INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-mmots-kasan-gce-2,10.128.0.7' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 34.833059] dev_remove_pack: ffff8801c8a4d240 not found [ 34.889443] ================================================================== [ 34.896840] BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2be3/0x33d0 [ 34.904343] Read of size 2 at addr ffff8801c8576b80 by task syzkaller379800/2988 [ 34.911842] [ 34.913441] CPU: 0 PID: 2988 Comm: syzkaller379800 Not tainted 4.13.0-mm1+ #7 [ 34.920687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.930008] Call Trace: [ 34.932557] [ 34.934689] dump_stack+0x194/0x257 executing program [ 34.938288] ? arch_local_irq_restore+0x53/0x53 [ 34.942926] ? show_regs_print_info+0x65/0x65 [ 34.947400] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 34.952561] print_address_description+0x73/0x250 [ 34.957372] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 34.962532] kasan_report+0x24e/0x340 [ 34.966314] __asan_report_load2_noabort+0x14/0x20 [ 34.971212] __netif_receive_skb_core+0x2be3/0x33d0 [ 34.976197] ? __bpf_address_lookup+0x2b0/0x2b0 [ 34.980845] ? nf_ingress+0x9f0/0x9f0 [ 34.984616] ? unwind_dump+0x4c0/0x4c0 [ 34.988478] ? check_noncircular+0x20/0x20 [ 34.992694] ? check_noncircular+0x20/0x20 [ 34.996899] ? __kernel_text_address+0xae/0xe0 [ 35.001454] ? unwind_get_return_address+0x61/0xa0 [ 35.006355] ? __save_stack_trace+0x7e/0xd0 [ 35.010655] ? print_usage_bug+0x480/0x480 [ 35.014878] ? find_held_lock+0x39/0x1d0 [ 35.018924] ? lock_downgrade+0x990/0x990 [ 35.023041] ? unwind_get_return_address+0x61/0xa0 [ 35.027948] ? lock_acquire+0x1d5/0x580 [ 35.031895] ? netif_receive_skb_internal+0x1d7/0x670 [ 35.037055] ? find_held_lock+0x39/0x1d0 [ 35.041100] ? pvclock_read_flags+0x160/0x160 [ 35.045567] ? mark_held_locks+0xb2/0x100 [ 35.049691] ? lock_acquire+0x1d5/0x580 [ 35.053635] ? netif_receive_skb_internal+0xa2/0x670 [ 35.058711] ? ktime_get_with_offset+0x2c1/0x420 [ 35.063446] ? lock_release+0xd70/0xd70 [ 35.067388] ? ktime_get+0x3a0/0x3a0 [ 35.071088] __netif_receive_skb+0x2c/0x1b0 [ 35.075378] ? __netif_receive_skb+0x2c/0x1b0 [ 35.079849] netif_receive_skb_internal+0x10b/0x670 [ 35.084835] ? dev_cpu_dead+0xb00/0xb00 [ 35.088781] ? __alloc_pages_nodemask+0xd80/0xd80 [ 35.093600] ? net_rx_action+0x1910/0x1910 [ 35.097810] ? __lock_is_held+0xbc/0x140 [ 35.101849] ? skb_gro_reset_offset+0x17b/0x300 [ 35.106492] napi_gro_receive+0x3d0/0x500 [ 35.110610] ? dev_gro_receive+0x19b0/0x19b0 [ 35.114990] ? eth_type_trans+0x2a3/0x650 [ 35.119110] ? eth_gro_receive+0x810/0x810 [ 35.123325] receive_buf+0xcc5/0x51f0 [ 35.127098] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 35.132089] ? unwind_dump+0x4c0/0x4c0 [ 35.135957] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 35.140515] ? __unwind_start+0x169/0x330 [ 35.144634] ? unwind_get_return_address+0x61/0xa0 [ 35.149536] ? __save_stack_trace+0x61/0xd0 [ 35.153832] ? rcu_report_qs_rnp+0x613/0x880 [ 35.158212] ? save_stack_trace+0x16/0x20 [ 35.162330] ? __lock_acquire+0x20fd/0x4620 [ 35.166620] ? __do_softirq+0x2bb/0xbd0 [ 35.170562] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 35.175728] ? find_held_lock+0x39/0x1d0 [ 35.179770] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 35.184929] ? lock_downgrade+0x990/0x990 [ 35.189048] ? check_noncircular+0x20/0x20 [ 35.193257] ? check_noncircular+0x20/0x20 [ 35.197461] ? pvclock_read_flags+0x160/0x160 [ 35.201928] ? lock_release+0xd70/0xd70 [ 35.205873] ? _find_next_bit+0xee/0x120 [ 35.209904] ? _find_next_bit+0xee/0x120 [ 35.213941] ? __lock_is_held+0xbc/0x140 [ 35.217978] ? __lock_is_held+0xbc/0x140 [ 35.222012] ? __x2apic_send_IPI_dest.constprop.7+0x5b/0x80 [ 35.227696] ? x2apic_send_IPI+0x6d/0xa0 [ 35.231738] ? native_smp_send_reschedule+0x69/0xa0 [ 35.236724] ? resched_curr+0x196/0x420 [ 35.240678] ? check_noncircular+0x20/0x20 [ 35.244882] ? check_noncircular+0x20/0x20 [ 35.249086] ? check_noncircular+0x20/0x20 [ 35.253296] ? check_noncircular+0x20/0x20 [ 35.257513] ? find_held_lock+0x39/0x1d0 [ 35.261554] ? lock_downgrade+0x990/0x990 [ 35.265670] ? lock_downgrade+0x990/0x990 [ 35.269793] ? check_noncircular+0x20/0x20 [ 35.274002] ? rcu_read_lock_sched_held+0x108/0x120 [ 35.278988] ? ttwu_do_wakeup+0x523/0x710 [ 35.283112] ? do_raw_spin_trylock+0x190/0x190 [ 35.287663] ? do_raw_spin_trylock+0x190/0x190 [ 35.292217] ? check_noncircular+0x20/0x20 [ 35.296429] ? trace_hardirqs_off+0xd/0x10 [ 35.300635] ? _raw_spin_unlock_irqrestore+0xa6/0xba [ 35.305709] ? try_to_wake_up+0x115/0x1850 [ 35.309914] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 35.315088] ? find_held_lock+0x39/0x1d0 [ 35.319132] ? lock_downgrade+0x990/0x990 [ 35.323259] ? vring_use_dma_api+0x7f/0xa0 [ 35.327467] ? vring_unmap_one+0x49/0x3d0 [ 35.331591] ? detach_buf+0x463/0x6a0 [ 35.335365] ? print_usage_bug+0x480/0x480 [ 35.339582] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 35.344310] ? common_interrupt+0x9d/0x9d [ 35.348432] ? detach_buf+0x6a0/0x6a0 [ 35.352207] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 35.357200] virtnet_poll+0x304/0xad0 [ 35.360981] ? receive_buf+0x51f0/0x51f0 [ 35.365010] ? unwind_dump+0x4c0/0x4c0 [ 35.368873] ? mark_held_locks+0xb2/0x100 [ 35.372995] ? net_rx_action+0x49b/0x1910 [ 35.377120] net_rx_action+0x792/0x1910 [ 35.381079] ? napi_complete_done+0x6c0/0x6c0 [ 35.385547] ? save_stack_trace+0x16/0x20 [ 35.389665] ? __lock_acquire+0x20fd/0x4620 [ 35.393959] ? rcu_start_gp_advanced+0x1e0/0x1e0 [ 35.398689] ? rcu_pm_notify+0xc0/0xc0 [ 35.402558] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 35.407736] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 35.412916] ? __lock_is_held+0xbc/0x140 [ 35.416960] ? rcu_read_lock_sched_held+0x108/0x120 [ 35.421949] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 35.426764] ? raise_softirq+0x490/0x490 [ 35.430802] ? lock_downgrade+0x990/0x990 [ 35.434928] ? print_usage_bug+0x480/0x480 [ 35.439141] ? lock_acquire+0x1d5/0x580 [ 35.443088] ? clockevents_program_event+0x163/0x2e0 [ 35.448165] ? trace_hardirqs_off+0xd/0x10 [ 35.452373] ? __napi_schedule+0x25e/0x370 [ 35.456586] ? netdev_info+0x170/0x170 [ 35.460442] ? check_noncircular+0x20/0x20 [ 35.464649] ? rcu_pm_notify+0xc0/0xc0 [ 35.468510] ? check_noncircular+0x20/0x20 [ 35.472717] ? __lock_is_held+0xbc/0x140 [ 35.476761] ? rcu_read_lock_sched_held+0x108/0x120 [ 35.482041] ? __handle_irq_event_percpu+0x308/0x9d0 [ 35.487135] ? __lock_is_held+0xbc/0x140 [ 35.491196] __do_softirq+0x2bb/0xbd0 [ 35.494984] ? __softirqentry_text_start+0x8/0x8 [ 35.499724] ? do_raw_spin_trylock+0x190/0x190 [ 35.504278] ? handle_irq_event_percpu+0x141/0x1b0 [ 35.509193] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 35.514280] ? _raw_spin_lock+0x32/0x40 [ 35.518582] ? _raw_spin_unlock+0x22/0x30 [ 35.522712] ? handle_edge_irq+0x2b4/0x7c0 [ 35.526936] irq_exit+0x1d3/0x210 [ 35.530364] do_IRQ+0xf6/0x190 [ 35.533536] common_interrupt+0x9d/0x9d [ 35.537482] [ 35.539695] RIP: 0010:lock_release+0x6d9/0xd70 [ 35.544247] RSP: 0018:ffff8801d75066c0 EFLAGS: 00000296 ORIG_RAX: ffffffffffffff6e [ 35.551930] RAX: 0000000000000000 RBX: fffffffffffffffc RCX: 0000000000000000 [ 35.559170] RDX: 1ffffffff0b592fd RSI: 0000000000000004 RDI: ffffed003aea0cd8 [ 35.566411] RBP: ffff8801d75066e8 R08: 0000000000000000 R09: 1ffff1003aea0cb8 [ 35.573654] R10: ffff8801cead6200 R11: 0000000000000003 R12: ffff8801d75065c0 [ 35.580894] R13: ffff8801cead6200 R14: de2a526b9dff2449 R15: 0000000000000003 [ 35.588164] __is_insn_slot_addr+0x225/0x330 [ 35.592550] ? __free_insn_slot+0x5c0/0x5c0 [ 35.596844] ? unwind_dump+0x4c0/0x4c0 [ 35.600703] ? check_noncircular+0x20/0x20 [ 35.604909] ? __free_insn_slot+0x5c0/0x5c0 [ 35.609211] ? __module_text_address+0x13/0x150 [ 35.613855] __kernel_text_address+0xa2/0xe0 [ 35.618236] unwind_get_return_address+0x61/0xa0 [ 35.622965] __save_stack_trace+0x7e/0xd0 [ 35.627095] save_stack_trace+0x16/0x20 [ 35.631042] save_stack+0x43/0xd0 [ 35.634468] ? save_stack_trace+0x16/0x20 [ 35.638592] ? save_stack+0x43/0xd0 [ 35.642189] ? kasan_kmalloc+0xad/0xe0 [ 35.646047] ? kasan_slab_alloc+0x12/0x20 [ 35.650166] ? kmem_cache_alloc+0x11b/0x760 [ 35.654460] ? ptlock_alloc+0x24/0x70 [ 35.658230] ? pte_alloc_one+0x59/0x100 [ 35.662207] ? __pte_alloc+0x2a/0x300 [ 35.665979] ? copy_page_range+0x18ba/0x27b0 [ 35.670357] ? copy_mm+0xd68/0x1310 [ 35.673953] ? copy_process.part.36+0x1eae/0x4af0 [ 35.678766] ? _do_fork+0x1ef/0xfe0 [ 35.682363] ? SyS_clone+0x37/0x50 [ 35.685874] ? do_syscall_64+0x26c/0x8c0 [ 35.689907] ? entry_SYSCALL64_slow_path+0x25/0x25 [ 35.694816] ? lock_downgrade+0x990/0x990 [ 35.698938] ? __alloc_pages_nodemask+0xadb/0xd80 [ 35.703758] ? __lock_is_held+0xbc/0x140 [ 35.707806] ? check_same_owner+0x320/0x320 [ 35.712105] ? kasan_unpoison_shadow+0x35/0x50 [ 35.716663] kasan_kmalloc+0xad/0xe0 [ 35.720351] kasan_slab_alloc+0x12/0x20 [ 35.724296] kmem_cache_alloc+0x11b/0x760 [ 35.728417] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 35.733413] ptlock_alloc+0x24/0x70 [ 35.737017] pte_alloc_one+0x59/0x100 [ 35.740790] __pte_alloc+0x2a/0x300 [ 35.744391] copy_page_range+0x18ba/0x27b0 [ 35.748601] ? is_bpf_text_address+0xa4/0x120 [ 35.753071] ? __kernel_text_address+0xae/0xe0 [ 35.757650] ? vm_iomap_memory+0x160/0x160 [ 35.761860] ? find_held_lock+0x39/0x1d0 [ 35.765902] ? lock_downgrade+0x990/0x990 [ 35.770030] ? anon_vma_fork+0x3eb/0x870 [ 35.774072] ? lock_release+0xd70/0xd70 [ 35.778020] ? check_same_owner+0x320/0x320 [ 35.782317] ? __lock_is_held+0xbc/0x140 [ 35.786356] ? __might_sleep+0x95/0x190 [ 35.790306] ? up_write+0x6b/0x120 [ 35.793817] ? up_read+0x40/0x40 [ 35.797158] ? anon_vma_interval_tree_insert+0x23f/0x2d0 [ 35.802596] ? anon_vma_clone+0x700/0x700 [ 35.806720] ? rcu_read_lock_sched_held+0x108/0x120 [ 35.811712] ? kmem_cache_alloc+0x469/0x760 [ 35.816022] ? __vma_link_rb+0x212/0x320 [ 35.820065] copy_mm+0xd68/0x1310 [ 35.823509] ? list_add_tail_rcu+0x193/0x193 [ 35.827905] ? check_same_owner+0x320/0x320 [ 35.832201] ? rcu_pm_notify+0xc0/0xc0 [ 35.836068] ? copy_process.part.36+0x202f/0x4af0 [ 35.840893] ? rcu_read_lock_sched_held+0x108/0x120 [ 35.845882] ? kmem_cache_alloc+0x469/0x760 [ 35.850182] ? _raw_spin_unlock+0x22/0x30 [ 35.854309] copy_process.part.36+0x1eae/0x4af0 [ 35.858966] ? __cleanup_sighand+0x40/0x40 [ 35.863172] ? show_initstate+0xb0/0xb0 [ 35.867119] ? bpf_prog_alloc+0x310/0x310 [ 35.871253] ? lock_release+0xd70/0xd70 [ 35.875200] ? __free_insn_slot+0x5c0/0x5c0 [ 35.879497] ? unwind_dump+0x4c0/0x4c0 [ 35.883369] ? is_bpf_text_address+0xa4/0x120 [ 35.887836] ? __kernel_text_address+0xae/0xe0