INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.29' (ECDSA) to the list of known hosts. 2018/04/21 14:44:54 parsed 1 programs 2018/04/21 14:44:54 executed programs: 0 syzkaller login: [ 26.156457] IPVS: Creating netns size=2536 id=1 [ 26.177678] IPVS: Creating netns size=2536 id=2 [ 26.210168] IPVS: Creating netns size=2536 id=3 [ 26.242995] IPVS: Creating netns size=2536 id=4 [ 26.273634] IPVS: Creating netns size=2536 id=5 [ 26.300368] IPVS: Creating netns size=2536 id=6 [ 26.343551] IPVS: Creating netns size=2536 id=7 [ 26.363160] IPVS: Creating netns size=2536 id=8 [ 26.502606] ================================================================== [ 26.510012] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 26.516740] Read of size 8 at addr ffff8801d89ffc60 by task blkid/3901 [ 26.523375] [ 26.524976] CPU: 1 PID: 3901 Comm: blkid Not tainted 4.9.95-gee0bcd6 #6 [ 26.531700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.541034] ffff8801d86d76d8 ffffffff81eb0f89 ffffea0007627e00 ffff8801d89ffc60 [ 26.549012] 0000000000000000 ffff8801d89ffc60 0000000000000000 ffff8801d86d7710 [ 26.557004] ffffffff815653cb ffff8801d89ffc60 0000000000000008 0000000000000000 [ 26.564990] Call Trace: [ 26.567554] [] dump_stack+0xc1/0x128 [ 26.572893] [] print_address_description+0x6c/0x234 [ 26.579530] [] kasan_report.cold.6+0x242/0x2fe [ 26.585740] [] ? disk_unblock_events+0x51/0x60 [ 26.591956] [] __asan_report_load8_noabort+0x14/0x20 [ 26.598685] [] disk_unblock_events+0x51/0x60 [ 26.604719] [] __blkdev_get+0x6b6/0xd60 [ 26.610315] [] ? __blkdev_put+0x840/0x840 [ 26.616087] [] ? fsnotify+0x114/0x1100 [ 26.621607] [] blkdev_get+0x2da/0x920 [ 26.627653] [] ? bd_may_claim+0xd0/0xd0 [ 26.633249] [] ? bd_acquire+0x27/0x250 [ 26.638760] [] ? bd_acquire+0x88/0x250 [ 26.644279] [] ? _raw_spin_unlock+0x2c/0x50 [ 26.650222] [] blkdev_open+0x1a5/0x250 [ 26.655733] [] do_dentry_open+0x703/0xc80 [ 26.661512] [] ? blkdev_get_by_dev+0x70/0x70 [ 26.667543] [] vfs_open+0x11c/0x210 [ 26.672794] [] ? may_open.isra.57+0x14f/0x2a0 [ 26.678909] [] path_openat+0x758/0x3590 [ 26.684514] [] ? save_stack+0xa9/0xd0 [ 26.689935] [] ? path_lookupat.isra.41+0x410/0x410 [ 26.696499] [] ? __lock_is_held+0xa2/0xf0 [ 26.702273] [] do_filp_open+0x197/0x270 [ 26.707868] [] ? may_open_dev+0xe0/0xe0 [ 26.713467] [] ? _raw_spin_unlock+0x2c/0x50 [ 26.719412] [] ? __alloc_fd+0x1d7/0x4a0 [ 26.725012] [] do_sys_open+0x30d/0x5c0 [ 26.730521] [] ? filp_open+0x70/0x70 [ 26.735859] [] ? up_read+0x1a/0x40 [ 26.741025] [] ? __do_page_fault+0x183/0xd50 [ 26.747058] [] SyS_open+0x2d/0x40 [ 26.752130] [] ? do_sys_open+0x5c0/0x5c0 [ 26.757814] [] do_syscall_64+0x1a6/0x490 [ 26.763500] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 26.770396] [ 26.771995] Allocated by task 3882: [ 26.775595] save_stack_trace+0x16/0x20 [ 26.779538] save_stack+0x43/0xd0 [ 26.782964] kasan_kmalloc+0xc7/0xe0 [ 26.786658] kmem_cache_alloc_trace+0xfd/0x2b0 [ 26.791214] alloc_disk_node+0x54/0x3a0 [ 26.795156] alloc_disk+0x18/0x20 [ 26.798582] loop_add+0x33b/0x770 [ 26.802006] loop_probe+0x14f/0x180 [ 26.805606] kobj_lookup+0x223/0x410 [ 26.809289] get_gendisk+0x39/0x2d0 [ 26.812895] __blkdev_get+0x351/0xd60 [ 26.816673] blkdev_get+0x2da/0x920 [ 26.820268] blkdev_open+0x1a5/0x250 [ 26.823955] do_dentry_open+0x703/0xc80 [ 26.827898] vfs_open+0x11c/0x210 [ 26.831324] path_openat+0x758/0x3590 [ 26.835097] do_filp_open+0x197/0x270 [ 26.838868] do_sys_open+0x30d/0x5c0 [ 26.842553] SyS_open+0x2d/0x40 [ 26.845808] do_syscall_64+0x1a6/0x490 [ 26.849674] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 26.854744] [ 26.856353] Freed by task 3901: [ 26.859605] save_stack_trace+0x16/0x20 [ 26.863560] save_stack+0x43/0xd0 [ 26.866992] kasan_slab_free+0x72/0xc0 [ 26.870850] kfree+0xfb/0x310 [ 26.873931] disk_release+0x259/0x330 [ 26.877704] device_release+0x7e/0x220 [ 26.881563] kobject_release+0x103/0x1b0 [ 26.885592] kobject_put+0x6d/0xd0 [ 26.889100] put_disk+0x23/0x30 [ 26.892351] __blkdev_get+0x616/0xd60 [ 26.896122] blkdev_get+0x2da/0x920 [ 26.899718] blkdev_open+0x1a5/0x250 [ 26.903409] do_dentry_open+0x703/0xc80 [ 26.907364] vfs_open+0x11c/0x210 [ 26.910790] path_openat+0x758/0x3590 [ 26.914560] do_filp_open+0x197/0x270 [ 26.918332] do_sys_open+0x30d/0x5c0 [ 26.922029] SyS_open+0x2d/0x40 [ 26.925300] do_syscall_64+0x1a6/0x490 [ 26.929178] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 26.934259] [ 26.935860] The buggy address belongs to the object at ffff8801d89ff700 [ 26.935860] which belongs to the cache kmalloc-2048 of size 2048 [ 26.948660] The buggy address is located 1376 bytes inside of [ 26.948660] 2048-byte region [ffff8801d89ff700, ffff8801d89fff00) [ 26.960679] The buggy address belongs to the page: [ 26.965581] page:ffffea0007627e00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 26.975749] flags: 0x8000000000004080(slab|head) [ 26.980471] page dumped because: kasan: bad access detected [ 26.986148] [ 26.987745] Memory state around the buggy address: [ 26.992646] ffff8801d89ffb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.999982] ffff8801d89ffb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.007312] >ffff8801d89ffc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.014643] ^ [ 27.021103] ffff8801d89ffc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.028431] ffff8801d89ffd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.035759] ================================================================== [ 27.043086] Disabling lock debugging due to kernel taint [ 27.725439] Kernel panic - not syncing: panic_on_warn set ... [ 27.725439] [ 27.732844] CPU: 1 PID: 3901 Comm: blkid Tainted: G B 4.9.95-gee0bcd6 #6 [ 27.740785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.750112] ffff8801d86d7638 ffffffff81eb0f89 ffffffff841c45f5 00000000ffffffff [ 27.758094] 0000000000000000 0000000000000001 0000000000000000 ffff8801d86d76f8 [ 27.766069] ffffffff8141f945 0000000041b58ab3 ffffffff841b7cf8 ffffffff8141f786 [ 27.774049] Call Trace: [ 27.776615] [] dump_stack+0xc1/0x128 [ 27.781961] [] panic+0x1bf/0x3bc [ 27.786957] [] ? add_taint.cold.6+0x16/0x16 [ 27.793083] [] ? ___preempt_schedule+0x16/0x18 [ 27.799289] [] kasan_end_report+0x47/0x4f [ 27.805059] [] kasan_report.cold.6+0x76/0x2fe [ 27.811182] [] ? disk_unblock_events+0x51/0x60 [ 27.817388] [] __asan_report_load8_noabort+0x14/0x20 [ 27.824112] [] disk_unblock_events+0x51/0x60 [ 27.830143] [] __blkdev_get+0x6b6/0xd60 [ 27.835753] [] ? __blkdev_put+0x840/0x840 [ 27.841522] [] ? fsnotify+0x114/0x1100 [ 27.847034] [] blkdev_get+0x2da/0x920 [ 27.852456] [] ? bd_may_claim+0xd0/0xd0 [ 27.858052] [] ? bd_acquire+0x27/0x250 [ 27.863562] [] ? bd_acquire+0x88/0x250 [ 27.869075] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.875018] [] blkdev_open+0x1a5/0x250 [ 27.880529] [] do_dentry_open+0x703/0xc80 [ 27.886300] [] ? blkdev_get_by_dev+0x70/0x70 [ 27.892505] [] vfs_open+0x11c/0x210 [ 27.897753] [] ? may_open.isra.57+0x14f/0x2a0 [ 27.903871] [] path_openat+0x758/0x3590 [ 27.909467] [] ? save_stack+0xa9/0xd0 [ 27.914895] [] ? path_lookupat.isra.41+0x410/0x410 [ 27.921539] [] ? __lock_is_held+0xa2/0xf0 [ 27.927310] [] do_filp_open+0x197/0x270 [ 27.932908] [] ? may_open_dev+0xe0/0xe0 [ 27.938506] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.944460] [] ? __alloc_fd+0x1d7/0x4a0 [ 27.950057] [] do_sys_open+0x30d/0x5c0 [ 27.955567] [] ? filp_open+0x70/0x70 [ 27.960901] [] ? up_read+0x1a/0x40 [ 27.966066] [] ? __do_page_fault+0x183/0xd50 [ 27.972099] [] SyS_open+0x2d/0x40 [ 27.977173] [] ? do_sys_open+0x5c0/0x5c0 [ 27.982863] [] do_syscall_64+0x1a6/0x490 [ 27.988546] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 27.995868] Dumping ftrace buffer: [ 27.999381] (ftrace buffer empty) [ 28.003067] Kernel Offset: disabled [ 28.006667] Rebooting in 86400 seconds..