INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.11' (ECDSA) to the list of known hosts. 2018/04/19 06:33:17 parsed 1 programs 2018/04/19 06:33:17 executed programs: 0 syzkaller login: [ 107.168315] IPVS: Creating netns size=2536 id=1 [ 107.200168] IPVS: Creating netns size=2536 id=2 [ 107.237283] IPVS: Creating netns size=2536 id=3 [ 107.275995] IPVS: Creating netns size=2536 id=4 [ 107.309064] IPVS: Creating netns size=2536 id=5 [ 107.359498] IPVS: Creating netns size=2536 id=6 [ 107.422974] IPVS: Creating netns size=2536 id=7 [ 107.472272] IPVS: Creating netns size=2536 id=8 [ 108.309171] ================================================================== [ 108.316559] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 108.323282] Read of size 8 at addr ffff8801d45e3860 by task syz-executor3/4076 [ 108.330610] [ 108.332212] CPU: 0 PID: 4076 Comm: syz-executor3 Not tainted 4.9.94-g8683408 #3 [ 108.339626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 108.348953] ffff8801d46476d8 ffffffff81d9b509 ffffea0007517800 ffff8801d45e3860 [ 108.356934] 0000000000000000 ffff8801d45e3860 0000000000000000 ffff8801d4647710 [ 108.364915] ffffffff815652cb ffff8801d45e3860 0000000000000008 0000000000000000 [ 108.372890] Call Trace: [ 108.375451] [] dump_stack+0xc1/0x128 [ 108.380787] [] print_address_description+0x6c/0x234 [ 108.387422] [] kasan_report.cold.6+0x242/0x2fe [ 108.393624] [] ? disk_unblock_events+0x51/0x60 [ 108.399826] [] __asan_report_load8_noabort+0x14/0x20 [ 108.406548] [] disk_unblock_events+0x51/0x60 [ 108.412583] [] __blkdev_get+0x6b6/0xd60 [ 108.418177] [] ? __blkdev_put+0x840/0x840 [ 108.423945] [] ? fsnotify+0x114/0x1100 [ 108.429452] [] blkdev_get+0x2da/0x920 [ 108.434873] [] ? bd_may_claim+0xd0/0xd0 [ 108.440464] [] ? bd_acquire+0x27/0x250 [ 108.445972] [] ? bd_acquire+0x88/0x250 [ 108.451481] [] ? _raw_spin_unlock+0x2c/0x50 [ 108.457422] [] blkdev_open+0x1a5/0x250 [ 108.462929] [] do_dentry_open+0x703/0xc80 [ 108.468695] [] ? blkdev_get_by_dev+0x70/0x70 [ 108.474731] [] vfs_open+0x11c/0x210 [ 108.479979] [] ? may_open.isra.57+0x14f/0x2a0 [ 108.486093] [] path_openat+0x758/0x3590 [ 108.491685] [] ? save_stack+0xa9/0xd0 [ 108.497105] [] ? path_lookupat.isra.41+0x410/0x410 [ 108.503659] [] ? __lock_is_held+0xa2/0xf0 [ 108.509446] [] do_filp_open+0x197/0x270 [ 108.515041] [] ? may_open_dev+0xe0/0xe0 [ 108.520637] [] ? _raw_spin_unlock+0x2c/0x50 [ 108.526582] [] ? __alloc_fd+0x1d7/0x4a0 [ 108.532184] [] do_sys_open+0x30d/0x5c0 [ 108.537690] [] ? filp_open+0x70/0x70 [ 108.543025] [] ? up_read+0x1a/0x40 [ 108.548202] [] ? __do_page_fault+0x183/0xd50 [ 108.554237] [] ? from_kgid+0x250/0x250 [ 108.559742] [] SyS_open+0x2d/0x40 [ 108.564813] [] ? do_sys_open+0x5c0/0x5c0 [ 108.570494] [] do_syscall_64+0x1a6/0x490 [ 108.576353] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 108.583253] [ 108.584852] Allocated by task 4076: [ 108.588462] save_stack_trace+0x16/0x20 [ 108.592405] save_stack+0x43/0xd0 [ 108.595828] kasan_kmalloc+0xc7/0xe0 [ 108.599511] kmem_cache_alloc_trace+0xfd/0x2b0 [ 108.604066] alloc_disk_node+0x54/0x3a0 [ 108.608008] alloc_disk+0x18/0x20 [ 108.611430] loop_add+0x33b/0x770 [ 108.614851] loop_control_ioctl+0x136/0x300 [ 108.619154] do_vfs_ioctl+0x1ac/0x11a0 [ 108.623007] SyS_ioctl+0x8f/0xc0 [ 108.626343] do_syscall_64+0x1a6/0x490 [ 108.630204] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 108.635272] [ 108.636869] Freed by task 4076: [ 108.640119] save_stack_trace+0x16/0x20 [ 108.644060] save_stack+0x43/0xd0 [ 108.647482] kasan_slab_free+0x72/0xc0 [ 108.651340] kfree+0xfb/0x310 [ 108.654425] disk_release+0x259/0x330 [ 108.658195] device_release+0x7e/0x220 [ 108.662052] kobject_release+0x103/0x1b0 [ 108.666081] kobject_put+0x6d/0xd0 [ 108.669594] put_disk+0x23/0x30 [ 108.673323] __blkdev_get+0x616/0xd60 [ 108.677092] blkdev_get+0x2da/0x920 [ 108.680686] blkdev_open+0x1a5/0x250 [ 108.684370] do_dentry_open+0x703/0xc80 [ 108.688321] vfs_open+0x11c/0x210 [ 108.691744] path_openat+0x758/0x3590 [ 108.695514] do_filp_open+0x197/0x270 [ 108.699282] do_sys_open+0x30d/0x5c0 [ 108.702966] SyS_open+0x2d/0x40 [ 108.706215] do_syscall_64+0x1a6/0x490 [ 108.710162] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 108.715231] [ 108.716828] The buggy address belongs to the object at ffff8801d45e3300 [ 108.716828] which belongs to the cache kmalloc-2048 of size 2048 [ 108.729635] The buggy address is located 1376 bytes inside of [ 108.729635] 2048-byte region [ffff8801d45e3300, ffff8801d45e3b00) [ 108.741658] The buggy address belongs to the page: [ 108.746558] page:ffffea0007517800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 108.756740] flags: 0x8000000000004080(slab|head) [ 108.761461] page dumped because: kasan: bad access detected [ 108.767140] [ 108.768736] Memory state around the buggy address: [ 108.773633] ffff8801d45e3700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.780964] ffff8801d45e3780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.788292] >ffff8801d45e3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.795625] ^ [ 108.802088] ffff8801d45e3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.809426] ffff8801d45e3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.816756] ================================================================== [ 108.824101] Disabling lock debugging due to kernel taint [ 108.829989] Kernel panic - not syncing: panic_on_warn set ... [ 108.829989] [ 108.837339] CPU: 0 PID: 4076 Comm: syz-executor3 Tainted: G B 4.9.94-g8683408 #3 [ 108.845978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 108.855307] ffff8801d4647638 ffffffff81d9b509 ffffffff841a8a65 00000000ffffffff [ 108.863287] 0000000000000000 0000000000000000 0000000000000000 ffff8801d46476f8 [ 108.871281] ffffffff8141f845 0000000041b58ab3 ffffffff8419c168 ffffffff8141f686 [ 108.879251] Call Trace: [ 108.881815] [] dump_stack+0xc1/0x128 [ 108.887150] [] panic+0x1bf/0x3bc [ 108.892144] [] ? add_taint.cold.6+0x16/0x16 [ 108.898086] [] ? ___preempt_schedule+0x16/0x18 [ 108.904304] [] kasan_end_report+0x47/0x4f [ 108.910072] [] kasan_report.cold.6+0x76/0x2fe [ 108.916186] [] ? disk_unblock_events+0x51/0x60 [ 108.922391] [] __asan_report_load8_noabort+0x14/0x20 [ 108.929117] [] disk_unblock_events+0x51/0x60 [ 108.935146] [] __blkdev_get+0x6b6/0xd60 [ 108.940738] [] ? __blkdev_put+0x840/0x840 [ 108.946505] [] ? fsnotify+0x114/0x1100 [ 108.952014] [] blkdev_get+0x2da/0x920 [ 108.957433] [] ? bd_may_claim+0xd0/0xd0 [ 108.963027] [] ? bd_acquire+0x27/0x250 [ 108.968535] [] ? bd_acquire+0x88/0x250 [ 108.974042] [] ? _raw_spin_unlock+0x2c/0x50 [ 108.979993] [] blkdev_open+0x1a5/0x250 [ 108.985501] [] do_dentry_open+0x703/0xc80 [ 108.991268] [] ? blkdev_get_by_dev+0x70/0x70 [ 108.997306] [] vfs_open+0x11c/0x210 [ 109.002554] [] ? may_open.isra.57+0x14f/0x2a0 [ 109.008668] [] path_openat+0x758/0x3590 [ 109.014261] [] ? save_stack+0xa9/0xd0 [ 109.019682] [] ? path_lookupat.isra.41+0x410/0x410 [ 109.026247] [] ? __lock_is_held+0xa2/0xf0 [ 109.032016] [] do_filp_open+0x197/0x270 [ 109.037610] [] ? may_open_dev+0xe0/0xe0 [ 109.043216] [] ? _raw_spin_unlock+0x2c/0x50 [ 109.049183] [] ? __alloc_fd+0x1d7/0x4a0 [ 109.054789] [] do_sys_open+0x30d/0x5c0 [ 109.060308] [] ? filp_open+0x70/0x70 [ 109.065646] [] ? up_read+0x1a/0x40 [ 109.070810] [] ? __do_page_fault+0x183/0xd50 [ 109.076842] [] ? from_kgid+0x250/0x250 [ 109.082350] [] SyS_open+0x2d/0x40 [ 109.087429] [] ? do_sys_open+0x5c0/0x5c0 [ 109.093117] [] do_syscall_64+0x1a6/0x490 [ 109.098802] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 109.106172] Dumping ftrace buffer: [ 109.109686] (ftrace buffer empty) [ 109.113368] Kernel Offset: disabled [ 109.116966] Rebooting in 86400 seconds..