INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-kasan-gce-386-2,10.128.0.24' (ECDSA) to the list of known hosts. 2017/10/03 17:24:32 parsed 1 programs 2017/10/03 17:24:32 executed programs: 0 syzkaller login: [ 33.063515] ================================================================== [ 33.070990] BUG: KASAN: use-after-free in __do_page_fault+0xc03/0xd60 [ 33.077567] Read of size 8 at addr ffff8801cacf26c0 by task syz-executor3/3968 [ 33.084911] [ 33.086529] CPU: 0 PID: 3968 Comm: syz-executor3 Not tainted 4.14.0-rc3+ #23 [ 33.093700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.103045] Call Trace: [ 33.105610] dump_stack+0x194/0x257 [ 33.109224] ? arch_local_irq_restore+0x53/0x53 [ 33.113890] ? show_regs_print_info+0x65/0x65 [ 33.118389] ? __do_page_fault+0xc03/0xd60 [ 33.122625] print_address_description+0x73/0x250 [ 33.127465] ? __do_page_fault+0xc03/0xd60 [ 33.131687] kasan_report+0x25b/0x340 [ 33.135481] __asan_report_load8_noabort+0x14/0x20 [ 33.140395] __do_page_fault+0xc03/0xd60 [ 33.144440] ? __task_pid_nr_ns+0x2c7/0x540 [ 33.148755] ? mm_fault_error+0x2c0/0x2c0 [ 33.152898] ? lockdep_sys_exit+0x47/0xf0 [ 33.157047] do_page_fault+0xee/0x720 [ 33.160834] ? __do_page_fault+0xd60/0xd60 [ 33.165062] ? lockdep_sys_exit+0x47/0xf0 [ 33.169211] ? syscall_return_slowpath+0x2b3/0x510 [ 33.174135] ? finish_task_switch+0x1aa/0x740 [ 33.178631] ? lockdep_sys_exit+0x47/0xf0 [ 33.182775] ? retint_user+0x18/0x20 [ 33.186479] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 33.191310] page_fault+0x22/0x30 [ 33.194743] RIP: 0023:0x8073f4f [ 33.197997] RSP: 002b:00000000f7f88bd0 EFLAGS: 00010202 [ 33.203347] RAX: 00000000f7f88c8c RBX: 0000000000000400 RCX: 000000000000000e [ 33.210601] RDX: 00000000f7f89a88 RSI: 0000000020012fe0 RDI: 00000000f7f88c8c [ 33.217862] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000 [ 33.225123] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 33.232384] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 33.239658] [ 33.241800] Allocated by task 3968: [ 33.245416] save_stack_trace+0x16/0x20 [ 33.249378] save_stack+0x43/0xd0 [ 33.252805] kasan_kmalloc+0xad/0xe0 [ 33.256504] kasan_slab_alloc+0x12/0x20 [ 33.260466] kmem_cache_alloc+0x12e/0x760 [ 33.264593] mmap_region+0x7ee/0x15a0 [ 33.268381] do_mmap+0x6a1/0xd50 [ 33.271732] vm_mmap_pgoff+0x1de/0x280 [ 33.275592] SyS_mmap_pgoff+0x23b/0x5f0 [ 33.279547] do_fast_syscall_32+0x3f2/0xf05 [ 33.283851] entry_SYSENTER_compat+0x51/0x60 [ 33.288227] [ 33.289827] Freed by task 3976: [ 33.293084] save_stack_trace+0x16/0x20 [ 33.297038] save_stack+0x43/0xd0 [ 33.300463] kasan_slab_free+0x71/0xc0 [ 33.304321] kmem_cache_free+0x77/0x280 [ 33.308268] remove_vma+0x162/0x1b0 [ 33.311867] do_munmap+0x82a/0xdf0 [ 33.315377] mmap_region+0x59e/0x15a0 [ 33.319155] do_mmap+0x6a1/0xd50 [ 33.322491] vm_mmap_pgoff+0x1de/0x280 [ 33.326350] SyS_mmap_pgoff+0x23b/0x5f0 [ 33.330295] do_fast_syscall_32+0x3f2/0xf05 [ 33.334588] entry_SYSENTER_compat+0x51/0x60 [ 33.338970] [ 33.340575] The buggy address belongs to the object at ffff8801cacf2670 [ 33.340575] which belongs to the cache vm_area_struct of size 200 [ 33.353465] The buggy address is located 80 bytes inside of [ 33.353465] 200-byte region [ffff8801cacf2670, ffff8801cacf2738) [ 33.365230] The buggy address belongs to the page: [ 33.370139] page:ffffea00072b3c80 count:1 mapcount:0 mapping:ffff8801cacf2040 index:0x0 [ 33.378255] flags: 0x200000000000100(slab) [ 33.382461] raw: 0200000000000100 ffff8801cacf2040 0000000000000000 000000010000000f [ 33.390314] raw: ffffea00072f16a0 ffffea0007322820 ffff8801dae069c0 0000000000000000 [ 33.398163] page dumped because: kasan: bad access detected [ 33.403846] [ 33.405450] Memory state around the buggy address: [ 33.410351] ffff8801cacf2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.417687] ffff8801cacf2600: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fb fb [ 33.425023] >ffff8801cacf2680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.432361] ^ [ 33.437780] ffff8801cacf2700: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fb [ 33.445112] ffff8801cacf2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.452439] ================================================================== [ 33.459768] Disabling lock debugging due to kernel taint [ 33.465252] Kernel panic - not syncing: panic_on_warn set ... [ 33.465252] [ 33.472596] CPU: 0 PID: 3968 Comm: syz-executor3 Tainted: G B 4.14.0-rc3+ #23 [ 33.480975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.490299] Call Trace: [ 33.492858] dump_stack+0x194/0x257 [ 33.496459] ? arch_local_irq_restore+0x53/0x53 [ 33.501099] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 33.505824] ? __do_page_fault+0xb20/0xd60 [ 33.510032] panic+0x1e4/0x417 [ 33.513196] ? __warn+0x1d9/0x1d9 [ 33.516621] ? __do_page_fault+0xc03/0xd60 [ 33.520820] kasan_end_report+0x50/0x50 [ 33.524761] kasan_report+0x144/0x340 [ 33.528530] __asan_report_load8_noabort+0x14/0x20 [ 33.533424] __do_page_fault+0xc03/0xd60 [ 33.537449] ? __task_pid_nr_ns+0x2c7/0x540 [ 33.541740] ? mm_fault_error+0x2c0/0x2c0 [ 33.545856] ? lockdep_sys_exit+0x47/0xf0 [ 33.549971] do_page_fault+0xee/0x720 [ 33.553741] ? __do_page_fault+0xd60/0xd60 [ 33.557945] ? lockdep_sys_exit+0x47/0xf0 [ 33.562062] ? syscall_return_slowpath+0x2b3/0x510 [ 33.566962] ? finish_task_switch+0x1aa/0x740 [ 33.571431] ? lockdep_sys_exit+0x47/0xf0 [ 33.575545] ? retint_user+0x18/0x20 [ 33.579237] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 33.584062] page_fault+0x22/0x30 [ 33.587480] RIP: 0023:0x8073f4f [ 33.590722] RSP: 002b:00000000f7f88bd0 EFLAGS: 00010202 [ 33.596054] RAX: 00000000f7f88c8c RBX: 0000000000000400 RCX: 000000000000000e [ 33.603291] RDX: 00000000f7f89a88 RSI: 0000000020012fe0 RDI: 00000000f7f88c8c [ 33.610526] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000 [ 33.617764] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 33.625006] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 33.632703] Dumping ftrace buffer: [ 33.636220] (ftrace buffer empty) [ 33.639894] Kernel Offset: disabled [ 33.643486] Rebooting in 86400 seconds..