Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts.
2018/12/17 16:02:20 parsed 1 programs
2018/12/17 16:02:23 executed programs: 0
syzkaller login: [   44.933846] IPVS: ftp: loaded support on port[0] = 21
[   45.187500] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.194552] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.201524] device bridge_slave_0 entered promiscuous mode
[   45.220033] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.226494] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.233604] device bridge_slave_1 entered promiscuous mode
[   45.252324] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[   45.271030] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[   45.323817] bond0: Enslaving bond_slave_0 as an active interface with an up link
[   45.345041] bond0: Enslaving bond_slave_1 as an active interface with an up link
[   45.421565] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[   45.428938] team0: Port device team_slave_0 added
[   45.446545] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[   45.453845] team0: Port device team_slave_1 added
[   45.471481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   45.490276] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   45.509709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   45.528764] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   45.672773] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.679452] bridge0: port 2(bridge_slave_1) entered forwarding state
[   45.686361] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.692734] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.208945] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.260940] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[   46.313798] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[   46.319948] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   46.328904] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   46.379203] 8021q: adding VLAN 0 to HW filter on device team0
[   48.119175] ==================================================================
[   48.126698] BUG: KASAN: use-after-free in __list_add_valid+0x8f/0xac
[   48.133192] Read of size 8 at addr ffff8881b739cbe0 by task syz-executor0/6602
[   48.140529] 
[   48.142145] CPU: 1 PID: 6602 Comm: syz-executor0 Not tainted 4.20.0-rc7+ #278
[   48.149399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.158734] Call Trace:
[   48.161325]  dump_stack+0x244/0x39d
[   48.164964]  ? dump_stack_print_info.cold.1+0x20/0x20
[   48.170149]  ? printk+0xa7/0xcf
[   48.173442]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   48.178199]  ? kasan_check_read+0x11/0x20
[   48.182339]  print_address_description.cold.7+0x9/0x1ff
[   48.187716]  kasan_report.cold.8+0x242/0x309
[   48.192132]  ? __list_add_valid+0x8f/0xac
[   48.196292]  __asan_report_load8_noabort+0x14/0x20
[   48.201218]  __list_add_valid+0x8f/0xac
[   48.205183]  rdma_listen+0x6dc/0x990
[   48.208924]  ? rdma_resolve_addr+0x2870/0x2870
[   48.213513]  ucma_listen+0x1a4/0x260
[   48.217229]  ? ucma_notify+0x210/0x210
[   48.221113]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   48.226649]  ? _copy_from_user+0xdf/0x150
[   48.230805]  ? ucma_notify+0x210/0x210
[   48.234683]  ucma_write+0x365/0x460
[   48.238312]  ? ucma_open+0x3f0/0x3f0
[   48.242043]  ? find_held_lock+0x36/0x1c0
[   48.246124]  __vfs_write+0x119/0x9f0
[   48.249825]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   48.254750]  ? ucma_open+0x3f0/0x3f0
[   48.258457]  ? kernel_read+0x120/0x120
[   48.262330]  ? apparmor_path_rmdir+0x30/0x30
[   48.266722]  ? trace_hardirqs_off_caller+0x310/0x310
[   48.271815]  ? apparmor_file_permission+0x24/0x30
[   48.276665]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   48.282187]  ? security_file_permission+0x1c2/0x220
[   48.287224]  ? rw_verify_area+0x118/0x360
[   48.291373]  vfs_write+0x1fc/0x560
[   48.294923]  ksys_write+0x101/0x260
[   48.298540]  ? __ia32_sys_read+0xb0/0xb0
[   48.302584]  ? trace_hardirqs_off_caller+0x310/0x310
[   48.307678]  __ia32_sys_write+0x71/0xb0
[   48.311646]  do_fast_syscall_32+0x34d/0xfb2
[   48.315966]  ? do_int80_syscall_32+0x890/0x890
[   48.320534]  ? entry_SYSENTER_compat+0x68/0x7f
[   48.325100]  ? trace_hardirqs_off_caller+0xbb/0x310
[   48.330119]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   48.334957]  ? trace_hardirqs_on_caller+0x310/0x310
[   48.339977]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   48.344988]  ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250
[   48.351709]  ? __switch_to_asm+0x40/0x70
[   48.355786]  ? __switch_to_asm+0x34/0x70
[   48.359834]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   48.364687]  entry_SYSENTER_compat+0x70/0x7f
[   48.369094] RIP: 0023:0xf7f3ea29
[   48.372459] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
[   48.391363] RSP: 002b:00000000f7f3a0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000004
[   48.399072] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200003c0
[   48.406336] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000
[   48.413606] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   48.420870] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   48.428130] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   48.435384] 
[   48.437025] Allocated by task 6596:
[   48.440640]  save_stack+0x43/0xd0
[   48.444091]  kasan_kmalloc+0xc7/0xe0
[   48.447798]  kmem_cache_alloc_trace+0x152/0x750
[   48.452449]  __rdma_create_id+0xdf/0x650
[   48.456510]  ucma_create_id+0x39b/0x990
[   48.460528]  ucma_write+0x365/0x460
[   48.464139]  __vfs_write+0x119/0x9f0
[   48.467841]  vfs_write+0x1fc/0x560
[   48.471398]  ksys_write+0x101/0x260
[   48.475010]  __ia32_sys_write+0x71/0xb0
[   48.478966]  do_fast_syscall_32+0x34d/0xfb2
[   48.483272]  entry_SYSENTER_compat+0x70/0x7f
[   48.487654] 
[   48.489272] Freed by task 6595:
[   48.492551]  save_stack+0x43/0xd0
[   48.496009]  __kasan_slab_free+0x102/0x150
[   48.500241]  kasan_slab_free+0xe/0x10
[   48.504031]  kfree+0xcf/0x230
[   48.507141]  rdma_destroy_id+0x835/0xcc0
[   48.511222]  ucma_close+0x114/0x310
[   48.514830]  __fput+0x385/0xa30
[   48.518095]  ____fput+0x15/0x20
[   48.521361]  task_work_run+0x1e8/0x2a0
[   48.525232]  exit_to_usermode_loop+0x318/0x380
[   48.529802]  do_fast_syscall_32+0xcd5/0xfb2
[   48.534124]  entry_SYSENTER_compat+0x70/0x7f
[   48.538511] 
[   48.540121] The buggy address belongs to the object at ffff8881b739ca00
[   48.540121]  which belongs to the cache kmalloc-2k of size 2048
[   48.552761] The buggy address is located 480 bytes inside of
[   48.552761]  2048-byte region [ffff8881b739ca00, ffff8881b739d200)
[   48.564702] The buggy address belongs to the page:
[   48.569644] page:ffffea0006dce700 count:1 mapcount:0 mapping:ffff8881da800c40 index:0x0 compound_mapcount: 0
[   48.579615] flags: 0x2fffc0000010200(slab|head)
[   48.584270] raw: 02fffc0000010200 ffffea0006e70908 ffff8881da801948 ffff8881da800c40
[   48.592135] raw: 0000000000000000 ffff8881b739c180 0000000100000003 0000000000000000
[   48.599996] page dumped because: kasan: bad access detected
[   48.605701] 
[   48.607317] Memory state around the buggy address:
[   48.612258]  ffff8881b739ca80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.619601]  ffff8881b739cb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.626970] >ffff8881b739cb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.634315]                                                        ^
[   48.640799]  ffff8881b739cc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.648137]  ffff8881b739cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.655472] ==================================================================
[   48.662805] Disabling lock debugging due to kernel taint
[   48.669545] Kernel panic - not syncing: panic_on_warn set ...
[   48.675434] CPU: 1 PID: 6602 Comm: syz-executor0 Tainted: G    B             4.20.0-rc7+ #278
[   48.684075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.693413] Call Trace:
[   48.696003]  dump_stack+0x244/0x39d
[   48.699616]  ? dump_stack_print_info.cold.1+0x20/0x20
[   48.704819]  panic+0x2ad/0x55c
[   48.708000]  ? add_taint.cold.5+0x16/0x16
[   48.712147]  ? preempt_schedule+0x4d/0x60
[   48.716297]  ? ___preempt_schedule+0x16/0x18
[   48.720708]  ? trace_hardirqs_on+0xb4/0x310
[   48.725016]  kasan_end_report+0x47/0x4f
[   48.728975]  kasan_report.cold.8+0x76/0x309
[   48.733283]  ? __list_add_valid+0x8f/0xac
[   48.737428]  __asan_report_load8_noabort+0x14/0x20
[   48.742340]  __list_add_valid+0x8f/0xac
[   48.746303]  rdma_listen+0x6dc/0x990
[   48.750004]  ? rdma_resolve_addr+0x2870/0x2870
[   48.754574]  ucma_listen+0x1a4/0x260
[   48.758274]  ? ucma_notify+0x210/0x210
[   48.762153]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   48.767715]  ? _copy_from_user+0xdf/0x150
[   48.771879]  ? ucma_notify+0x210/0x210
[   48.775775]  ucma_write+0x365/0x460
[   48.779606]  ? ucma_open+0x3f0/0x3f0
[   48.783329]  ? find_held_lock+0x36/0x1c0
[   48.787380]  __vfs_write+0x119/0x9f0
[   48.791079]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   48.795992]  ? ucma_open+0x3f0/0x3f0
[   48.799719]  ? kernel_read+0x120/0x120
[   48.803590]  ? apparmor_path_rmdir+0x30/0x30
[   48.807984]  ? trace_hardirqs_off_caller+0x310/0x310
[   48.813071]  ? apparmor_file_permission+0x24/0x30
[   48.817903]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   48.823442]  ? security_file_permission+0x1c2/0x220
[   48.828439]  ? rw_verify_area+0x118/0x360
[   48.832569]  vfs_write+0x1fc/0x560
[   48.836095]  ksys_write+0x101/0x260
[   48.839730]  ? __ia32_sys_read+0xb0/0xb0
[   48.843787]  ? trace_hardirqs_off_caller+0x310/0x310
[   48.848876]  __ia32_sys_write+0x71/0xb0
[   48.852841]  do_fast_syscall_32+0x34d/0xfb2
[   48.857146]  ? do_int80_syscall_32+0x890/0x890
[   48.861724]  ? entry_SYSENTER_compat+0x68/0x7f
[   48.866301]  ? trace_hardirqs_off_caller+0xbb/0x310
[   48.871301]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   48.876157]  ? trace_hardirqs_on_caller+0x310/0x310
[   48.881175]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   48.886195]  ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250
[   48.892858]  ? __switch_to_asm+0x40/0x70
[   48.896921]  ? __switch_to_asm+0x34/0x70
[   48.900977]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   48.905834]  entry_SYSENTER_compat+0x70/0x7f
[   48.910231] RIP: 0023:0xf7f3ea29
[   48.913599] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
[   48.932499] RSP: 002b:00000000f7f3a0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000004
[   48.940202] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200003c0
[   48.947490] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000
[   48.954770] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   48.962030] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   48.969295] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   48.977526] Kernel Offset: disabled
[   48.981154] Rebooting in 86400 seconds..