INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-3,10.128.15.213' (ECDSA) to the list of known hosts.
2017/10/06 04:17:03 parsed 1 programs
2017/10/06 04:17:03 executed programs: 0
syzkaller login: [   46.179931] ==================================================================
[   46.187438] BUG: KASAN: use-after-free in __do_page_fault+0xc03/0xd60
[   46.194005] Read of size 8 at addr ffff8801cbba6680 by task syz-executor0/3851
[   46.201348] 
[   46.202965] CPU: 0 PID: 3851 Comm: syz-executor0 Not tainted 4.14.0-rc3+ #27
[   46.210138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.219479] Call Trace:
[   46.222058]  dump_stack+0x194/0x257
[   46.225673]  ? arch_local_irq_restore+0x53/0x53
[   46.230329]  ? show_regs_print_info+0x65/0x65
[   46.234834]  ? __do_page_fault+0xc03/0xd60
[   46.239069]  print_address_description+0x73/0x250
[   46.243899]  ? __do_page_fault+0xc03/0xd60
[   46.248112]  kasan_report+0x25b/0x340
[   46.251895]  __asan_report_load8_noabort+0x14/0x20
[   46.256801]  __do_page_fault+0xc03/0xd60
[   46.260839]  ? __task_pid_nr_ns+0x2c7/0x540
[   46.265160]  ? mm_fault_error+0x2c0/0x2c0
[   46.269312]  ? lockdep_sys_exit+0x47/0xf0
[   46.273442]  do_page_fault+0xee/0x720
[   46.277220]  ? __do_page_fault+0xd60/0xd60
[   46.281442]  ? lockdep_sys_exit+0x47/0xf0
[   46.285582]  ? syscall_return_slowpath+0x2b3/0x510
[   46.290507]  ? finish_task_switch+0x1aa/0x740
[   46.295004]  ? lockdep_sys_exit+0x47/0xf0
[   46.299140]  ? retint_user+0x18/0x20
[   46.302838]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   46.307666]  page_fault+0x22/0x30
[   46.311096] RIP: 0023:0x8073f4f
[   46.314361] RSP: 002b:00000000f7f02bd0 EFLAGS: 00010202
[   46.319732] RAX: 00000000f7f02c8c RBX: 0000000000000400 RCX: 000000000000000e
[   46.326988] RDX: 00000000f7f03a88 RSI: 0000000020012fe0 RDI: 00000000f7f02c8c
[   46.334234] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000
[   46.341484] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
[   46.348738] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   46.356006] 
[   46.357621] Allocated by task 3851:
[   46.361228]  save_stack_trace+0x16/0x20
[   46.365180]  save_stack+0x43/0xd0
[   46.368613]  kasan_kmalloc+0xad/0xe0
[   46.372313]  kasan_slab_alloc+0x12/0x20
[   46.376276]  kmem_cache_alloc+0x12e/0x760
[   46.380401]  mmap_region+0x7ee/0x15a0
[   46.384173]  do_mmap+0x6a1/0xd50
[   46.387515]  vm_mmap_pgoff+0x1de/0x280
[   46.391387]  SyS_mmap_pgoff+0x23b/0x5f0
[   46.395349]  do_fast_syscall_32+0x3f2/0xf05
[   46.399648]  entry_SYSENTER_compat+0x51/0x60
[   46.404032] 
[   46.405636] Freed by task 3856:
[   46.408892]  save_stack_trace+0x16/0x20
[   46.412839]  save_stack+0x43/0xd0
[   46.416271]  kasan_slab_free+0x71/0xc0
[   46.420153]  kmem_cache_free+0x77/0x280
[   46.424118]  remove_vma+0x162/0x1b0
[   46.427726]  do_munmap+0x82a/0xdf0
[   46.431238]  mmap_region+0x59e/0x15a0
[   46.435018]  do_mmap+0x6a1/0xd50
[   46.438369]  vm_mmap_pgoff+0x1de/0x280
[   46.442228]  SyS_mmap_pgoff+0x23b/0x5f0
[   46.446186]  do_fast_syscall_32+0x3f2/0xf05
[   46.450490]  entry_SYSENTER_compat+0x51/0x60
[   46.454867] 
[   46.456467] The buggy address belongs to the object at ffff8801cbba6630
[   46.456467]  which belongs to the cache vm_area_struct of size 200
[   46.469356] The buggy address is located 80 bytes inside of
[   46.469356]  200-byte region [ffff8801cbba6630, ffff8801cbba66f8)
[   46.481116] The buggy address belongs to the page:
[   46.486024] page:ffffea00072ee980 count:1 mapcount:0 mapping:ffff8801cbba6000 index:0x0
[   46.494158] flags: 0x200000000000100(slab)
[   46.498365] raw: 0200000000000100 ffff8801cbba6000 0000000000000000 000000010000000f
[   46.506217] raw: ffffea00072ec860 ffffea00072e72a0 ffff8801dae069c0 0000000000000000
[   46.514075] page dumped because: kasan: bad access detected
[   46.519757] 
[   46.521358] Memory state around the buggy address:
[   46.526258]  ffff8801cbba6580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   46.533587]  ffff8801cbba6600: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
[   46.540916] >ffff8801cbba6680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[   46.548244]                    ^
[   46.551593]  ffff8801cbba6700: fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00
[   46.558933]  ffff8801cbba6780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   46.566262] ==================================================================
[   46.573591] Disabling lock debugging due to kernel taint
[   46.579115] Kernel panic - not syncing: panic_on_warn set ...
[   46.579115] 
[   46.586462] CPU: 0 PID: 3851 Comm: syz-executor0 Tainted: G    B           4.14.0-rc3+ #27
[   46.594837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.604159] Call Trace:
[   46.606725]  dump_stack+0x194/0x257
[   46.610339]  ? arch_local_irq_restore+0x53/0x53
[   46.614988]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   46.619716]  ? __do_page_fault+0xb20/0xd60
[   46.623919]  panic+0x1e4/0x417
[   46.627082]  ? __warn+0x1d9/0x1d9
[   46.630530]  ? __do_page_fault+0xc03/0xd60
[   46.634748]  kasan_end_report+0x50/0x50
[   46.638700]  kasan_report+0x144/0x340
[   46.642476]  __asan_report_load8_noabort+0x14/0x20
[   46.647380]  __do_page_fault+0xc03/0xd60
[   46.651411]  ? __task_pid_nr_ns+0x2c7/0x540
[   46.655711]  ? mm_fault_error+0x2c0/0x2c0
[   46.659831]  ? lockdep_sys_exit+0x47/0xf0
[   46.663948]  do_page_fault+0xee/0x720
[   46.667718]  ? __do_page_fault+0xd60/0xd60
[   46.671922]  ? lockdep_sys_exit+0x47/0xf0
[   46.676045]  ? syscall_return_slowpath+0x2b3/0x510
[   46.680942]  ? finish_task_switch+0x1aa/0x740
[   46.685405]  ? lockdep_sys_exit+0x47/0xf0
[   46.689526]  ? retint_user+0x18/0x20
[   46.693211]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   46.698030]  page_fault+0x22/0x30
[   46.701449] RIP: 0023:0x8073f4f
[   46.704691] RSP: 002b:00000000f7f02bd0 EFLAGS: 00010202
[   46.710023] RAX: 00000000f7f02c8c RBX: 0000000000000400 RCX: 000000000000000e
[   46.717261] RDX: 00000000f7f03a88 RSI: 0000000020012fe0 RDI: 00000000f7f02c8c
[   46.724496] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000
[   46.731735] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
[   46.738972] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   46.746674] Dumping ftrace buffer:
[   46.750181]    (ftrace buffer empty)
[   46.753857] Kernel Offset: disabled
[   46.757453] Rebooting in 86400 seconds..