2017/10/24 16:34:21 parsed 1 programs
2017/10/24 16:34:21 executed programs: 0
syzkaller login: [   27.378715] ==================================================================
[   27.379328] BUG: KASAN: use-after-free in packet_getsockopt+0xc72/0xe00
[   27.379892] Read of size 8 at addr ffff88003bdd0d98 by task syz-executor0/3086
[   27.380666] 
[   27.380848] CPU: 1 PID: 3086 Comm: syz-executor0 Not tainted 4.14.0-rc5-next-20171018+ #8
[   27.381726] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   27.382592] Call Trace:
[   27.382874]  dump_stack+0x194/0x257
[   27.383272]  ? arch_local_irq_restore+0x53/0x53
[   27.383834]  ? show_regs_print_info+0x65/0x65
[   27.384304]  ? lock_release+0xa40/0xa40
[   27.384742]  ? packet_getsockopt+0xc72/0xe00
[   27.385225]  print_address_description+0x73/0x250
[   27.385744]  ? packet_getsockopt+0xc72/0xe00
[   27.386211]  kasan_report+0x25b/0x340
[   27.386630]  __asan_report_load8_noabort+0x14/0x20
[   27.387161]  packet_getsockopt+0xc72/0xe00
[   27.387610]  ? packet_notifier+0x950/0x950
[   27.388057]  ? iput+0x540/0xaf0
[   27.388362]  ? __fget_light+0x297/0x380
[   27.388765]  ? sock_has_perm+0x29c/0x400
[   27.389144]  ? selinux_secmark_relabel_packet+0xc0/0xc0
[   27.389548]  ? free_modinfo_version+0x70/0x70
[   27.389836]  ? __sk_free+0x5c/0x230
[   27.390054]  ? sk_free+0x2f/0x40
[   27.390265]  ? selinux_socket_getsockopt+0x36/0x40
[   27.390556]  ? security_socket_getsockopt+0x89/0xb0
[   27.390866]  SyS_getsockopt+0x178/0x340
[   27.391113]  ? SyS_setsockopt+0x360/0x360
[   27.391404]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   27.391762]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   27.392110]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   27.392448]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   27.392849] RIP: 0033:0x447c89
[   27.393115] RSP: 002b:00007fd953bacbd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
[   27.393760] RAX: ffffffffffffffda RBX: 00007fd953bad6cc RCX: 0000000000447c89
[   27.394452] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 000000000000000b
[   27.395161] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[   27.395921] R10: 0000000020ec8000 R11: 0000000000000246 R12: 0000000000000000
[   27.396705] R13: 0000000000000000 R14: 00007fd953bad9c0 R15: 00007fd953bad700
[   27.397493] 
[   27.397669] Allocated by task 3085:
[   27.398023]  save_stack+0x43/0xd0
[   27.398367]  kasan_kmalloc+0xad/0xe0
[   27.399149]  kmem_cache_alloc_trace+0x136/0x750
[   27.399480]  fanout_add+0x27e/0x1480
[   27.399782]  packet_setsockopt+0xfdc/0x1e80
[   27.400191]  SyS_setsockopt+0x189/0x360
[   27.400546]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   27.400914] 
[   27.401034] Freed by task 3085:
[   27.401340]  save_stack+0x43/0xd0
[   27.401584]  kasan_slab_free+0x71/0xc0
[   27.401902]  kfree+0xca/0x250
[   27.402123]  fanout_add+0x432/0x1480
[   27.402383]  packet_setsockopt+0xfdc/0x1e80
[   27.402696]  SyS_setsockopt+0x189/0x360
[   27.402975]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   27.403303] 
[   27.403419] The buggy address belongs to the object at ffff88003bdd0d80
[   27.403419]  which belongs to the cache kmalloc-128 of size 128
[   27.404285] The buggy address is located 24 bytes inside of
[   27.404285]  128-byte region [ffff88003bdd0d80, ffff88003bdd0e00)
[   27.405115] The buggy address belongs to the page:
[   27.405458] page:ffffea0000ef7400 count:1 mapcount:0 mapping:ffff88003bdd0000 index:0xffff88003bdd03c0
[   27.406142] flags: 0x100000000000100(slab)
[   27.406436] raw: 0100000000000100 ffff88003bdd0000 ffff88003bdd03c0 0000000100000012
[   27.406981] raw: ffffea0000e91420 ffffea0000f0d8a0 ffff88003e800640 0000000000000000
[   27.407524] page dumped because: kasan: bad access detected
[   27.407922] 
[   27.408039] Memory state around the buggy address:
[   27.408380]  ffff88003bdd0c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   27.408914]  ffff88003bdd0d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   27.409423] >ffff88003bdd0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   27.409932]                             ^
[   27.410221]  ffff88003bdd0e00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   27.410730]  ffff88003bdd0e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   27.411237] ==================================================================
[   27.411746] Disabling lock debugging due to kernel taint
[   27.412145] Kernel panic - not syncing: panic_on_warn set ...
[   27.412145] 
[   27.412673] CPU: 1 PID: 3086 Comm: syz-executor0 Tainted: G    B            4.14.0-rc5-next-20171018+ #8
[   27.413529] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   27.414146] Call Trace:
[   27.414455]  dump_stack+0x194/0x257
[   27.414872]  ? arch_local_irq_restore+0x53/0x53
[   27.415413]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   27.416071]  ? vsnprintf+0x1ed/0x1900
[   27.416500]  ? packet_getsockopt+0xbf0/0xe00
[   27.417048]  panic+0x1e4/0x41c
[   27.417389]  ? refcount_error_report+0x214/0x214
[   27.417894]  ? add_taint+0x1c/0x50
[   27.418277]  ? add_taint+0x1c/0x50
[   27.418657]  ? packet_getsockopt+0xc72/0xe00
[   27.419127]  kasan_end_report+0x50/0x50
[   27.419590]  kasan_report+0x144/0x340
[   27.420377]  __asan_report_load8_noabort+0x14/0x20
[   27.420900]  packet_getsockopt+0xc72/0xe00
[   27.421356]  ? packet_notifier+0x950/0x950
[   27.421864]  ? iput+0x540/0xaf0
[   27.422250]  ? __fget_light+0x297/0x380
[   27.422666]  ? sock_has_perm+0x29c/0x400
[   27.423140]  ? selinux_secmark_relabel_packet+0xc0/0xc0
[   27.423796]  ? free_modinfo_version+0x70/0x70
[   27.424155]  ? __sk_free+0x5c/0x230
[   27.424489]  ? sk_free+0x2f/0x40
[   27.424717]  ? selinux_socket_getsockopt+0x36/0x40
[   27.425027]  ? security_socket_getsockopt+0x89/0xb0
[   27.425344]  SyS_getsockopt+0x178/0x340
[   27.425605]  ? SyS_setsockopt+0x360/0x360
[   27.425870]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   27.426209]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   27.426512]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   27.426810]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   27.427080] RIP: 0033:0x447c89
[   27.427262] RSP: 002b:00007fd953bacbd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
[   27.427783] RAX: ffffffffffffffda RBX: 00007fd953bad6cc RCX: 0000000000447c89
[   27.428468] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 000000000000000b
[   27.429004] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[   27.429517] R10: 0000000020ec8000 R11: 0000000000000246 R12: 0000000000000000
[   27.430100] R13: 0000000000000000 R14: 00007fd953bad9c0 R15: 00007fd953bad700
[   27.430752] Dumping ftrace buffer:
[   27.431019]    (ftrace buffer empty)
[   27.431439] Kernel Offset: disabled
[   27.431828] Rebooting in 86400 seconds..