INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-0,10.128.15.210' (ECDSA) to the list of known hosts.
2017/09/19 06:02:44 parsed 1 programs
2017/09/19 06:02:44 executed programs: 0
syzkaller login: [   45.169710] dev_remove_pack: ffff8801c5d38bc0 not found
[   45.186231] ==================================================================
[   45.187388] BUG: KASAN: use-after-free in __list_add_valid+0xb1/0xd0
[   45.188305] Read of size 8 at addr ffff8801c5a1a9b0 by task syz-executor5/3904
[   45.189274] 
[   45.189515] CPU: 1 PID: 3904 Comm: syz-executor5 Not tainted 4.13.0-mm1+ #7
[   45.190471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.199799] Call Trace:
[   45.202363]  dump_stack+0x194/0x257
[   45.205969]  ? arch_local_irq_restore+0x53/0x53
[   45.210612]  ? show_regs_print_info+0x65/0x65
[   45.215099]  ? __list_add_valid+0xb1/0xd0
[   45.219222]  print_address_description+0x73/0x250
[   45.224038]  ? __list_add_valid+0xb1/0xd0
[   45.228159]  kasan_report+0x24e/0x340
[   45.231936]  __asan_report_load8_noabort+0x14/0x20
[   45.236838]  __list_add_valid+0xb1/0xd0
[   45.240789]  dev_add_pack+0x113/0x2b0
[   45.244564]  ? napi_skb_free_stolen_head+0x170/0x170
[   45.249643]  ? trace_hardirqs_on+0xd/0x10
[   45.253768]  ? skb_dequeue+0x12a/0x180
[   45.257639]  register_prot_hook.part.49+0x95/0xb0
[   45.262456]  packet_set_ring+0xf3c/0x1b70
[   45.266593]  ? packet_poll+0x5c0/0x5c0
[   45.270461]  ? __might_fault+0xe0/0x1d0
[   45.274411]  ? lock_downgrade+0x990/0x990
[   45.278537]  ? lock_release+0xd70/0xd70
[   45.282485]  ? check_same_owner+0x320/0x320
[   45.286781]  ? __check_object_size+0x25d/0x4f0
[   45.291345]  ? __might_sleep+0x95/0x190
[   45.295301]  ? kasan_check_write+0x14/0x20
[   45.299508]  ? _copy_from_user+0x99/0x110
[   45.303633]  packet_setsockopt+0x6cd/0x1e80
[   45.307934]  ? fanout_add+0x1190/0x1190
[   45.311881]  ? lock_downgrade+0x990/0x990
[   45.316022]  ? __fget+0xbb/0x580
[   45.319371]  ? lock_release+0xd70/0xd70
[   45.323322]  ? __lock_is_held+0xbc/0x140
[   45.327371]  ? __fget+0x362/0x580
[   45.330810]  ? iterate_fd+0x3f0/0x3f0
[   45.334588]  ? userfaultfd_unmap_complete+0x327/0x510
[   45.339767]  ? schedule+0x108/0x440
[   45.343365]  ? do_mmap+0x34f/0xd50
[   45.346886]  ? sock_has_perm+0x29c/0x400
[   45.350918]  ? __fget_light+0x29d/0x390
[   45.354868]  ? selinux_tun_dev_create+0xc0/0xc0
[   45.359511]  ? security_mmap_file+0x14e/0x190
[   45.363982]  ? selinux_netlbl_socket_setsockopt+0x10c/0x460
[   45.369670]  ? selinux_netlbl_sock_rcv_skb+0x730/0x730
[   45.374931]  ? trace_hardirqs_off+0xd/0x10
[   45.379164]  ? selinux_socket_setsockopt+0x64/0x80
[   45.384078]  SyS_setsockopt+0x189/0x360
[   45.388025]  ? SyS_setsockopt+0x189/0x360
[   45.392153]  ? SyS_recv+0x40/0x40
[   45.395590]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   45.400412]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   45.405415]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   45.410163]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.414899] RIP: 0033:0x451e59
[   45.418064] RSP: 002b:00007fb9371f7c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000036
[   45.425749] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 0000000000451e59
[   45.432998] RDX: 0000000000000005 RSI: 0000000000000107 RDI: 000000000000000b
[   45.440249] RBP: 0000000000000082 R08: 000000000000047e R09: 0000000000000000
[   45.447500] R10: 0000000020001000 R11: 0000000000000216 R12: 00000000004c0160
[   45.454742] R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000084
[   45.462016] 
[   45.463623] Allocated by task 3890:
[   45.467228]  save_stack_trace+0x16/0x20
[   45.471176]  save_stack+0x43/0xd0
[   45.474607]  kasan_kmalloc+0xad/0xe0
[   45.478301]  kmem_cache_alloc_trace+0x136/0x750
[   45.482950]  fanout_add+0xa50/0x1190
[   45.486636]  packet_setsockopt+0xfdc/0x1e80
[   45.490936]  SyS_setsockopt+0x189/0x360
[   45.494886]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.499610] 
[   45.501209] Freed by task 3890:
[   45.504461]  save_stack_trace+0x16/0x20
[   45.508408]  save_stack+0x43/0xd0
[   45.511838]  kasan_slab_free+0x71/0xc0
[   45.515697]  kfree+0xca/0x250
[   45.518777]  packet_release+0xa8f/0xd70
[   45.522722]  sock_release+0x8d/0x1e0
[   45.526406]  sock_close+0x16/0x20
[   45.529830]  __fput+0x333/0x7f0
[   45.533081]  ____fput+0x15/0x20
[   45.536336]  task_work_run+0x199/0x270
[   45.540195]  do_exit+0xa52/0x1b40
[   45.543621]  do_group_exit+0x149/0x400
[   45.547488]  get_signal+0x7e8/0x17e0
[   45.551174]  do_signal+0x94/0x1ee0
[   45.554685]  exit_to_usermode_loop+0x224/0x300
[   45.559238]  syscall_return_slowpath+0x42f/0x500
[   45.563965]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   45.568691] 
[   45.570292] The buggy address belongs to the object at ffff8801c5a1a100
[   45.570292]  which belongs to the cache kmalloc-4096 of size 4096
[   45.583094] The buggy address is located 2224 bytes inside of
[   45.583094]  4096-byte region [ffff8801c5a1a100, ffff8801c5a1b100)
[   45.595111] The buggy address belongs to the page:
[   45.600017] page:ffffea0007168680 count:1 mapcount:0 mapping:ffff8801c5a1a100 index:0x0 compound_mapcount: 0
[   45.609966] flags: 0x200000000008100(slab|head)
[   45.614612] raw: 0200000000008100 ffff8801c5a1a100 0000000000000000 0000000100000001
[   45.622467] raw: ffffea0007151c20 ffff8801dac01a50 ffff8801dac00dc0 0000000000000000
[   45.630321] page dumped because: kasan: bad access detected
[   45.636001] 
[   45.637605] Memory state around the buggy address:
[   45.642506]  ffff8801c5a1a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.649836]  ffff8801c5a1a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.657164] >ffff8801c5a1a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.664493]                                      ^
[   45.669394]  ffff8801c5a1aa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.676725]  ffff8801c5a1aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.684052] ==================================================================
[   45.691382] Disabling lock debugging due to kernel taint
[   45.696898] Kernel panic - not syncing: panic_on_warn set ...
[   45.696898] 
[   45.704231] CPU: 1 PID: 3904 Comm: syz-executor5 Tainted: G    B           4.13.0-mm1+ #7
[   45.712510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.721829] Call Trace:
[   45.724386]  dump_stack+0x194/0x257
[   45.727984]  ? arch_local_irq_restore+0x53/0x53
[   45.732622]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   45.737346]  ? __list_add_valid+0x50/0xd0
[   45.741461]  panic+0x1e4/0x417
[   45.744624]  ? __warn+0x1d9/0x1d9
[   45.748055]  ? __list_add_valid+0xb1/0xd0
[   45.752170]  kasan_end_report+0x50/0x50
[   45.756110]  kasan_report+0x137/0x340
[   45.759879]  __asan_report_load8_noabort+0x14/0x20
[   45.764773]  __list_add_valid+0xb1/0xd0
[   45.768716]  dev_add_pack+0x113/0x2b0
[   45.772484]  ? napi_skb_free_stolen_head+0x170/0x170
[   45.777553]  ? trace_hardirqs_on+0xd/0x10
[   45.781669]  ? skb_dequeue+0x12a/0x180
[   45.785529]  register_prot_hook.part.49+0x95/0xb0
[   45.790337]  packet_set_ring+0xf3c/0x1b70
[   45.794461]  ? packet_poll+0x5c0/0x5c0
[   45.798320]  ? __might_fault+0xe0/0x1d0
[   45.802261]  ? lock_downgrade+0x990/0x990
[   45.806378]  ? lock_release+0xd70/0xd70
[   45.810320]  ? check_same_owner+0x320/0x320
[   45.814611]  ? __check_object_size+0x25d/0x4f0
[   45.819165]  ? __might_sleep+0x95/0x190
[   45.823109]  ? kasan_check_write+0x14/0x20
[   45.827311]  ? _copy_from_user+0x99/0x110
[   45.831426]  packet_setsockopt+0x6cd/0x1e80
[   45.835718]  ? fanout_add+0x1190/0x1190
[   45.839658]  ? lock_downgrade+0x990/0x990
[   45.843779]  ? __fget+0xbb/0x580
[   45.847118]  ? lock_release+0xd70/0xd70
[   45.851060]  ? __lock_is_held+0xbc/0x140
[   45.855095]  ? __fget+0x362/0x580
[   45.858519]  ? iterate_fd+0x3f0/0x3f0
[   45.862286]  ? userfaultfd_unmap_complete+0x327/0x510
[   45.867453]  ? schedule+0x108/0x440
[   45.871046]  ? do_mmap+0x34f/0xd50
[   45.874556]  ? sock_has_perm+0x29c/0x400
[   45.878581]  ? __fget_light+0x29d/0x390
[   45.882522]  ? selinux_tun_dev_create+0xc0/0xc0
[   45.887158]  ? security_mmap_file+0x14e/0x190
[   45.891621]  ? selinux_netlbl_socket_setsockopt+0x10c/0x460
[   45.897301]  ? selinux_netlbl_sock_rcv_skb+0x730/0x730
[   45.902548]  ? trace_hardirqs_off+0xd/0x10
[   45.906753]  ? selinux_socket_setsockopt+0x64/0x80
[   45.911654]  SyS_setsockopt+0x189/0x360
[   45.915595]  ? SyS_setsockopt+0x189/0x360
[   45.919711]  ? SyS_recv+0x40/0x40
[   45.923131]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   45.927940]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   45.932925]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   45.937651]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.942372] RIP: 0033:0x451e59
[   45.945529] RSP: 002b:00007fb9371f7c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000036
[   45.953202] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 0000000000451e59
[   45.960439] RDX: 0000000000000005 RSI: 0000000000000107 RDI: 000000000000000b
[   45.967675] RBP: 0000000000000082 R08: 000000000000047e R09: 0000000000000000
[   45.974911] R10: 0000000020001000 R11: 0000000000000216 R12: 00000000004c0160
[   45.982149] R13: 00000000ffffffff R14: ffffffffffffffff R15: 0000000000000084
[   45.989813] Dumping ftrace buffer:
[   45.993328]    (ftrace buffer empty)
[   45.997004] Kernel Offset: disabled
[   46.000596] Rebooting in 86400 seconds..