INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.45' (ECDSA) to the list of known hosts. 2018/04/21 14:43:00 parsed 1 programs 2018/04/21 14:43:00 executed programs: 0 syzkaller login: [ 51.032738] IPVS: Creating netns size=2536 id=1 [ 51.053161] IPVS: Creating netns size=2536 id=2 [ 51.063622] IPVS: Creating netns size=2536 id=3 [ 51.083925] IPVS: Creating netns size=2536 id=4 [ 51.106870] IPVS: Creating netns size=2536 id=5 [ 51.130105] IPVS: Creating netns size=2536 id=6 [ 51.156293] IPVS: Creating netns size=2536 id=7 [ 51.193057] IPVS: Creating netns size=2536 id=8 [ 51.366440] ================================================================== [ 51.373863] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 51.380586] Read of size 8 at addr ffff8801b4644960 by task syz-executor7/3941 [ 51.387922] [ 51.389525] CPU: 1 PID: 3941 Comm: syz-executor7 Not tainted 4.9.95-gee0bcd6 #6 [ 51.396940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.406266] ffff8801b4b076c8 ffffffff81eb0f89 ffffea0006d19000 ffff8801b4644960 [ 51.414249] 0000000000000000 ffff8801b4644960 0000000000000000 ffff8801b4b07700 [ 51.422222] ffffffff815653cb ffff8801b4644960 0000000000000008 0000000000000000 [ 51.430229] Call Trace: [ 51.432795] [] dump_stack+0xc1/0x128 [ 51.438143] [] print_address_description+0x6c/0x234 [ 51.444787] [] kasan_report.cold.6+0x242/0x2fe [ 51.451000] [] ? disk_unblock_events+0x51/0x60 [ 51.457204] [] __asan_report_load8_noabort+0x14/0x20 [ 51.463935] [] disk_unblock_events+0x51/0x60 [ 51.469965] [] __blkdev_get+0x6b6/0xd60 [ 51.475558] [] ? __blkdev_put+0x840/0x840 [ 51.481325] [] ? fsnotify+0x114/0x1100 [ 51.486831] [] blkdev_get+0x2da/0x920 [ 51.492253] [] ? bd_may_claim+0xd0/0xd0 [ 51.497859] [] ? bd_acquire+0x27/0x250 [ 51.503376] [] ? bd_acquire+0x88/0x250 [ 51.508894] [] ? _raw_spin_unlock+0x2c/0x50 [ 51.514838] [] blkdev_open+0x1a5/0x250 [ 51.520343] [] do_dentry_open+0x703/0xc80 [ 51.526111] [] ? blkdev_get_by_dev+0x70/0x70 [ 51.532150] [] vfs_open+0x11c/0x210 [ 51.537397] [] ? may_open.isra.57+0x14f/0x2a0 [ 51.543513] [] path_openat+0x758/0x3590 [ 51.549110] [] ? save_stack+0xa9/0xd0 [ 51.554539] [] ? path_lookupat.isra.41+0x410/0x410 [ 51.561103] [] ? __lock_is_held+0xa2/0xf0 [ 51.566872] [] do_filp_open+0x197/0x270 [ 51.572478] [] ? may_open_dev+0xe0/0xe0 [ 51.578086] [] ? _raw_spin_unlock+0x2c/0x50 [ 51.584046] [] ? __alloc_fd+0x1d7/0x4a0 [ 51.589651] [] do_sys_open+0x30d/0x5c0 [ 51.595159] [] ? filp_open+0x70/0x70 [ 51.600502] [] ? up_read+0x1a/0x40 [ 51.605661] [] compat_SyS_open+0x2a/0x40 [ 51.611353] [] ? compat_SyS_getdents64+0x280/0x280 [ 51.617902] [] do_fast_syscall_32+0x2f7/0x870 [ 51.624019] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 51.630666] [] entry_SYSENTER_compat+0x90/0xa2 [ 51.636867] [ 51.638464] Allocated by task 3938: [ 51.642062] save_stack_trace+0x16/0x20 [ 51.646007] save_stack+0x43/0xd0 [ 51.649440] kasan_kmalloc+0xc7/0xe0 [ 51.653138] kmem_cache_alloc_trace+0xfd/0x2b0 [ 51.657698] alloc_disk_node+0x54/0x3a0 [ 51.661641] alloc_disk+0x18/0x20 [ 51.665067] loop_add+0x33b/0x770 [ 51.668496] loop_probe+0x14f/0x180 [ 51.672094] kobj_lookup+0x223/0x410 [ 51.675781] get_gendisk+0x39/0x2d0 [ 51.679390] __blkdev_get+0x351/0xd60 [ 51.683161] blkdev_get+0x2da/0x920 [ 51.686757] blkdev_open+0x1a5/0x250 [ 51.690438] do_dentry_open+0x703/0xc80 [ 51.694379] vfs_open+0x11c/0x210 [ 51.697801] path_openat+0x758/0x3590 [ 51.701571] do_filp_open+0x197/0x270 [ 51.705351] do_sys_open+0x30d/0x5c0 [ 51.709046] compat_SyS_open+0x2a/0x40 [ 51.712902] do_fast_syscall_32+0x2f7/0x870 [ 51.717196] entry_SYSENTER_compat+0x90/0xa2 [ 51.721572] [ 51.723191] Freed by task 3941: [ 51.726439] save_stack_trace+0x16/0x20 [ 51.730382] save_stack+0x43/0xd0 [ 51.733804] kasan_slab_free+0x72/0xc0 [ 51.737670] kfree+0xfb/0x310 [ 51.740756] disk_release+0x259/0x330 [ 51.744539] device_release+0x7e/0x220 [ 51.748397] kobject_release+0x103/0x1b0 [ 51.752427] kobject_put+0x6d/0xd0 [ 51.755940] put_disk+0x23/0x30 [ 51.759191] __blkdev_get+0x616/0xd60 [ 51.762968] blkdev_get+0x2da/0x920 [ 51.766565] blkdev_open+0x1a5/0x250 [ 51.770258] do_dentry_open+0x703/0xc80 [ 51.774214] vfs_open+0x11c/0x210 [ 51.777640] path_openat+0x758/0x3590 [ 51.781419] do_filp_open+0x197/0x270 [ 51.785197] do_sys_open+0x30d/0x5c0 [ 51.788880] compat_SyS_open+0x2a/0x40 [ 51.792746] do_fast_syscall_32+0x2f7/0x870 [ 51.797046] entry_SYSENTER_compat+0x90/0xa2 [ 51.801423] [ 51.803022] The buggy address belongs to the object at ffff8801b4644400 [ 51.803022] which belongs to the cache kmalloc-2048 of size 2048 [ 51.815830] The buggy address is located 1376 bytes inside of [ 51.815830] 2048-byte region [ffff8801b4644400, ffff8801b4644c00) [ 51.827856] The buggy address belongs to the page: [ 51.832766] page:ffffea0006d19000 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 51.842954] flags: 0x8000000000004080(slab|head) [ 51.847686] page dumped because: kasan: bad access detected [ 51.853365] [ 51.854964] Memory state around the buggy address: [ 51.859864] ffff8801b4644800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 51.867195] ffff8801b4644880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 51.874525] >ffff8801b4644900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 51.881853] ^ [ 51.888312] ffff8801b4644980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 51.895652] ffff8801b4644a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 51.902991] ================================================================== [ 51.910316] Disabling lock debugging due to kernel taint [ 51.916031] Kernel panic - not syncing: panic_on_warn set ... [ 51.916031] [ 51.923368] CPU: 1 PID: 3941 Comm: syz-executor7 Tainted: G B 4.9.95-gee0bcd6 #6 [ 51.931998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.941333] ffff8801b4b07628 ffffffff81eb0f89 ffffffff841c45f5 00000000ffffffff [ 51.949325] 0000000000000000 0000000000000001 0000000000000000 ffff8801b4b076e8 [ 51.957302] ffffffff8141f945 0000000041b58ab3 ffffffff841b7cf8 ffffffff8141f786 [ 51.965281] Call Trace: [ 51.967858] [] dump_stack+0xc1/0x128 [ 51.973197] [] panic+0x1bf/0x3bc [ 51.978187] [] ? add_taint.cold.6+0x16/0x16 [ 51.984142] [] ? ___preempt_schedule+0x16/0x18 [ 51.990356] [] kasan_end_report+0x47/0x4f [ 51.996126] [] kasan_report.cold.6+0x76/0x2fe [ 52.002244] [] ? disk_unblock_events+0x51/0x60 [ 52.008458] [] __asan_report_load8_noabort+0x14/0x20 [ 52.015193] [] disk_unblock_events+0x51/0x60 [ 52.021237] [] __blkdev_get+0x6b6/0xd60 [ 52.026831] [] ? __blkdev_put+0x840/0x840 [ 52.032608] [] ? fsnotify+0x114/0x1100 [ 52.038116] [] blkdev_get+0x2da/0x920 [ 52.043536] [] ? bd_may_claim+0xd0/0xd0 [ 52.049128] [] ? bd_acquire+0x27/0x250 [ 52.054633] [] ? bd_acquire+0x88/0x250 [ 52.060143] [] ? _raw_spin_unlock+0x2c/0x50 [ 52.066085] [] blkdev_open+0x1a5/0x250 [ 52.071724] [] do_dentry_open+0x703/0xc80 [ 52.077504] [] ? blkdev_get_by_dev+0x70/0x70 [ 52.083541] [] vfs_open+0x11c/0x210 [ 52.088803] [] ? may_open.isra.57+0x14f/0x2a0 [ 52.094921] [] path_openat+0x758/0x3590 [ 52.100515] [] ? save_stack+0xa9/0xd0 [ 52.105937] [] ? path_lookupat.isra.41+0x410/0x410 [ 52.112486] [] ? __lock_is_held+0xa2/0xf0 [ 52.118253] [] do_filp_open+0x197/0x270 [ 52.123850] [] ? may_open_dev+0xe0/0xe0 [ 52.129446] [] ? _raw_spin_unlock+0x2c/0x50 [ 52.135387] [] ? __alloc_fd+0x1d7/0x4a0 [ 52.140981] [] do_sys_open+0x30d/0x5c0 [ 52.146577] [] ? filp_open+0x70/0x70 [ 52.151911] [] ? up_read+0x1a/0x40 [ 52.157072] [] compat_SyS_open+0x2a/0x40 [ 52.162767] [] ? compat_SyS_getdents64+0x280/0x280 [ 52.169328] [] do_fast_syscall_32+0x2f7/0x870 [ 52.175455] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 52.182095] [] entry_SYSENTER_compat+0x90/0xa2 [ 52.188703] Dumping ftrace buffer: [ 52.192218] (ftrace buffer empty) [ 52.195913] Kernel Offset: disabled [ 52.199521] Rebooting in 86400 seconds..