INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.17' (ECDSA) to the list of known hosts. 2018/04/15 16:05:57 parsed 1 programs 2018/04/15 16:05:57 executed programs: 0 syzkaller login: [ 27.018275] IPVS: Creating netns size=2536 id=1 [ 27.039984] IPVS: Creating netns size=2536 id=2 [ 27.050873] IPVS: Creating netns size=2536 id=3 [ 27.062064] IPVS: Creating netns size=2536 id=4 [ 27.093333] IPVS: Creating netns size=2536 id=5 [ 27.110665] IPVS: Creating netns size=2536 id=6 [ 27.161300] IPVS: Creating netns size=2536 id=7 [ 27.222762] IPVS: Creating netns size=2536 id=8 [ 27.472252] ================================================================== [ 27.479653] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 27.486384] Read of size 8 at addr ffff8801d835eb60 by task blkid/3946 [ 27.493022] [ 27.494629] CPU: 1 PID: 3946 Comm: blkid Not tainted 4.9.94-g8683408 #3 [ 27.501371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.510705] ffff8801d7a6f6d8 ffffffff81d9b509 ffffea000760d600 ffff8801d835eb60 [ 27.518742] 0000000000000000 ffff8801d835eb60 0000000000000000 ffff8801d7a6f710 [ 27.526779] ffffffff815652cb ffff8801d835eb60 0000000000000008 0000000000000000 [ 27.534781] Call Trace: [ 27.537439] [] dump_stack+0xc1/0x128 [ 27.542780] [] print_address_description+0x6c/0x234 [ 27.549438] [] kasan_report.cold.6+0x242/0x2fe [ 27.555648] [] ? disk_unblock_events+0x51/0x60 [ 27.561865] [] __asan_report_load8_noabort+0x14/0x20 [ 27.568601] [] disk_unblock_events+0x51/0x60 [ 27.574648] [] __blkdev_get+0x6b6/0xd60 [ 27.580252] [] ? __blkdev_put+0x840/0x840 [ 27.586030] [] ? fsnotify+0x114/0x1100 [ 27.591555] [] blkdev_get+0x2da/0x920 [ 27.596987] [] ? bd_may_claim+0xd0/0xd0 [ 27.602689] [] ? bd_acquire+0x27/0x250 [ 27.608206] [] ? bd_acquire+0x88/0x250 [ 27.613748] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.619784] [] blkdev_open+0x1a5/0x250 [ 27.625298] [] do_dentry_open+0x703/0xc80 [ 27.631075] [] ? blkdev_get_by_dev+0x70/0x70 [ 27.637115] [] vfs_open+0x11c/0x210 [ 27.642380] [] ? may_open.isra.57+0x14f/0x2a0 [ 27.648505] [] path_openat+0x758/0x3590 [ 27.654108] [] ? save_stack+0xa9/0xd0 [ 27.659544] [] ? path_lookupat.isra.41+0x410/0x410 [ 27.666138] [] ? __lock_is_held+0xa2/0xf0 [ 27.671926] [] do_filp_open+0x197/0x270 [ 27.677538] [] ? may_open_dev+0xe0/0xe0 [ 27.683145] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.689115] [] ? __alloc_fd+0x1d7/0x4a0 [ 27.694722] [] do_sys_open+0x30d/0x5c0 [ 27.700235] [] ? filp_open+0x70/0x70 [ 27.705576] [] ? up_read+0x1a/0x40 [ 27.710746] [] ? __do_page_fault+0x183/0xd50 [ 27.716781] [] SyS_open+0x2d/0x40 [ 27.721865] [] ? do_sys_open+0x5c0/0x5c0 [ 27.727650] [] do_syscall_64+0x1a6/0x490 [ 27.733440] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 27.740425] [ 27.742037] Allocated by task 3940: [ 27.745732] save_stack_trace+0x16/0x20 [ 27.749683] save_stack+0x43/0xd0 [ 27.753208] kasan_kmalloc+0xc7/0xe0 [ 27.756999] kmem_cache_alloc_trace+0xfd/0x2b0 [ 27.761559] alloc_disk_node+0x54/0x3a0 [ 27.765524] alloc_disk+0x18/0x20 [ 27.768955] loop_add+0x33b/0x770 [ 27.772386] loop_probe+0x14f/0x180 [ 27.775986] kobj_lookup+0x223/0x410 [ 27.779671] get_gendisk+0x39/0x2d0 [ 27.783273] __blkdev_get+0x351/0xd60 [ 27.787056] blkdev_get+0x2da/0x920 [ 27.790656] blkdev_open+0x1a5/0x250 [ 27.794349] do_dentry_open+0x703/0xc80 [ 27.798298] vfs_open+0x11c/0x210 [ 27.801727] path_openat+0x758/0x3590 [ 27.805507] do_filp_open+0x197/0x270 [ 27.809283] do_sys_open+0x30d/0x5c0 [ 27.812976] compat_SyS_open+0x2a/0x40 [ 27.816837] do_fast_syscall_32+0x2f7/0x870 [ 27.821136] entry_SYSENTER_compat+0x90/0xa2 [ 27.825515] [ 27.827114] Freed by task 3946: [ 27.830366] save_stack_trace+0x16/0x20 [ 27.834314] save_stack+0x43/0xd0 [ 27.837761] kasan_slab_free+0x72/0xc0 [ 27.841636] kfree+0xfb/0x310 [ 27.844901] disk_release+0x259/0x330 [ 27.848688] device_release+0x7e/0x220 [ 27.852637] kobject_release+0x103/0x1b0 [ 27.856671] kobject_put+0x6d/0xd0 [ 27.860183] put_disk+0x23/0x30 [ 27.863435] __blkdev_get+0x616/0xd60 [ 27.867206] blkdev_get+0x2da/0x920 [ 27.871149] blkdev_open+0x1a5/0x250 [ 27.874842] do_dentry_open+0x703/0xc80 [ 27.878787] vfs_open+0x11c/0x210 [ 27.882211] path_openat+0x758/0x3590 [ 27.885984] do_filp_open+0x197/0x270 [ 27.890302] do_sys_open+0x30d/0x5c0 [ 27.893994] SyS_open+0x2d/0x40 [ 27.897253] do_syscall_64+0x1a6/0x490 [ 27.901118] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 27.906187] [ 27.907789] The buggy address belongs to the object at ffff8801d835e600 [ 27.907789] which belongs to the cache kmalloc-2048 of size 2048 [ 27.920593] The buggy address is located 1376 bytes inside of [ 27.920593] 2048-byte region [ffff8801d835e600, ffff8801d835ee00) [ 27.932697] The buggy address belongs to the page: [ 27.938158] page:ffffea000760d600 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 27.948427] flags: 0x8000000000004080(slab|head) [ 27.953150] page dumped because: kasan: bad access detected [ 27.958839] [ 27.960441] Memory state around the buggy address: [ 27.965345] ffff8801d835ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.972678] ffff8801d835ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.980031] >ffff8801d835eb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.987363] ^ [ 27.993834] ffff8801d835eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.001164] ffff8801d835ec00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.009010] ================================================================== [ 28.016344] Disabling lock debugging due to kernel taint [ 28.022981] Kernel panic - not syncing: panic_on_warn set ... [ 28.022981] [ 28.030339] CPU: 1 PID: 3946 Comm: blkid Tainted: G B 4.9.94-g8683408 #3 [ 28.038296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.047631] ffff8801d7a6f638 ffffffff81d9b509 ffffffff841a8a65 00000000ffffffff [ 28.055654] 0000000000000000 0000000000000001 0000000000000000 ffff8801d7a6f6f8 [ 28.063764] ffffffff8141f845 0000000041b58ab3 ffffffff8419c168 ffffffff8141f686 [ 28.071765] Call Trace: [ 28.074336] [] dump_stack+0xc1/0x128 [ 28.079679] [] panic+0x1bf/0x3bc [ 28.084674] [] ? add_taint.cold.6+0x16/0x16 [ 28.090642] [] ? ___preempt_schedule+0x16/0x18 [ 28.096856] [] kasan_end_report+0x47/0x4f [ 28.102640] [] kasan_report.cold.6+0x76/0x2fe [ 28.108764] [] ? disk_unblock_events+0x51/0x60 [ 28.114975] [] __asan_report_load8_noabort+0x14/0x20 [ 28.121714] [] disk_unblock_events+0x51/0x60 [ 28.127752] [] __blkdev_get+0x6b6/0xd60 [ 28.133389] [] ? __blkdev_put+0x840/0x840 [ 28.139199] [] ? fsnotify+0x114/0x1100 [ 28.144714] [] blkdev_get+0x2da/0x920 [ 28.150147] [] ? bd_may_claim+0xd0/0xd0 [ 28.155749] [] ? bd_acquire+0x27/0x250 [ 28.161280] [] ? bd_acquire+0x88/0x250 [ 28.166797] [] ? _raw_spin_unlock+0x2c/0x50 [ 28.172746] [] blkdev_open+0x1a5/0x250 [ 28.178369] [] do_dentry_open+0x703/0xc80 [ 28.184146] [] ? blkdev_get_by_dev+0x70/0x70 [ 28.190191] [] vfs_open+0x11c/0x210 [ 28.195679] [] ? may_open.isra.57+0x14f/0x2a0 [ 28.201804] [] path_openat+0x758/0x3590 [ 28.207405] [] ? save_stack+0xa9/0xd0 [ 28.212837] [] ? path_lookupat.isra.41+0x410/0x410 [ 28.219398] [] ? __lock_is_held+0xa2/0xf0 [ 28.225173] [] do_filp_open+0x197/0x270 [ 28.230775] [] ? may_open_dev+0xe0/0xe0 [ 28.236389] [] ? _raw_spin_unlock+0x2c/0x50 [ 28.242339] [] ? __alloc_fd+0x1d7/0x4a0 [ 28.247955] [] do_sys_open+0x30d/0x5c0 [ 28.253470] [] ? filp_open+0x70/0x70 [ 28.258822] [] ? up_read+0x1a/0x40 [ 28.263994] [] ? __do_page_fault+0x183/0xd50 [ 28.270032] [] SyS_open+0x2d/0x40 [ 28.275121] [] ? do_sys_open+0x5c0/0x5c0 [ 28.280811] [] do_syscall_64+0x1a6/0x490 [ 28.286499] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 28.294029] Dumping ftrace buffer: [ 28.297576] (ftrace buffer empty) [ 28.301266] Kernel Offset: disabled [ 28.304874] Rebooting in 86400 seconds..