[ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.39' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 28.940713] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program [ 29.005675] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program [ 29.054915] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program [ 29.108552] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program [ 29.155195] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program executing program [ 29.205207] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. [ 29.244553] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program [ 29.304427] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program executing program [ 29.354827] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. [ 29.385190] netlink: 4 bytes leftover after parsing attributes in process `syz-executor452'. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 29.847254] refcount_t: underflow; use-after-free. [ 29.852562] ------------[ cut here ]------------ [ 29.857311] WARNING: CPU: 0 PID: 8096 at lib/refcount.c:281 refcount_dec_not_one.cold+0x18/0x25 [ 29.866136] Kernel panic - not syncing: panic_on_warn set ... [ 29.866136] [ 29.873473] CPU: 0 PID: 8096 Comm: systemd-udevd Not tainted 4.14.224-syzkaller #0 [ 29.881153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.890489] Call Trace: [ 29.893080] dump_stack+0x1b2/0x281 [ 29.896772] panic+0x1f9/0x42d [ 29.899944] ? add_taint.cold+0x16/0x16 [ 29.903895] ? refcount_dec_not_one.cold+0x18/0x25 [ 29.908799] ? refcount_dec_not_one.cold+0x18/0x25 [ 29.913711] __warn.cold+0x20/0x44 [ 29.917242] ? ist_end_non_atomic+0x10/0x10 [ 29.921558] ? refcount_dec_not_one.cold+0x18/0x25 [ 29.926464] report_bug+0x208/0x250 [ 29.930069] do_error_trap+0x195/0x2d0 [ 29.933954] ? math_error+0x2d0/0x2d0 [ 29.937734] ? ___preempt_schedule+0x16/0x18 [ 29.942120] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.946941] invalid_op+0x1b/0x40 [ 29.950387] RIP: 0010:refcount_dec_not_one.cold+0x18/0x25 [ 29.955903] RSP: 0018:ffff88809678fc38 EFLAGS: 00010286 [ 29.961267] RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000000 [ 29.968520] RDX: 0000000000000000 RSI: ffffffff878bbb80 RDI: ffffed1012cf1f7d [ 29.975764] RBP: ffff8880b3525198 R08: 0000000000000026 R09: 0000000000000000 [ 29.983014] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff [ 29.990261] R13: 0000000000000000 R14: ffffed1011bea656 R15: ffff8880b35251a8 [ 29.997519] ? refcount_dec_not_one.cold+0x18/0x25 [ 30.002427] ? trace_hardirqs_on_caller+0x3a8/0x580 [ 30.007422] refcount_dec_and_mutex_lock+0x1a/0x60 [ 30.012331] nbd_config_put+0x506/0x810 [ 30.016380] nbd_release+0xdf/0x150 [ 30.020003] ? nbd_queue_rq+0xc50/0xc50 [ 30.023970] __blkdev_put+0x5aa/0x800 [ 30.027755] ? revalidate_disk+0x1f0/0x1f0 [ 30.031977] ? locks_remove_file+0x2cd/0x420 [ 30.036361] ? blkdev_put+0x75/0x4c0 [ 30.040052] ? blkdev_put+0x4c0/0x4c0 [ 30.043828] blkdev_close+0x86/0xb0 [ 30.047521] __fput+0x25f/0x7a0 [ 30.050782] task_work_run+0x11f/0x190 [ 30.054647] exit_to_usermode_loop+0x1ad/0x200 [ 30.059205] do_syscall_64+0x4a3/0x640 [ 30.063084] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 30.068254] RIP: 0033:0x7fde6e80e270 [ 30.071985] RSP: 002b:00007ffc89395aa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 30.079670] RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007fde6e80e270 [ 30.086919] RDX: 000000000aba9500 RSI: 0000000000000000 RDI: 0000000000000007 [ 30.094175] RBP: 00007fde6f6c7710 R08: 0000000000000045 R09: 0000000000000018 [ 30.101524] R10: 0000558d3f7d6c28 R11: 0000000000000246 R12: 0000000000000000 [ 30.108778] R13: 0000558d3f7d4550 R14: 0000000000000003 R15: 000000000000000e [ 30.116927] Kernel Offset: disabled [ 30.120580] Rebooting in 86400 seconds..