INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-kasan-gce-0,10.128.15.203' (ECDSA) to the list of known hosts. net.ipv6.conf.syz0.accept_dad = 0 net.ipv6.conf.syz0.router_solicitations = 0 net.ipv6.conf.syz7.accept_dad = 0 net.ipv6.conf.syz2.accept_dad = 0 net.ipv6.conf.syz5.accept_dad = 0 net.ipv6.conf.syz6.accept_dad = 0 net.ipv6.conf.syz3.accept_dad = 0 net.ipv6.conf.syz7.router_solicitations = 0 net.ipv6.conf.syz2.router_solicitations = 0 net.ipv6.conf.syz3.router_solicitations = 0 net.ipv6.conf.syz5.router_solicitations = 0 net.ipv6.conf.syz6.router_solicitations = 0 net.ipv6.conf.syz4.accept_dad = 0 net.ipv6.conf.syz1.accept_dad = 0 net.ipv6.conf.syz4.router_solicitations = 0 net.ipv6.conf.syz1.router_solicitations = 0 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 76.044417] dev_remove_pack: ffff8801c8d4eb00 not found executing program executing program executing program [ 76.116409] ================================================================== [ 76.123834] BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2fa3/0x3230 [ 76.131360] Read of size 2 at addr ffff8801c8e91040 by task syzkaller564363/3026 [ 76.138886] [ 76.140508] CPU: 0 PID: 3026 Comm: syzkaller564363 Not tainted 4.13.0-rc7+ #64 [ 76.147853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 76.157195] Call Trace: [ 76.159778] [ 76.161924] dump_stack+0x194/0x257 [ 76.165544] ? arch_local_irq_restore+0x53/0x53 [ 76.170191] ? show_regs_print_info+0x65/0x65 [ 76.174678] ? __netif_receive_skb_core+0x2fa3/0x3230 [ 76.179876] print_address_description+0x73/0x250 [ 76.184862] ? __netif_receive_skb_core+0x2fa3/0x3230 [ 76.190069] kasan_report+0x24e/0x340 [ 76.193851] __asan_report_load2_noabort+0x14/0x20 [ 76.198762] __netif_receive_skb_core+0x2fa3/0x3230 [ 76.203789] ? nf_ingress+0x980/0x980 [ 76.207584] ? find_held_lock+0x35/0x1d0 [ 76.211639] ? lock_downgrade+0x990/0x990 [ 76.215766] ? __lock_acquire+0x6ef/0x3dc0 [ 76.219975] ? find_held_lock+0x35/0x1d0 [ 76.224038] ? print_usage_bug+0x480/0x480 [ 76.228256] ? is_bpf_text_address+0x7b/0x120 [ 76.232740] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.237908] ? __free_insn_slot+0x5c0/0x5c0 [ 76.242213] ? update_stack_state+0x700/0x700 [ 76.246735] ? find_held_lock+0x35/0x1d0 [ 76.250783] ? netif_receive_skb_internal+0x23e/0x1a50 [ 76.256057] ? lock_downgrade+0x990/0x990 [ 76.260581] ? pvclock_read_flags+0x160/0x160 [ 76.265060] ? mark_held_locks+0xaf/0x100 [ 76.269197] ? lock_acquire+0x1d5/0x580 [ 76.273153] ? lock_acquire+0x1d5/0x580 [ 76.277106] ? netif_receive_skb_internal+0xf1/0x1a50 [ 76.282284] ? ktime_get_with_offset+0x2c1/0x420 [ 76.287040] ? lock_release+0xa40/0xa40 [ 76.290998] ? do_gettimeofday+0x190/0x190 [ 76.295213] ? check_noncircular+0x20/0x20 [ 76.299431] ? netif_receive_skb_internal+0xf1/0x1a50 [ 76.304594] __netif_receive_skb+0x2c/0x1b0 [ 76.308896] ? __netif_receive_skb+0x2c/0x1b0 [ 76.313387] ? netif_receive_skb_internal+0xf1/0x1a50 [ 76.318560] netif_receive_skb_internal+0x16a/0x1a50 [ 76.323744] ? find_held_lock+0x35/0x1d0 [ 76.327803] ? dev_queue_xmit_accel+0x30/0x30 [ 76.332274] ? dev_gro_receive+0xc3e/0x19b0 [ 76.336570] ? lock_downgrade+0x990/0x990 [ 76.340693] ? lock_release+0xa40/0xa40 [ 76.345136] ? memset+0x31/0x40 [ 76.350948] ? dev_gro_receive+0x1be/0x19b0 [ 76.355264] ? __alloc_pages_nodemask+0xd40/0xd40 [ 76.360100] ? net_rx_action+0x1910/0x1910 [ 76.367179] ? __lock_is_held+0xb6/0x140 [ 76.371258] ? skb_gro_reset_offset+0x17b/0x300 [ 76.375908] napi_gro_receive+0x3d0/0x500 [ 76.380049] ? dev_gro_receive+0x19b0/0x19b0 [ 76.386210] ? eth_type_trans+0x2a3/0x650 [ 76.390337] ? eth_gro_receive+0x810/0x810 [ 76.395312] receive_buf+0xaef/0x5690 [ 76.399469] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 76.404042] ? sched_init_domains+0xb0/0x120 [ 76.408439] ? check_noncircular+0x20/0x20 [ 76.413660] ? update_curr+0x30c/0x800 [ 76.417539] ? nohz_balance_exit_idle.part.86+0x70/0x70 [ 76.423138] ? print_usage_bug+0x460/0x480 [ 76.427486] ? print_usage_bug+0x480/0x480 [ 76.431716] ? account_entity_enqueue+0x27d/0x4e0 [ 76.436663] ? __enqueue_entity+0x134/0x230 [ 76.440963] ? __update_load_avg_se.isra.23+0x39c/0x590 [ 76.446328] ? enqueue_task_fair+0x2541/0x7a10 [ 76.450900] ? update_curr+0x2cf/0x800 [ 76.454779] ? dequeue_task_fair+0x5c10/0x5c10 [ 76.459350] ? __lock_acquire+0x6ef/0x3dc0 [ 76.463567] ? enqueue_task_fair+0x2541/0x7a10 [ 76.468313] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.473489] ? dequeue_task_fair+0x5c10/0x5c10 [ 76.478067] ? select_task_rq_fair+0xeba/0x2ac0 [ 76.482722] ? print_usage_bug+0x480/0x480 [ 76.486944] ? _find_next_bit+0xee/0x120 [ 76.491011] ? _find_next_bit+0xee/0x120 [ 76.495190] ? select_task_rq_fair+0xed9/0x2ac0 [ 76.499861] ? __lock_acquire+0x6ef/0x3dc0 [ 76.504098] ? print_usage_bug+0x480/0x480 [ 76.508325] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.513504] ? check_noncircular+0x20/0x20 [ 76.517726] ? check_noncircular+0x20/0x20 [ 76.521943] ? check_noncircular+0x20/0x20 [ 76.526210] ? check_noncircular+0x20/0x20 [ 76.530431] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.535601] ? print_usage_bug+0x480/0x480 [ 76.539814] ? rb_insert_color+0x1570/0x1570 [ 76.544224] ? find_held_lock+0x35/0x1d0 [ 76.548268] ? print_usage_bug+0x480/0x480 [ 76.552484] ? __lock_acquire+0x6ef/0x3dc0 [ 76.556699] ? lock_downgrade+0x990/0x990 [ 76.560837] ? lock_release+0xa40/0xa40 [ 76.564807] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.569978] ? cpuacct_charge+0x2fd/0x5b0 [ 76.574109] ? cpuusage_read+0x10/0x10 [ 76.577979] ? check_noncircular+0x20/0x20 [ 76.582214] ? hrtimer_forward+0x2d0/0x2d0 [ 76.586428] ? check_noncircular+0x20/0x20 [ 76.590654] ? vring_use_dma_api+0x7f/0xa0 [ 76.594866] ? vring_unmap_one+0x49/0x3d0 [ 76.598996] ? detach_buf+0x463/0x6a0 [ 76.602779] ? print_usage_bug+0x480/0x480 [ 76.606990] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.612168] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 76.616991] ? cleanup_timers_list+0x330/0x330 [ 76.621557] ? detach_buf+0x6a0/0x6a0 [ 76.625340] virtnet_poll+0x50b/0xab0 [ 76.629120] ? pvclock_read_flags+0x160/0x160 [ 76.633607] ? receive_buf+0x5690/0x5690 [ 76.637667] ? mark_held_locks+0xaf/0x100 [ 76.641809] ? net_rx_action+0x49b/0x1910 [ 76.645940] net_rx_action+0x792/0x1910 [ 76.649923] ? napi_complete_done+0x6c0/0x6c0 [ 76.654405] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.659580] ? trigger_load_balance+0x3c8/0x11b0 [ 76.664337] ? __run_timers+0x947/0xb90 [ 76.668304] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.673474] ? __lock_is_held+0xb6/0x140 [ 76.677533] ? rcu_read_lock_sched_held+0x108/0x120 [ 76.682653] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 76.687484] ? raise_softirq+0x490/0x490 [ 76.691538] ? print_usage_bug+0x480/0x480 [ 76.695750] ? print_usage_bug+0x480/0x480 [ 76.699973] ? timerqueue_add+0x1e9/0x280 [ 76.704118] ? trace_hardirqs_off+0xd/0x10 [ 76.708340] ? __napi_schedule+0x25e/0x370 [ 76.712560] ? netdev_info+0x170/0x170 [ 76.716427] ? check_noncircular+0x20/0x20 [ 76.720646] ? __lock_is_held+0xb6/0x140 [ 76.724696] ? check_noncircular+0x20/0x20 [ 76.728906] ? rcu_read_lock_sched_held+0x108/0x120 [ 76.733901] ? __handle_irq_event_percpu+0x308/0x9d0 [ 76.739004] ? __lock_is_held+0xb6/0x140 [ 76.743073] __do_softirq+0x2f5/0xba3 [ 76.746862] ? handle_edge_irq+0x2b4/0x7c0 [ 76.751075] ? __softirqentry_text_start+0x8/0x8 [ 76.755808] ? do_raw_spin_trylock+0x190/0x190 [ 76.760372] ? handle_irq_event_percpu+0x141/0x1b0 [ 76.765274] ? native_apic_msr_write+0x30/0x80 [ 76.769831] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 76.774907] ? lapic_next_event+0x5a/0x90 [ 76.779124] ? _raw_spin_lock+0x32/0x40 [ 76.783085] ? _raw_spin_unlock+0x22/0x30 [ 76.787210] ? handle_edge_irq+0x2b4/0x7c0 [ 76.791451] irq_exit+0x1cc/0x200 [ 76.794892] do_IRQ+0xf6/0x190 [ 76.798070] common_interrupt+0x93/0x93 [ 76.802165] RIP: 0010:__vm_enough_memory+0x30e/0x810 [ 76.807238] RSP: 0018:ffff8801d0ec6fc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff6e [ 76.814930] RAX: 000000000017732b RBX: 1ffff1003a1d8dfe RCX: dffffc0000000000 [ 76.822183] RDX: ffff8801d0ec7050 RSI: 0000000000000000 RDI: ffff8801d0ec7050 [ 76.829426] RBP: ffff8801d0ec7178 R08: 1ffffffff0c3c684 R09: 1ffff1003a1d8d7d [ 76.836669] R10: ffff8801d0ec6bb0 R11: 0000000000000003 R12: ffff8801d0ec7150 [ 76.843914] R13: ffffffff85ba6320 R14: 0000000000000001 R15: dffffc0000000000 [ 76.851166] [ 76.853405] ? __vm_enough_memory+0x17d/0x810 [ 76.857885] ? vm_commit_limit+0xc0/0xc0 [ 76.861934] ? up_write+0x6b/0x120 [ 76.865459] ? up_read+0x40/0x40 [ 76.868802] ? anon_vma_interval_tree_insert+0x22a/0x2c0 [ 76.874233] ? anon_vma_fork+0x121/0x870 [ 76.878289] ? anon_vma_clone+0x700/0x700 [ 76.882426] ? cap_capable+0x168/0x1c0 [ 76.886311] security_vm_enough_memory_mm+0x90/0xb0 [ 76.891318] copy_mm+0x8af/0x1247 [ 76.894771] ? list_add_tail_rcu+0x193/0x193 [ 76.899172] ? check_same_owner+0x320/0x320 [ 76.903483] ? rcu_pm_notify+0xc0/0xc0 [ 76.907359] ? copy_process.part.35+0x204c/0x4bd0 [ 76.912282] ? rcu_read_lock_sched_held+0x108/0x120 [ 76.917276] ? kmem_cache_alloc+0x45f/0x750 [ 76.921578] ? _raw_spin_unlock+0x22/0x30 [ 76.925728] copy_process.part.35+0x1ec4/0x4bd0 [ 76.930410] ? __cleanup_sighand+0x40/0x40 [ 76.934635] ? lock_release+0xa40/0xa40 [ 76.938603] ? update_stack_state+0x700/0x700 [ 76.943088] ? print_usage_bug+0x480/0x480 [ 76.947305] ? print_usage_bug+0x480/0x480 [ 76.951513] ? print_usage_bug+0x480/0x480 [ 76.955740] ? print_usage_bug+0x480/0x480 [ 76.959979] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.965172] ? __lock_acquire+0x6ef/0x3dc0 [ 76.969403] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.974585] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.979752] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 76.984915] ? check_noncircular+0x20/0x20 [ 76.989136] ? check_noncircular+0x20/0x20 [ 76.993376] ? check_noncircular+0x20/0x20 [ 76.997588] ? security_context_to_sid_core+0x620/0x620 [ 77.002925] ? __lock_is_held+0xb6/0x140 [ 77.006987] ? fsnotify+0xb6f/0x1af0 [ 77.010692] ? find_held_lock+0x35/0x1d0 [ 77.014742] ? find_held_lock+0x35/0x1d0 [ 77.018790] ? check_noncircular+0x20/0x20 [ 77.023024] ? __d_instantiate+0x4d8/0x710 [ 77.027258] ? check_noncircular+0x20/0x20 [ 77.031496] _do_fork+0x1ef/0xfb0 [ 77.034962] ? fork_idle+0x2d0/0x2d0 [ 77.038696] ? mntput_no_expire+0x130/0xa90 [ 77.042998] ? lock_downgrade+0x990/0x990 [ 77.047140] ? lock_release+0xa40/0xa40 [ 77.051097] ? find_held_lock+0x35/0x1d0 [ 77.055143] ? lock_downgrade+0x990/0x990 [ 77.059280] ? mntput_no_expire+0x15e/0xa90 [ 77.063578] ? mnt_get_count+0x160/0x160 [ 77.067627] SyS_clone+0x37/0x50 [ 77.070979] ? ptregs_sys_rt_sigreturn+0x10/0x10 [ 77.075726] do_syscall_64+0x26c/0x800 [ 77.079584] ? dput.part.24+0x175/0x740 [ 77.083544] ? syscall_return_slowpath+0x450/0x450 [ 77.088456] ? done_path_create+0xcc/0x110 [ 77.092681] ? SyS_mkdir+0x17b/0x270 [ 77.096379] ? entry_SYSCALL_64_fastpath+0x5/0xbe [ 77.101200] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 77.106029] ? sys_vfork+0x30/0x30 [ 77.109568] entry_SYSCALL64_slow_path+0x25/0x25 [ 77.114418] RIP: 0033:0x44a59a