INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-3,10.128.0.42' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   47.931688] device lo entered promiscuous mode
executing program
[   48.022391] ==================================================================
[   48.029781] BUG: KASAN: use-after-free in sctp_association_free+0x7b7/0x930
[   48.036931] Read of size 8 at addr ffff8801d1af0a20 by task syzkaller287969/3008
[   48.044426] 
[   48.046023] CPU: 1 PID: 3008 Comm: syzkaller287969 Not tainted 4.14.0-rc6+ #152
[   48.053434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.062755] Call Trace:
[   48.065314]  dump_stack+0x194/0x257
[   48.068912]  ? arch_local_irq_restore+0x53/0x53
[   48.073553]  ? show_regs_print_info+0x65/0x65
[   48.078023]  ? sctp_association_free+0x7b7/0x930
[   48.082747]  print_address_description+0x73/0x250
[   48.087557]  ? sctp_association_free+0x7b7/0x930
[   48.092280]  kasan_report+0x25b/0x340
[   48.096055]  __asan_report_load8_noabort+0x14/0x20
[   48.100951]  sctp_association_free+0x7b7/0x930
[   48.105507]  ? sctp_asconf_queue_teardown+0x700/0x700
[   48.110673]  ? sctp_init_sock+0x1350/0x1350
[   48.114964]  ? sctp_outq_tail+0x860/0x860
[   48.119082]  ? finish_wait+0x490/0x490
[   48.122937]  ? sctp_assoc_set_bind_addr_from_ep+0x136/0x190
[   48.128620]  sctp_sendmsg+0x2311/0x31f0
[   48.132573]  ? sctp_id2assoc+0x390/0x390
[   48.136605]  ? check_noncircular+0x20/0x20
[   48.140822]  ? iterate_fd+0x3f0/0x3f0
[   48.144593]  ? check_noncircular+0x20/0x20
[   48.148811]  ? find_held_lock+0x35/0x1d0
[   48.152848]  ? __might_fault+0x110/0x1d0
[   48.156884]  ? selinux_tun_dev_create+0xc0/0xc0
[   48.161525]  ? __check_object_size+0x25d/0x4f0
[   48.166078]  inet_sendmsg+0x11f/0x5e0
[   48.169841]  ? inet_sendmsg+0x11f/0x5e0
[   48.173783]  ? __might_sleep+0x95/0x190
[   48.177725]  ? inet_recvmsg+0x5f0/0x5f0
[   48.181670]  ? selinux_socket_sendmsg+0x36/0x40
[   48.186306]  ? security_socket_sendmsg+0x89/0xb0
[   48.191028]  ? inet_recvmsg+0x5f0/0x5f0
[   48.194975]  sock_sendmsg+0xca/0x110
[   48.198659]  SYSC_sendto+0x352/0x5a0
[   48.202343]  ? SYSC_connect+0x470/0x470
[   48.206298]  ? mm_fault_error+0x2c0/0x2c0
[   48.210414]  ? do_raw_spin_trylock+0x190/0x190
[   48.214965]  ? lock_release+0xa40/0xa40
[   48.218917]  ? __do_page_fault+0xd60/0xd60
[   48.223118]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   48.228108]  ? syscall_return_slowpath+0x2b3/0x510
[   48.233004]  ? finish_task_switch+0x1aa/0x740
[   48.237465]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   48.242452]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   48.247264]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   48.252250]  SyS_sendto+0x40/0x50
[   48.255673]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.260394] RIP: 0033:0x446f79
[   48.263552] RSP: 002b:00007f5222799db8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c
[   48.271226] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446f79
[   48.278462] RDX: 0000000000000002 RSI: 0000000020925000 RDI: 0000000000000003
[   48.285700] RBP: 0000000000000082 R08: 00000000209e1000 R09: 000000000000001c
[   48.292937] R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
[   48.300172] R13: 00000000007efd1f R14: 00007f522279a9c0 R15: 0000000000000000
[   48.307422] 
[   48.309017] Allocated by task 3008:
[   48.312614]  save_stack_trace+0x16/0x20
[   48.316554]  save_stack+0x43/0xd0
[   48.319973]  kasan_kmalloc+0xad/0xe0
[   48.323654]  kmem_cache_alloc_trace+0x136/0x750
[   48.328288]  sctp_association_new+0x114/0x21e0
[   48.332837]  sctp_sendmsg+0x128c/0x31f0
[   48.336776]  inet_sendmsg+0x11f/0x5e0
[   48.340541]  sock_sendmsg+0xca/0x110
[   48.344220]  SYSC_sendto+0x352/0x5a0
[   48.347896]  SyS_sendto+0x40/0x50
[   48.351314]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.356032] 
[   48.357626] Freed by task 3008:
[   48.360871]  save_stack_trace+0x16/0x20
[   48.364810]  save_stack+0x43/0xd0
[   48.368227]  kasan_slab_free+0x71/0xc0
[   48.372078]  kfree+0xca/0x250
[   48.375147]  sctp_association_put+0x21c/0x2f0
[   48.379609]  sctp_wait_for_sndbuf+0x5e3/0x7c0
[   48.384072]  sctp_sendmsg+0x2750/0x31f0
[   48.388010]  inet_sendmsg+0x11f/0x5e0
[   48.391779]  sock_sendmsg+0xca/0x110
[   48.395457]  SYSC_sendto+0x352/0x5a0
[   48.399134]  SyS_sendto+0x40/0x50
[   48.402553]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.407268] 
[   48.408862] The buggy address belongs to the object at ffff8801d1af0a00
[   48.408862]  which belongs to the cache kmalloc-4096 of size 4096
[   48.421656] The buggy address is located 32 bytes inside of
[   48.421656]  4096-byte region [ffff8801d1af0a00, ffff8801d1af1a00)
[   48.433493] The buggy address belongs to the page:
[   48.438390] page:ffffea000746bc00 count:1 mapcount:0 mapping:ffff8801d1af0a00 index:0x0 compound_mapcount: 0
[   48.448326] flags: 0x200000000008100(slab|head)
[   48.452962] raw: 0200000000008100 ffff8801d1af0a00 0000000000000000 0000000100000001
[   48.460808] raw: ffffea000746baa0 ffffea000746bda0 ffff8801dac00dc0 0000000000000000
[   48.468650] page dumped because: kasan: bad access detected
[   48.474322] 
[   48.475914] Memory state around the buggy address:
[   48.480807]  ffff8801d1af0900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   48.488130]  ffff8801d1af0980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   48.495453] >ffff8801d1af0a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.502775]                                ^
[   48.507147]  ffff8801d1af0a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.514471]  ffff8801d1af0b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.521793] ==================================================================
[   48.529113] Disabling lock debugging due to kernel taint
[   48.534608] Kernel panic - not syncing: panic_on_warn set ...
[   48.534608] 
[   48.541938] CPU: 1 PID: 3008 Comm: syzkaller287969 Tainted: G    B           4.14.0-rc6+ #152
[   48.550566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.559889] Call Trace:
[   48.562449]  dump_stack+0x194/0x257
[   48.566044]  ? arch_local_irq_restore+0x53/0x53
[   48.570680]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   48.575404]  ? sctp_association_free+0x750/0x930
[   48.580126]  panic+0x1e4/0x417
[   48.583285]  ? __warn+0x1d9/0x1d9
[   48.586710]  ? sctp_association_free+0x7b7/0x930
[   48.591434]  kasan_end_report+0x50/0x50
[   48.595374]  kasan_report+0x144/0x340
[   48.599138]  __asan_report_load8_noabort+0x14/0x20
[   48.604033]  sctp_association_free+0x7b7/0x930
[   48.608581]  ? sctp_asconf_queue_teardown+0x700/0x700
[   48.613737]  ? sctp_init_sock+0x1350/0x1350
[   48.618022]  ? sctp_outq_tail+0x860/0x860
[   48.622172]  ? finish_wait+0x490/0x490
[   48.626027]  ? sctp_assoc_set_bind_addr_from_ep+0x136/0x190
[   48.631703]  sctp_sendmsg+0x2311/0x31f0
[   48.635649]  ? sctp_id2assoc+0x390/0x390
[   48.639676]  ? check_noncircular+0x20/0x20
[   48.643882]  ? iterate_fd+0x3f0/0x3f0
[   48.647650]  ? check_noncircular+0x20/0x20
[   48.651850]  ? find_held_lock+0x35/0x1d0
[   48.655884]  ? __might_fault+0x110/0x1d0
[   48.659914]  ? selinux_tun_dev_create+0xc0/0xc0
[   48.664550]  ? __check_object_size+0x25d/0x4f0
[   48.669103]  inet_sendmsg+0x11f/0x5e0
[   48.672873]  ? inet_sendmsg+0x11f/0x5e0
[   48.676810]  ? __might_sleep+0x95/0x190
[   48.680748]  ? inet_recvmsg+0x5f0/0x5f0
[   48.684690]  ? selinux_socket_sendmsg+0x36/0x40
[   48.689324]  ? security_socket_sendmsg+0x89/0xb0
[   48.694045]  ? inet_recvmsg+0x5f0/0x5f0
[   48.697989]  sock_sendmsg+0xca/0x110
[   48.701667]  SYSC_sendto+0x352/0x5a0
[   48.705347]  ? SYSC_connect+0x470/0x470
[   48.709292]  ? mm_fault_error+0x2c0/0x2c0
[   48.713406]  ? do_raw_spin_trylock+0x190/0x190
[   48.718658]  ? lock_release+0xa40/0xa40
[   48.722600]  ? __do_page_fault+0xd60/0xd60
[   48.726798]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   48.731782]  ? syscall_return_slowpath+0x2b3/0x510
[   48.736675]  ? finish_task_switch+0x1aa/0x740
[   48.741136]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   48.746117]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   48.750924]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   48.755907]  SyS_sendto+0x40/0x50
[   48.759414]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.764134] RIP: 0033:0x446f79
[   48.767291] RSP: 002b:00007f5222799db8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c
[   48.774963] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446f79
[   48.782199] RDX: 0000000000000002 RSI: 0000000020925000 RDI: 0000000000000003
[   48.789440] RBP: 0000000000000082 R08: 00000000209e1000 R09: 000000000000001c
[   48.796674] R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
[   48.803916] R13: 00000000007efd1f R14: 00007f522279a9c0 R15: 0000000000000000
[   48.811492] Dumping ftrace buffer:
[   48.815003]    (ftrace buffer empty)
[   48.818763] Kernel Offset: disabled
[   48.822356] Rebooting in 86400 seconds..