INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.59' (ECDSA) to the list of known hosts. 2018/04/15 10:05:46 parsed 1 programs 2018/04/15 10:05:46 executed programs: 0 syzkaller login: [ 27.641655] IPVS: Creating netns size=2536 id=1 [ 27.674320] IPVS: Creating netns size=2536 id=2 [ 27.697326] IPVS: Creating netns size=2536 id=3 [ 27.730453] IPVS: Creating netns size=2536 id=4 [ 27.753433] IPVS: Creating netns size=2536 id=5 [ 27.799093] IPVS: Creating netns size=2536 id=6 [ 27.825633] IPVS: Creating netns size=2536 id=7 [ 27.849499] IPVS: Creating netns size=2536 id=8 [ 30.600134] ================================================================== [ 30.607537] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 30.614274] Read of size 8 at addr ffff8801d56bd1e0 by task blkid/3998 [ 30.620920] [ 30.622541] CPU: 1 PID: 3998 Comm: blkid Not tainted 4.9.94-g8683408 #3 [ 30.629279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.638623] ffff8801d45af6d8 ffffffff81d9b509 ffffea000755ae00 ffff8801d56bd1e0 [ 30.646674] 0000000000000000 ffff8801d56bd1e0 0000000000000000 ffff8801d45af710 [ 30.654716] ffffffff815652cb ffff8801d56bd1e0 0000000000000008 0000000000000000 [ 30.662753] Call Trace: [ 30.665332] [] dump_stack+0xc1/0x128 [ 30.670689] [] print_address_description+0x6c/0x234 [ 30.677346] [] kasan_report.cold.6+0x242/0x2fe [ 30.683565] [] ? disk_unblock_events+0x51/0x60 [ 30.689788] [] __asan_report_load8_noabort+0x14/0x20 [ 30.696532] [] disk_unblock_events+0x51/0x60 [ 30.702593] [] __blkdev_get+0x6b6/0xd60 [ 30.708214] [] ? __blkdev_put+0x840/0x840 [ 30.714000] [] ? fsnotify+0x114/0x1100 [ 30.719523] [] blkdev_get+0x2da/0x920 [ 30.724951] [] ? bd_may_claim+0xd0/0xd0 [ 30.730553] [] ? bd_acquire+0x27/0x250 [ 30.736064] [] ? bd_acquire+0x88/0x250 [ 30.741579] [] ? _raw_spin_unlock+0x2c/0x50 [ 30.747526] [] blkdev_open+0x1a5/0x250 [ 30.753033] [] do_dentry_open+0x703/0xc80 [ 30.758807] [] ? blkdev_get_by_dev+0x70/0x70 [ 30.764840] [] vfs_open+0x11c/0x210 [ 30.770087] [] ? may_open.isra.57+0x14f/0x2a0 [ 30.776202] [] path_openat+0x758/0x3590 [ 30.781807] [] ? save_stack+0xa9/0xd0 [ 30.787240] [] ? path_lookupat.isra.41+0x410/0x410 [ 30.793814] [] ? __lock_is_held+0xa2/0xf0 [ 30.799599] [] do_filp_open+0x197/0x270 [ 30.805208] [] ? may_open_dev+0xe0/0xe0 [ 30.810813] [] ? _raw_spin_unlock+0x2c/0x50 [ 30.816768] [] ? __alloc_fd+0x1d7/0x4a0 [ 30.822366] [] do_sys_open+0x30d/0x5c0 [ 30.827887] [] ? filp_open+0x70/0x70 [ 30.833230] [] ? up_read+0x1a/0x40 [ 30.838399] [] ? __do_page_fault+0x183/0xd50 [ 30.844441] [] SyS_open+0x2d/0x40 [ 30.849521] [] ? do_sys_open+0x5c0/0x5c0 [ 30.855211] [] do_syscall_64+0x1a6/0x490 [ 30.860900] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 30.867803] [ 30.869419] Allocated by task 3988: [ 30.873036] save_stack_trace+0x16/0x20 [ 30.876998] save_stack+0x43/0xd0 [ 30.880419] kasan_kmalloc+0xc7/0xe0 [ 30.884114] kmem_cache_alloc_trace+0xfd/0x2b0 [ 30.888678] alloc_disk_node+0x54/0x3a0 [ 30.892632] alloc_disk+0x18/0x20 [ 30.896067] loop_add+0x33b/0x770 [ 30.899496] loop_probe+0x14f/0x180 [ 30.903547] kobj_lookup+0x223/0x410 [ 30.907255] get_gendisk+0x39/0x2d0 [ 30.910860] __blkdev_get+0x351/0xd60 [ 30.914654] blkdev_get+0x2da/0x920 [ 30.918271] blkdev_open+0x1a5/0x250 [ 30.921960] do_dentry_open+0x703/0xc80 [ 30.925906] vfs_open+0x11c/0x210 [ 30.929332] path_openat+0x758/0x3590 [ 30.933105] do_filp_open+0x197/0x270 [ 30.936874] do_sys_open+0x30d/0x5c0 [ 30.940568] compat_SyS_open+0x2a/0x40 [ 30.944436] do_fast_syscall_32+0x2f7/0x870 [ 30.948736] entry_SYSENTER_compat+0x90/0xa2 [ 30.953110] [ 30.954709] Freed by task 3998: [ 30.957972] save_stack_trace+0x16/0x20 [ 30.961927] save_stack+0x43/0xd0 [ 30.965351] kasan_slab_free+0x72/0xc0 [ 30.969215] kfree+0xfb/0x310 [ 30.972294] disk_release+0x259/0x330 [ 30.976064] device_release+0x7e/0x220 [ 30.979924] kobject_release+0x103/0x1b0 [ 30.983955] kobject_put+0x6d/0xd0 [ 30.987472] put_disk+0x23/0x30 [ 30.990727] __blkdev_get+0x616/0xd60 [ 30.994499] blkdev_get+0x2da/0x920 [ 30.998100] blkdev_open+0x1a5/0x250 [ 31.001791] do_dentry_open+0x703/0xc80 [ 31.005749] vfs_open+0x11c/0x210 [ 31.009173] path_openat+0x758/0x3590 [ 31.012946] do_filp_open+0x197/0x270 [ 31.016719] do_sys_open+0x30d/0x5c0 [ 31.020406] SyS_open+0x2d/0x40 [ 31.023659] do_syscall_64+0x1a6/0x490 [ 31.027518] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 31.032585] [ 31.034183] The buggy address belongs to the object at ffff8801d56bcc80 [ 31.034183] which belongs to the cache kmalloc-2048 of size 2048 [ 31.046984] The buggy address is located 1376 bytes inside of [ 31.046984] 2048-byte region [ffff8801d56bcc80, ffff8801d56bd480) [ 31.058999] The buggy address belongs to the page: [ 31.063900] page:ffffea000755ae00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 31.074087] flags: 0x8000000000004080(slab|head) [ 31.078810] page dumped because: kasan: bad access detected [ 31.084486] [ 31.086084] Memory state around the buggy address: [ 31.090983] ffff8801d56bd080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.098308] ffff8801d56bd100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.105638] >ffff8801d56bd180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.112963] ^ [ 31.119424] ffff8801d56bd200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.126753] ffff8801d56bd280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.134082] ================================================================== [ 31.141407] Disabling lock debugging due to kernel taint [ 31.151742] Kernel panic - not syncing: panic_on_warn set ... [ 31.151742] [ 31.159114] CPU: 1 PID: 3998 Comm: blkid Tainted: G B 4.9.94-g8683408 #3 [ 31.167060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.176387] ffff8801d45af638 ffffffff81d9b509 ffffffff841a8a65 00000000ffffffff [ 31.184378] 0000000000000000 0000000000000001 0000000000000000 ffff8801d45af6f8 [ 31.192351] ffffffff8141f845 0000000041b58ab3 ffffffff8419c168 ffffffff8141f686 [ 31.200351] Call Trace: [ 31.202920] [] dump_stack+0xc1/0x128 [ 31.208261] [] panic+0x1bf/0x3bc [ 31.213251] [] ? add_taint.cold.6+0x16/0x16 [ 31.219195] [] ? ___preempt_schedule+0x16/0x18 [ 31.225399] [] kasan_end_report+0x47/0x4f [ 31.231166] [] kasan_report.cold.6+0x76/0x2fe [ 31.237285] [] ? disk_unblock_events+0x51/0x60 [ 31.243487] [] __asan_report_load8_noabort+0x14/0x20 [ 31.250212] [] disk_unblock_events+0x51/0x60 [ 31.256242] [] __blkdev_get+0x6b6/0xd60 [ 31.261835] [] ? __blkdev_put+0x840/0x840 [ 31.267615] [] ? fsnotify+0x114/0x1100 [ 31.273130] [] blkdev_get+0x2da/0x920 [ 31.278550] [] ? bd_may_claim+0xd0/0xd0 [ 31.284146] [] ? bd_acquire+0x27/0x250 [ 31.289656] [] ? bd_acquire+0x88/0x250 [ 31.295166] [] ? _raw_spin_unlock+0x2c/0x50 [ 31.301107] [] blkdev_open+0x1a5/0x250 [ 31.306615] [] do_dentry_open+0x703/0xc80 [ 31.312382] [] ? blkdev_get_by_dev+0x70/0x70 [ 31.318416] [] vfs_open+0x11c/0x210 [ 31.323673] [] ? may_open.isra.57+0x14f/0x2a0 [ 31.329812] [] path_openat+0x758/0x3590 [ 31.335417] [] ? save_stack+0xa9/0xd0 [ 31.340840] [] ? path_lookupat.isra.41+0x410/0x410 [ 31.347392] [] ? __lock_is_held+0xa2/0xf0 [ 31.353169] [] do_filp_open+0x197/0x270 [ 31.358771] [] ? may_open_dev+0xe0/0xe0 [ 31.364369] [] ? _raw_spin_unlock+0x2c/0x50 [ 31.370314] [] ? __alloc_fd+0x1d7/0x4a0 [ 31.375910] [] do_sys_open+0x30d/0x5c0 [ 31.381423] [] ? filp_open+0x70/0x70 [ 31.386761] [] ? up_read+0x1a/0x40 [ 31.391924] [] ? __do_page_fault+0x183/0xd50 [ 31.397958] [] SyS_open+0x2d/0x40 [ 31.403294] [] ? do_sys_open+0x5c0/0x5c0 [ 31.408982] [] do_syscall_64+0x1a6/0x490 [ 31.414668] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 31.422039] Dumping ftrace buffer: [ 31.425552] (ftrace buffer empty) [ 31.429232] Kernel Offset: disabled [ 31.432836] Rebooting in 86400 seconds..