INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-next-kasan-gce-6,10.128.15.213' (ECDSA) to the list of known hosts. 2017/09/08 21:19:47 parsed 1 programs 2017/09/08 21:19:47 executed programs: 0 syzkaller login: [ 45.411623] refcount_t: underflow; use-after-free. [ 45.417289] ------------[ cut here ]------------ [ 45.422412] WARNING: CPU: 0 PID: 3187 at lib/refcount.c:186 refcount_sub_and_test+0x167/0x1b0 [ 45.431232] Kernel panic - not syncing: panic_on_warn set ... [ 45.431232] [ 45.438577] CPU: 0 PID: 3187 Comm: syz-executor6 Not tainted 4.13.0-next-20170908+ #18 [ 45.446643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.455982] Call Trace: [ 45.458556] dump_stack+0x194/0x257 [ 45.462159] ? arch_local_irq_restore+0x53/0x53 [ 45.466817] panic+0x1e4/0x417 [ 45.469981] ? __warn+0x1d9/0x1d9 [ 45.473402] ? show_regs_print_info+0x65/0x65 [ 45.477892] ? retint_kernel+0x10/0x10 [ 45.481762] ? refcount_sub_and_test+0x167/0x1b0 [ 45.486501] __warn+0x1c4/0x1d9 [ 45.489752] ? refcount_sub_and_test+0x169/0x1b0 [ 45.494478] ? refcount_sub_and_test+0x167/0x1b0 [ 45.499225] report_bug+0x211/0x2d0 [ 45.502830] fixup_bug+0x40/0x90 [ 45.506167] do_trap+0x260/0x390 [ 45.509516] do_error_trap+0x120/0x390 [ 45.513381] ? do_trap+0x390/0x390 [ 45.516890] ? refcount_sub_and_test+0x167/0x1b0 [ 45.521631] ? vprintk_emit+0x3ea/0x590 [ 45.525589] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 45.530406] do_invalid_op+0x1b/0x20 [ 45.534098] invalid_op+0x18/0x20 [ 45.537522] RIP: 0010:refcount_sub_and_test+0x167/0x1b0 [ 45.542852] RSP: 0018:ffff8801d01c6300 EFLAGS: 00010282 [ 45.548202] RAX: 0000000000000026 RBX: 0000000000000001 RCX: 0000000000000000 [ 45.555457] RDX: 0000000000000026 RSI: 1ffff1003a038c20 RDI: ffffed003a038c54 [ 45.562697] RBP: ffff8801d01c6390 R08: ffff8801d01c59f0 R09: 0000000000000000 [ 45.569937] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1003a038c61 [ 45.577182] R13: 00000000ffffff01 R14: 0000000000000100 R15: ffff8801ccdd82a4 [ 45.584451] ? refcount_inc+0x50/0x50 [ 45.588225] ? __sctp_outq_teardown+0xc7d/0x15a0 [ 45.592955] ? sctp_association_free+0x2d0/0x930 [ 45.597680] ? sctp_do_sm+0x28e7/0x6dd0 [ 45.601625] ? sctp_primitive_SHUTDOWN+0xa0/0xd0 [ 45.606348] ? sctp_close+0x3c6/0x980 [ 45.610122] ? inet_release+0xed/0x1c0 [ 45.614017] sctp_wfree+0x183/0x620 [ 45.617613] ? __sctp_write_space+0x910/0x910 [ 45.622083] skb_release_head_state+0x124/0x200 [ 45.626733] skb_release_all+0x15/0x60 [ 45.630597] consume_skb+0x153/0x490 [ 45.634282] ? sctp_chunk_put+0x99/0x420 [ 45.638326] ? alloc_skb_with_frags+0x710/0x710 [ 45.642980] ? sctp_chunk_hold+0x20/0x20 [ 45.647017] ? refcount_sub_and_test+0x115/0x1b0 [ 45.651744] ? refcount_inc+0x50/0x50 [ 45.655534] ? mark_held_locks+0xb2/0x100 [ 45.659654] ? sctp_datamsg_put+0x456/0x560 [ 45.663954] sctp_chunk_put+0x29c/0x420 [ 45.667899] ? sctp_chunk_hold+0x20/0x20 [ 45.671936] ? sctp_transport_dst_confirm+0x50/0x50 [ 45.676942] sctp_chunk_free+0x53/0x60 [ 45.680801] __sctp_outq_teardown+0xc7d/0x15a0 [ 45.685364] ? inet6_release+0x50/0x70 [ 45.689227] ? sctp_inq_set_th_handler+0x1b0/0x1b0 [ 45.694130] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 45.699119] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 45.704107] ? unwind_dump+0x4c0/0x4c0 [ 45.707963] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 45.712951] ? unwind_dump+0x4c0/0x4c0 [ 45.716830] ? check_noncircular+0x20/0x20 [ 45.721052] ? check_noncircular+0x20/0x20 [ 45.725254] ? unwind_get_return_address+0x61/0xa0 [ 45.730167] ? __save_stack_trace+0x61/0xd0 [ 45.734469] ? check_noncircular+0x20/0x20 [ 45.738683] ? print_usage_bug+0x480/0x480 [ 45.742895] ? find_held_lock+0x39/0x1d0 [ 45.746936] ? lock_downgrade+0x990/0x990 [ 45.751061] ? sk_dst_check+0x560/0x560 [ 45.755006] ? rcu_read_lock_sched_held+0x108/0x120 [ 45.760016] ? lock_release+0xd70/0xd70 [ 45.763988] sctp_outq_free+0x15/0x20 [ 45.767771] sctp_association_free+0x2d0/0x930 [ 45.772329] ? sctp_asconf_queue_teardown+0x700/0x700 [ 45.777491] ? sock_def_wakeup+0x222/0x350 [ 45.781708] ? sk_dst_check+0x560/0x560 [ 45.785653] ? sctp_association_put+0x74/0x2f0 [ 45.790204] ? sctp_association_hold+0x20/0x20 [ 45.794757] ? unwind_dump+0x4c0/0x4c0 [ 45.798615] ? sctp_sm_lookup_event+0x95/0x3c0 [ 45.803173] sctp_do_sm+0x28e7/0x6dd0 [ 45.806955] ? sctp_do_8_2_transport_strike.isra.16+0x8a0/0x8a0 [ 45.812984] ? print_usage_bug+0x480/0x480 [ 45.817186] ? __lock_acquire+0x20fd/0x4620 [ 45.821480] ? print_usage_bug+0x480/0x480 [ 45.825698] ? find_held_lock+0x39/0x1d0 [ 45.829737] ? lock_downgrade+0x990/0x990 [ 45.833871] ? skb_dequeue+0x22/0x180 [ 45.837649] ? do_raw_spin_trylock+0x190/0x190 [ 45.842218] ? mark_held_locks+0xb2/0x100 [ 45.846350] ? trace_hardirqs_on+0xd/0x10 [ 45.850477] sctp_primitive_SHUTDOWN+0xa0/0xd0 [ 45.855034] sctp_close+0x3c6/0x980 [ 45.858640] ? sctp_apply_peer_addr_params+0xf30/0xf30 [ 45.863886] ? unwind_get_return_address+0x61/0xa0 [ 45.868785] ? check_noncircular+0x20/0x20 [ 45.872993] ? depot_save_stack+0x12c/0x490 [ 45.877290] ? ipv6_sock_ac_close+0x2e8/0x3e0 [ 45.881759] ? ipv6_sock_mc_close+0x148/0x1a0 [ 45.886222] ? ipv6_sock_ac_drop+0x580/0x580 [ 45.890598] ? ip_mc_drop_socket+0x1ce/0x230 [ 45.894977] ? __fsnotify_parent+0xb4/0x3a0 [ 45.899272] inet_release+0xed/0x1c0 [ 45.902959] inet6_release+0x50/0x70 [ 45.906643] sock_release+0x8d/0x1e0 [ 45.910326] ? sock_release+0x1e0/0x1e0 [ 45.914269] sock_close+0x16/0x20 [ 45.917693] __fput+0x333/0x7f0 [ 45.920952] ? fput+0x140/0x140 [ 45.924208] ? _raw_spin_unlock_irq+0x27/0x70 [ 45.928688] ____fput+0x15/0x20 [ 45.931942] task_work_run+0x199/0x270 [ 45.935803] ? task_work_cancel+0x210/0x210 [ 45.940096] ? _raw_spin_unlock+0x22/0x30 [ 45.944214] ? switch_task_namespaces+0x87/0xc0 [ 45.948857] do_exit+0xa52/0x1b40 [ 45.952288] ? plist_check_list+0xa0/0xa0 [ 45.956419] ? plist_del+0x47b/0x990 [ 45.960104] ? mm_update_next_owner+0x930/0x930 [ 45.964741] ? plist_add+0x760/0x760 [ 45.968432] ? unwind_dump+0x4c0/0x4c0 [ 45.972300] ? check_same_owner+0x320/0x320 [ 45.976597] ? find_held_lock+0x39/0x1d0 [ 45.980641] ? check_noncircular+0x20/0x20 [ 45.984845] ? lock_downgrade+0x990/0x990 [ 45.988962] ? refill_pi_state_cache.part.6+0x2f0/0x2f0 [ 45.994323] ? find_held_lock+0x39/0x1d0 [ 45.998366] ? lock_downgrade+0x990/0x990 [ 46.002496] ? recalc_sigpending_tsk+0x117/0x150 [ 46.007223] ? recalc_sigpending+0x103/0x160 [ 46.011602] ? recalc_sigpending_tsk+0x150/0x150 [ 46.016326] ? get_signal+0x397/0x17e0 [ 46.020196] do_group_exit+0x149/0x400 [ 46.024053] ? __lock_is_held+0xbc/0x140 [ 46.028082] ? SyS_exit+0x30/0x30 [ 46.031504] ? _raw_spin_unlock_irq+0x27/0x70 [ 46.035971] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 46.040960] get_signal+0x7e8/0x17e0 [ 46.044703] ? ptrace_notify+0x130/0x130 [ 46.048736] ? get_unused_fd_flags+0x190/0x190 [ 46.053297] ? exit_robust_list+0x240/0x240 [ 46.057618] do_signal+0x94/0x1ee0 [ 46.061127] ? __fd_install+0x2f7/0x6a0 [ 46.065072] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 46.069803] ? get_unused_fd_flags+0x190/0x190 [ 46.074354] ? setup_sigcontext+0x7d0/0x7d0 [ 46.078659] ? copy_user_generic_unrolled+0x89/0xc0 [ 46.083649] ? _copy_to_user+0xa2/0xc0 [ 46.087514] ? fd_install+0x4d/0x60 [ 46.091108] ? fput+0xd2/0x140 [ 46.094275] ? SYSC_accept4+0x4f2/0x850 [ 46.098218] ? __release_sock+0x360/0x360 [ 46.102343] ? exit_to_usermode_loop+0x98/0x300 [ 46.106990] exit_to_usermode_loop+0x224/0x300 [ 46.111542] ? sctp_inet_listen+0x141/0x850 [ 46.115835] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 46.121338] ? sctp_transport_get_idx+0x70/0x70 [ 46.125984] syscall_return_slowpath+0x42f/0x500 [ 46.130711] ? prepare_exit_to_usermode+0x2c0/0x2c0 [ 46.135699] ? entry_SYSCALL_64_fastpath+0x91/0xbe [ 46.140603] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 46.145598] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 46.150331] entry_SYSCALL_64_fastpath+0xbc/0xbe [ 46.155054] RIP: 0033:0x451e59 [ 46.158214] RSP: 002b:00007f45035bccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 46.165894] RAX: fffffffffffffe00 RBX: 00000000007180d8 RCX: 0000000000451e59 [ 46.173132] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000007180d8 [ 46.180372] RBP: 00000000007180b0 R08: 0000000000000000 R09: 0000000000000000 [ 46.187610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 46.194851] R13: 0000000000a6f7ef R14: 00007f45035bd9c0 R15: 000000000000000c [ 46.202568] Dumping ftrace buffer: [ 46.206129] (ftrace buffer empty) [ 46.209813] Kernel Offset: disabled [ 46.213417] Rebooting in 86400 seconds..