[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   12.222376] audit: type=1400 audit(1514841329.735:6): avc:  denied  { map } for  pid=3126 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.15.198' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   18.382860] audit: type=1400 audit(1514841335.895:7): avc:  denied  { map } for  pid=3140 comm="syzkaller818591" path="/root/syzkaller818591236" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   18.387394] ==================================================================
[   18.387408] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00
[   18.387414] Read of size 8 at addr ffff8801c9fb9b38 by task syzkaller818591/3140
[   18.387415] 
[   18.387422] CPU: 0 PID: 3140 Comm: syzkaller818591 Not tainted 4.15.0-rc4-mm1+ #49
[   18.387425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.387427] Call Trace:
[   18.387436]  dump_stack+0x194/0x257
[   18.387444]  ? arch_local_irq_restore+0x53/0x53
[   18.387451]  ? show_regs_print_info+0x18/0x18
[   18.387457]  ? print_irqtrace_events+0x270/0x270
[   18.387463]  ? __lock_acquire+0x664/0x3e00
[   18.387470]  ? __lock_acquire+0x3d4d/0x3e00
[   18.387478]  print_address_description+0x73/0x250
[   18.387484]  ? __lock_acquire+0x3d4d/0x3e00
[   18.387490]  kasan_report+0x23b/0x360
[   18.387499]  __asan_report_load8_noabort+0x14/0x20
[   18.387504]  __lock_acquire+0x3d4d/0x3e00
[   18.387510]  ? __lock_acquire+0x664/0x3e00
[   18.387515]  ? lock_downgrade+0x980/0x980
[   18.387520]  ? lock_downgrade+0x980/0x980
[   18.387530]  ? remove_wait_queue+0x81/0x350
[   18.387538]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.387545]  ? __lock_acquire+0x664/0x3e00
[   18.387550]  ? check_noncircular+0x20/0x20
[   18.387562]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.387570]  ? lock_acquire+0x1d5/0x580
[   18.387575]  ? lock_acquire+0x1d5/0x580
[   18.387582]  ? ep_free+0xf4/0x320
[   18.387590]  ? lock_release+0xa40/0xa40
[   18.387597]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.387603]  ? print_irqtrace_events+0x270/0x270
[   18.387611]  ? rcu_note_context_switch+0x710/0x710
[   18.387618]  ? __might_sleep+0x95/0x190
[   18.387624]  ? ep_free+0xf4/0x320
[   18.387629]  ? __mutex_lock+0x16f/0x1a80
[   18.387634]  ? ep_free+0xf4/0x320
[   18.387641]  ? print_irqtrace_events+0x270/0x270
[   18.387646]  ? ep_free+0xf4/0x320
[   18.387654]  lock_acquire+0x1d5/0x580
[   18.387660]  ? lock_acquire+0x1d5/0x580
[   18.387665]  ? remove_wait_queue+0x81/0x350
[   18.387671]  ? __lock_acquire+0x664/0x3e00
[   18.387678]  ? lock_release+0xa40/0xa40
[   18.387687]  ? lock_acquire+0x1d5/0x580
[   18.387693]  ? lock_acquire+0x1d5/0x580
[   18.387699]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.387706]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.387712]  ? remove_wait_queue+0x81/0x350
[   18.387718]  remove_wait_queue+0x81/0x350
[   18.387726]  ? add_wait_queue+0x290/0x290
[   18.387732]  ? rcutorture_record_progress+0x10/0x10
[   18.387742]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.387749]  ? __kernel_text_address+0xd/0x40
[   18.387757]  ? clear_tfile_check_list+0x370/0x370
[   18.387764]  ? check_noncircular+0x20/0x20
[   18.387773]  ? locks_remove_file+0x3fa/0x5a0
[   18.387782]  ep_free+0x13f/0x320
[   18.387788]  ? ep_remove+0x800/0x800
[   18.387794]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.387801]  ? ep_free+0x320/0x320
[   18.387807]  ep_eventpoll_release+0x44/0x60
[   18.387813]  __fput+0x327/0x7e0
[   18.387822]  ? fput+0x140/0x140
[   18.387828]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.387836]  ____fput+0x15/0x20
[   18.387842]  task_work_run+0x199/0x270
[   18.387850]  ? task_work_cancel+0x210/0x210
[   18.387856]  ? _raw_spin_unlock+0x22/0x30
[   18.387862]  ? switch_task_namespaces+0x87/0xc0
[   18.387869]  do_exit+0x9bb/0x1ad0
[   18.387879]  ? binder_ioctl+0x551/0x1417
[   18.387885]  ? mm_update_next_owner+0x930/0x930
[   18.387892]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.387902]  ? avc_ss_reset+0x110/0x110
[   18.387908]  ? mutex_unlock+0xd/0x10
[   18.387914]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.387939]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.387944]  ? up_read+0x1a/0x40
[   18.387951]  ? rcu_note_context_switch+0x710/0x710
[   18.387957]  ? __fd_install+0x288/0x740
[   18.387966]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.387971]  ? do_vfs_ioctl+0x486/0x1520
[   18.387977]  ? _cond_resched+0x14/0x30
[   18.387984]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.387993]  ? selinux_capable+0x40/0x40
[   18.387999]  ? __alloc_fd+0x750/0x750
[   18.388011]  do_group_exit+0x149/0x400
[   18.388017]  ? SyS_exit+0x30/0x30
[   18.388024]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.388032]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.388040]  SyS_exit_group+0x1d/0x20
[   18.388046]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.388050] RIP: 0033:0x4429f8
[   18.388054] RSP: 002b:00007ffc859456f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.388060] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.388063] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.388067] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.388070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.388073] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.388081] 
[   18.388084] Allocated by task 3140:
[   18.388090]  save_stack+0x43/0xd0
[   18.388095]  kasan_kmalloc+0xad/0xe0
[   18.388100]  kmem_cache_alloc_trace+0x136/0x750
[   18.388105]  binder_get_thread+0x1cf/0x870
[   18.388113]  binder_poll+0x8c/0x390
[   18.388118]  ep_item_poll.isra.10+0xf2/0x320
[   18.388122]  ep_insert+0x6a2/0x1ac0
[   18.388127]  SyS_epoll_ctl+0x12bf/0x1a80
[   18.388132]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.388133] 
[   18.388135] Freed by task 3140:
[   18.388140]  save_stack+0x43/0xd0
[   18.388145]  kasan_slab_free+0x71/0xc0
[   18.388149]  kfree+0xd6/0x260
[   18.388153]  binder_thread_dec_tmpref+0x27f/0x310
[   18.388158]  binder_thread_release+0x27d/0x540
[   18.388162]  binder_ioctl+0xc02/0x1417
[   18.388166]  do_vfs_ioctl+0x1b1/0x1520
[   18.388170]  SyS_ioctl+0x8f/0xc0
[   18.388175]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.388176] 
[   18.388180] The buggy address belongs to the object at ffff8801c9fb9a80
[   18.388180]  which belongs to the cache kmalloc-512 of size 512
[   18.388185] The buggy address is located 184 bytes inside of
[   18.388185]  512-byte region [ffff8801c9fb9a80, ffff8801c9fb9c80)
[   18.388187] The buggy address belongs to the page:
[   18.388192] page:ffffea000727ee40 count:1 mapcount:0 mapping:ffff8801c9fb9080 index:0x0
[   18.388197] flags: 0x2fffc0000000100(slab)
[   18.388205] raw: 02fffc0000000100 ffff8801c9fb9080 0000000000000000 0000000100000006
[   18.388212] raw: ffffea0007246f60 ffffea00072470a0 ffff8801dac00940 0000000000000000
[   18.388214] page dumped because: kasan: bad access detected
[   18.388215] 
[   18.388217] Memory state around the buggy address:
[   18.388222]  ffff8801c9fb9a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.388226]  ffff8801c9fb9a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.388230] >ffff8801c9fb9b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.388232]                                         ^
[   18.388237]  ffff8801c9fb9b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.388241]  ffff8801c9fb9c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.388243] ==================================================================
[   18.388244] Disabling lock debugging due to kernel taint
[   18.388247] Kernel panic - not syncing: panic_on_warn set ...
[   18.388247] 
[   18.388254] CPU: 0 PID: 3140 Comm: syzkaller818591 Tainted: G    B            4.15.0-rc4-mm1+ #49
[   18.388256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.388258] Call Trace:
[   18.388264]  dump_stack+0x194/0x257
[   18.388270]  ? arch_local_irq_restore+0x53/0x53
[   18.388275]  ? kasan_end_report+0x32/0x50
[   18.388282]  ? lock_downgrade+0x980/0x980
[   18.388287]  ? vsnprintf+0x1ed/0x1900
[   18.388293]  ? __lock_acquire+0x3c90/0x3e00
[   18.388299]  panic+0x1e4/0x41c
[   18.388305]  ? refcount_error_report+0x214/0x214
[   18.388312]  ? add_taint+0x40/0x50
[   18.388317]  ? add_taint+0x1c/0x50
[   18.388324]  ? __lock_acquire+0x3d4d/0x3e00
[   18.388330]  kasan_end_report+0x50/0x50
[   18.388335]  kasan_report+0x148/0x360
[   18.388343]  __asan_report_load8_noabort+0x14/0x20
[   18.388349]  __lock_acquire+0x3d4d/0x3e00
[   18.388355]  ? __lock_acquire+0x664/0x3e00
[   18.388360]  ? lock_downgrade+0x980/0x980
[   18.388365]  ? lock_downgrade+0x980/0x980
[   18.388373]  ? remove_wait_queue+0x81/0x350
[   18.388382]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.388388]  ? __lock_acquire+0x664/0x3e00
[   18.388393]  ? check_noncircular+0x20/0x20
[   18.388405]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.388412]  ? lock_acquire+0x1d5/0x580
[   18.388418]  ? lock_acquire+0x1d5/0x580
[   18.388423]  ? ep_free+0xf4/0x320
[   18.388431]  ? lock_release+0xa40/0xa40
[   18.388437]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.388443]  ? print_irqtrace_events+0x270/0x270
[   18.388449]  ? rcu_note_context_switch+0x710/0x710
[   18.388456]  ? __might_sleep+0x95/0x190
[   18.388461]  ? ep_free+0xf4/0x320
[   18.388467]  ? __mutex_lock+0x16f/0x1a80
[   18.388471]  ? ep_free+0xf4/0x320
[   18.388478]  ? print_irqtrace_events+0x270/0x270
[   18.388483]  ? ep_free+0xf4/0x320
[   18.388491]  lock_acquire+0x1d5/0x580
[   18.388496]  ? lock_acquire+0x1d5/0x580
[   18.388501]  ? remove_wait_queue+0x81/0x350
[   18.388507]  ? __lock_acquire+0x664/0x3e00
[   18.388514]  ? lock_release+0xa40/0xa40
[   18.388523]  ? lock_acquire+0x1d5/0x580
[   18.388528]  ? lock_acquire+0x1d5/0x580
[   18.388534]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.388541]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.388547]  ? remove_wait_queue+0x81/0x350
[   18.388553]  remove_wait_queue+0x81/0x350
[   18.388561]  ? add_wait_queue+0x290/0x290
[   18.388566]  ? rcutorture_record_progress+0x10/0x10
[   18.388576]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.388582]  ? __kernel_text_address+0xd/0x40
[   18.388590]  ? clear_tfile_check_list+0x370/0x370
[   18.388597]  ? check_noncircular+0x20/0x20
[   18.388604]  ? locks_remove_file+0x3fa/0x5a0
[   18.388613]  ep_free+0x13f/0x320
[   18.388619]  ? ep_remove+0x800/0x800
[   18.388624]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.388631]  ? ep_free+0x320/0x320
[   18.388637]  ep_eventpoll_release+0x44/0x60
[   18.388643]  __fput+0x327/0x7e0
[   18.388651]  ? fput+0x140/0x140
[   18.388657]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.388665]  ____fput+0x15/0x20
[   18.388671]  task_work_run+0x199/0x270
[   18.388679]  ? task_work_cancel+0x210/0x210
[   18.388685]  ? _raw_spin_unlock+0x22/0x30
[   18.388691]  ? switch_task_namespaces+0x87/0xc0
[   18.388698]  do_exit+0x9bb/0x1ad0
[   18.388705]  ? binder_ioctl+0x551/0x1417
[   18.388711]  ? mm_update_next_owner+0x930/0x930
[   18.388718]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.388726]  ? avc_ss_reset+0x110/0x110
[   18.388732]  ? mutex_unlock+0xd/0x10
[   18.388737]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.388755]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.388760]  ? up_read+0x1a/0x40
[   18.388767]  ? rcu_note_context_switch+0x710/0x710
[   18.388771]  ? __fd_install+0x288/0x740
[   18.388780]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.388785]  ? do_vfs_ioctl+0x486/0x1520
[   18.388790]  ? _cond_resched+0x14/0x30
[   18.388797]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.388804]  ? selinux_capable+0x40/0x40
[   18.388810]  ? __alloc_fd+0x750/0x750
[   18.388818]  do_group_exit+0x149/0x400
[   18.388825]  ? SyS_exit+0x30/0x30
[   18.388831]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.388837]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.388844]  SyS_exit_group+0x1d/0x20
[   18.388850]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.388854] RIP: 0033:0x4429f8
[   18.388857] RSP: 002b:00007ffc859456f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.388862] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.388866] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.388869] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.388872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.388875] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.409205] Dumping ftrace buffer:
[   18.409208]    (ftrace buffer empty)
[   18.409211] Kernel Offset: disabled
[   19.533063] Rebooting in 86400 seconds..