INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-8,10.128.15.223' (ECDSA) to the list of known hosts.
2017/10/18 20:38:43 parsed 1 programs
2017/10/18 20:38:43 executed programs: 0
2017/10/18 20:38:48 executed programs: 57
2017/10/18 20:38:53 executed programs: 113
syzkaller login: [  103.507264] ==================================================================
[  103.508496] BUG: KASAN: use-after-free in packet_getsockopt+0xc72/0xe00
[  103.509409] Read of size 8 at addr ffff8801cfef0e58 by task syz-executor0/3339
[  103.510396] 
[  103.510633] CPU: 0 PID: 3339 Comm: syz-executor0 Not tainted 4.14.0-rc5-next-20171017+ #35
[  103.511788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  103.513009] Call Trace:
[  103.513374]  dump_stack+0x194/0x257
[  103.513885]  ? arch_local_irq_restore+0x53/0x53
[  103.514523]  ? show_regs_print_info+0x65/0x65
[  103.515134]  ? lock_release+0xa40/0xa40
[  103.515675]  ? packet_getsockopt+0xc72/0xe00
[  103.516282]  print_address_description+0x73/0x250
[  103.516932]  ? packet_getsockopt+0xc72/0xe00
[  103.517562]  kasan_report+0x25b/0x340
[  103.518079]  __asan_report_load8_noabort+0x14/0x20
[  103.518758]  packet_getsockopt+0xc72/0xe00
[  103.519329]  ? packet_notifier+0x950/0x950
[  103.519928]  ? iput+0x540/0xaf0
[  103.520377]  ? __fget_light+0x297/0x380
[  103.520915]  ? sock_has_perm+0x29c/0x400
[  103.521482]  ? selinux_secmark_relabel_packet+0xc0/0xc0
[  103.522243]  ? free_modinfo_version+0x70/0x70
[  103.522974]  ? __sk_free+0x5c/0x230
[  103.523480]  ? sk_free+0x2f/0x40
[  103.523952]  ? selinux_socket_getsockopt+0x36/0x40
[  103.524620]  ? security_socket_getsockopt+0x89/0xb0
[  103.525296]  SyS_getsockopt+0x178/0x340
[  103.525837]  ? SyS_setsockopt+0x360/0x360
[  103.526410]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[  103.527059]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  103.529495]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  103.534227]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  103.538953] RIP: 0033:0x452719
[  103.542110] RSP: 002b:00007f989fd1fbe8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
[  103.549785] RAX: ffffffffffffffda RBX: 00000000007580d8 RCX: 0000000000452719
[  103.557025] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 0000000000000011
[  103.564263] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[  103.571505] R10: 0000000020ec8000 R11: 0000000000000212 R12: 0000000000000000
[  103.578745] R13: 0000000000a6f7ff R14: 00007f989fd209c0 R15: 0000000000000002
[  103.586004] 
[  103.587603] Allocated by task 3338:
[  103.591207]  save_stack+0x43/0xd0
[  103.594626]  kasan_kmalloc+0xad/0xe0
[  103.598306]  kmem_cache_alloc_trace+0x136/0x750
[  103.602945]  fanout_add+0x27e/0x1480
[  103.606625]  packet_setsockopt+0xfdc/0x1e80
[  103.610915]  SyS_setsockopt+0x189/0x360
[  103.614862]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  103.619578] 
[  103.621172] Freed by task 3338:
[  103.624417]  save_stack+0x43/0xd0
[  103.627838]  kasan_slab_free+0x71/0xc0
[  103.631690]  kfree+0xca/0x250
[  103.634763]  fanout_add+0x432/0x1480
[  103.638444]  packet_setsockopt+0xfdc/0x1e80
[  103.642731]  SyS_setsockopt+0x189/0x360
[  103.646673]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  103.651392] 
[  103.652991] The buggy address belongs to the object at ffff8801cfef0e40
[  103.652991]  which belongs to the cache kmalloc-128 of size 128
[  103.665613] The buggy address is located 24 bytes inside of
[  103.665613]  128-byte region [ffff8801cfef0e40, ffff8801cfef0ec0)
[  103.677369] The buggy address belongs to the page:
[  103.682271] page:ffffea00073fbc00 count:1 mapcount:0 mapping:ffff8801cfef0000 index:0x0
[  103.690382] flags: 0x200000000000100(slab)
[  103.694588] raw: 0200000000000100 ffff8801cfef0000 0000000000000000 0000000100000015
[  103.702438] raw: ffffea00073e1320 ffff8801dac01548 ffff8801dac00640 0000000000000000
[  103.710286] page dumped because: kasan: bad access detected
[  103.715963] 
[  103.717557] Memory state around the buggy address:
[  103.722452]  ffff8801cfef0d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  103.729776]  ffff8801cfef0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  103.737102] >ffff8801cfef0e00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[  103.744426]                                                     ^
[  103.750624]  ffff8801cfef0e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  103.757947]  ffff8801cfef0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  103.765270] ==================================================================
[  103.772593] Disabling lock debugging due to kernel taint
[  103.778107] Kernel panic - not syncing: panic_on_warn set ...
[  103.778107] 
[  103.785442] CPU: 0 PID: 3339 Comm: syz-executor0 Tainted: G    B            4.14.0-rc5-next-20171017+ #35
[  103.795111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  103.804432] Call Trace:
[  103.806995]  dump_stack+0x194/0x257
[  103.810591]  ? arch_local_irq_restore+0x53/0x53
[  103.815230]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  103.819957]  ? vsnprintf+0x1ed/0x1900
[  103.823727]  ? packet_getsockopt+0xbf0/0xe00
[  103.828106]  panic+0x1e4/0x41c
[  103.831267]  ? refcount_error_report+0x214/0x214
[  103.835991]  ? add_taint+0x1c/0x50
[  103.839499]  ? add_taint+0x1c/0x50
[  103.843006]  ? packet_getsockopt+0xc72/0xe00
[  103.847384]  kasan_end_report+0x50/0x50
[  103.851324]  kasan_report+0x144/0x340
[  103.855094]  __asan_report_load8_noabort+0x14/0x20
[  103.859991]  packet_getsockopt+0xc72/0xe00
[  103.864194]  ? packet_notifier+0x950/0x950
[  103.868394]  ? iput+0x540/0xaf0
[  103.871642]  ? __fget_light+0x297/0x380
[  103.875584]  ? sock_has_perm+0x29c/0x400
[  103.879612]  ? selinux_secmark_relabel_packet+0xc0/0xc0
[  103.884941]  ? free_modinfo_version+0x70/0x70
[  103.889402]  ? __sk_free+0x5c/0x230
[  103.892996]  ? sk_free+0x2f/0x40
[  103.896338]  ? selinux_socket_getsockopt+0x36/0x40
[  103.901233]  ? security_socket_getsockopt+0x89/0xb0
[  103.906220]  SyS_getsockopt+0x178/0x340
[  103.910161]  ? SyS_setsockopt+0x360/0x360
[  103.914279]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[  103.919090]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  103.924072]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  103.928798]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  103.933519] RIP: 0033:0x452719
[  103.936675] RSP: 002b:00007f989fd1fbe8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
[  103.944348] RAX: ffffffffffffffda RBX: 00000000007580d8 RCX: 0000000000452719
[  103.951585] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 0000000000000011
[  103.958819] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[  103.966054] R10: 0000000020ec8000 R11: 0000000000000212 R12: 0000000000000000
[  103.973289] R13: 0000000000a6f7ff R14: 00007f989fd209c0 R15: 0000000000000002
[  103.980887] Dumping ftrace buffer:
[  103.984400]    (ftrace buffer empty)
[  103.988077] Kernel Offset: disabled
[  103.991672] Rebooting in 86400 seconds..