INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-8,10.128.0.3' (ECDSA) to the list of known hosts.
2017/09/27 07:56:10 parsed 1 programs
2017/09/27 07:56:10 executed programs: 0
syzkaller login: [   43.870010] ==================================================================
[   43.877438] BUG: KASAN: use-after-free in __do_page_fault+0xc03/0xd60
[   43.883994] Read of size 8 at addr ffff8801cf2ef890 by task syz-executor4/3914
[   43.891326] 
[   43.892934] CPU: 0 PID: 3914 Comm: syz-executor4 Not tainted 4.14.0-rc2-next-20170927+ #30
[   43.901307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   43.910633] Call Trace:
[   43.913195]  dump_stack+0x194/0x257
[   43.916799]  ? arch_local_irq_restore+0x53/0x53
[   43.921442]  ? show_regs_print_info+0x65/0x65
[   43.925928]  ? __do_page_fault+0xc03/0xd60
[   43.930140]  print_address_description+0x73/0x250
[   43.934959]  ? __do_page_fault+0xc03/0xd60
[   43.939170]  kasan_report+0x25b/0x340
[   43.942950]  __asan_report_load8_noabort+0x14/0x20
[   43.947854]  __do_page_fault+0xc03/0xd60
[   43.951901]  ? mm_fault_error+0x2c0/0x2c0
[   43.956025]  ? free_pidmap.isra.0+0x70/0x70
[   43.960331]  do_page_fault+0xee/0x720
[   43.964109]  ? __do_page_fault+0xd60/0xd60
[   43.968322]  ? SyS_futex+0x269/0x390
[   43.972017]  ? do_futex+0x20d0/0x20d0
[   43.975792]  ? __task_pid_nr_ns+0x2c7/0x540
[   43.980087]  ? entry_SYSCALL_64_fastpath+0x4b/0xbe
[   43.985004]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   43.989829]  page_fault+0x22/0x30
[   43.993256] RIP: 0033:0x44bcf0
[   43.996418] RSP: 002b:00007f5e73838758 EFLAGS: 00010202
[   44.001756] RAX: 00007f5e73838800 RBX: 0000000000718000 RCX: 000000000000000e
[   44.009002] RDX: 0000000000000400 RSI: 0000000020012fe0 RDI: 00007f5e73838800
[   44.016246] RBP: 0000000000005e10 R08: 0000000000000400 R09: 0000000000000000
[   44.023490] R10: 00000000000f4245 R11: 0000000000000246 R12: 00000000004bbc27
[   44.030737] R13: 00000000ffffffff R14: 0000000020012fee R15: 0000000000000000
[   44.038012] 
[   44.039612] Allocated by task 3914:
[   44.043215]  save_stack_trace+0x16/0x20
[   44.047162]  save_stack+0x43/0xd0
[   44.050586]  kasan_kmalloc+0xad/0xe0
[   44.054271]  kasan_slab_alloc+0x12/0x20
[   44.058218]  kmem_cache_alloc+0x12e/0x760
[   44.062337]  mmap_region+0x7ee/0x15a0
[   44.066110]  do_mmap+0x6a1/0xd50
[   44.069452]  vm_mmap_pgoff+0x1de/0x280
[   44.073311]  SyS_mmap_pgoff+0x23b/0x5f0
[   44.077257]  SyS_mmap+0x16/0x20
[   44.080509]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.085231] 
[   44.086829] Freed by task 3925:
[   44.090076]  save_stack_trace+0x16/0x20
[   44.094019]  save_stack+0x43/0xd0
[   44.097443]  kasan_slab_free+0x71/0xc0
[   44.101300]  kmem_cache_free+0x77/0x280
[   44.105246]  remove_vma+0x162/0x1b0
[   44.108847]  do_munmap+0x82a/0xdf0
[   44.112358]  mmap_region+0x59e/0x15a0
[   44.116131]  do_mmap+0x6a1/0xd50
[   44.119471]  vm_mmap_pgoff+0x1de/0x280
[   44.123332]  SyS_mmap_pgoff+0x23b/0x5f0
[   44.127278]  SyS_mmap+0x16/0x20
[   44.130529]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.135264] 
[   44.136867] The buggy address belongs to the object at ffff8801cf2ef840
[   44.136867]  which belongs to the cache vm_area_struct of size 200
[   44.149762] The buggy address is located 80 bytes inside of
[   44.149762]  200-byte region [ffff8801cf2ef840, ffff8801cf2ef908)
[   44.161518] The buggy address belongs to the page:
[   44.166418] page:ffffea00073cbbc0 count:1 mapcount:0 mapping:ffff8801cf2ef000 index:0x0
[   44.174536] flags: 0x200000000000100(slab)
[   44.178743] raw: 0200000000000100 ffff8801cf2ef000 0000000000000000 000000010000000f
[   44.186595] raw: ffffea000733a320 ffffea00072f5420 ffff8801dae0a9c0 0000000000000000
[   44.194452] page dumped because: kasan: bad access detected
[   44.200133] 
[   44.201730] Memory state around the buggy address:
[   44.206633]  ffff8801cf2ef780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.213963]  ffff8801cf2ef800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   44.221293] >ffff8801cf2ef880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.228623]                          ^
[   44.232483]  ffff8801cf2ef900: fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb
[   44.239814]  ffff8801cf2ef980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.247143] ==================================================================
[   44.254471] Disabling lock debugging due to kernel taint
[   44.259983] Kernel panic - not syncing: panic_on_warn set ...
[   44.259983] 
[   44.267318] CPU: 0 PID: 3914 Comm: syz-executor4 Tainted: G    B           4.14.0-rc2-next-20170927+ #30
[   44.276906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   44.286226] Call Trace:
[   44.288780]  dump_stack+0x194/0x257
[   44.292374]  ? arch_local_irq_restore+0x53/0x53
[   44.297019]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   44.301744]  ? __do_page_fault+0xb90/0xd60
[   44.305947]  panic+0x1e4/0x417
[   44.309111]  ? __warn+0x1d9/0x1d9
[   44.312537]  ? __do_page_fault+0xc03/0xd60
[   44.316738]  kasan_end_report+0x50/0x50
[   44.320677]  kasan_report+0x144/0x340
[   44.324457]  __asan_report_load8_noabort+0x14/0x20
[   44.329368]  __do_page_fault+0xc03/0xd60
[   44.333405]  ? mm_fault_error+0x2c0/0x2c0
[   44.337524]  ? free_pidmap.isra.0+0x70/0x70
[   44.341825]  do_page_fault+0xee/0x720
[   44.345597]  ? __do_page_fault+0xd60/0xd60
[   44.349802]  ? SyS_futex+0x269/0x390
[   44.353489]  ? do_futex+0x20d0/0x20d0
[   44.357256]  ? __task_pid_nr_ns+0x2c7/0x540
[   44.361545]  ? entry_SYSCALL_64_fastpath+0x4b/0xbe
[   44.366444]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   44.371258]  page_fault+0x22/0x30
[   44.374676] RIP: 0033:0x44bcf0
[   44.377831] RSP: 002b:00007f5e73838758 EFLAGS: 00010202
[   44.383158] RAX: 00007f5e73838800 RBX: 0000000000718000 RCX: 000000000000000e
[   44.390393] RDX: 0000000000000400 RSI: 0000000020012fe0 RDI: 00007f5e73838800
[   44.397626] RBP: 0000000000005e10 R08: 0000000000000400 R09: 0000000000000000
[   44.404862] R10: 00000000000f4245 R11: 0000000000000246 R12: 00000000004bbc27
[   44.412097] R13: 00000000ffffffff R14: 0000000020012fee R15: 0000000000000000
[   44.419781] Dumping ftrace buffer:
[   44.423285]    (ftrace buffer empty)
[   44.426961] Kernel Offset: disabled
[   44.430553] Rebooting in 86400 seconds..