INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-mmots-kasan-gce-4,10.128.15.196' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 56.497592] dev_remove_pack: ffff8801cdc3b100 not found [ 56.534302] ================================================================== [ 56.541715] BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2be3/0x33d0 [ 56.549223] Read of size 2 at addr ffff8801cd6c1100 by task syzkaller255262/2987 [ 56.556727] [ 56.558329] CPU: 0 PID: 2987 Comm: syzkaller255262 Not tainted 4.13.0-mm1+ #7 [ 56.565573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 56.574900] Call Trace: [ 56.577457] [ 56.579589] dump_stack+0x194/0x257 [ 56.583194] ? arch_local_irq_restore+0x53/0x53 [ 56.587840] ? show_regs_print_info+0x65/0x65 [ 56.592320] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 56.597493] print_address_description+0x73/0x250 [ 56.602314] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 56.607480] kasan_report+0x24e/0x340 [ 56.611262] __asan_report_load2_noabort+0x14/0x20 [ 56.616182] __netif_receive_skb_core+0x2be3/0x33d0 [ 56.621172] ? __bpf_address_lookup+0x2b0/0x2b0 [ 56.625829] ? nf_ingress+0x9f0/0x9f0 [ 56.629606] ? unwind_dump+0x4c0/0x4c0 [ 56.633473] ? check_noncircular+0x20/0x20 [ 56.637697] ? check_noncircular+0x20/0x20 [ 56.641911] ? __kernel_text_address+0xae/0xe0 [ 56.646468] ? unwind_get_return_address+0x61/0xa0 [ 56.651373] ? __save_stack_trace+0x7e/0xd0 [ 56.655678] ? print_usage_bug+0x480/0x480 [ 56.659901] ? find_held_lock+0x39/0x1d0 [ 56.663952] ? lock_downgrade+0x990/0x990 [ 56.668073] ? kmem_cache_alloc+0x29/0x760 [ 56.672291] ? lock_acquire+0x1d5/0x580 [ 56.676241] ? netif_receive_skb_internal+0x1d7/0x670 [ 56.681403] ? find_held_lock+0x39/0x1d0 [ 56.685446] ? pvclock_read_flags+0x160/0x160 [ 56.689916] ? mark_held_locks+0xb2/0x100 [ 56.694043] ? lock_acquire+0x1d5/0x580 [ 56.697990] ? netif_receive_skb_internal+0xa2/0x670 [ 56.703069] ? ktime_get_with_offset+0x2c1/0x420 [ 56.707802] ? lock_release+0xd70/0xd70 [ 56.711746] ? ktime_get+0x3a0/0x3a0 [ 56.715444] __netif_receive_skb+0x2c/0x1b0 [ 56.719735] ? __netif_receive_skb+0x2c/0x1b0 [ 56.724207] netif_receive_skb_internal+0x10b/0x670 [ 56.729198] ? dev_cpu_dead+0xb00/0xb00 [ 56.733145] ? __alloc_pages_nodemask+0xd80/0xd80 [ 56.737972] ? net_rx_action+0x1910/0x1910 [ 56.742182] ? __lock_is_held+0xbc/0x140 [ 56.746227] ? skb_gro_reset_offset+0x17b/0x300 [ 56.750872] napi_gro_receive+0x3d0/0x500 [ 56.754997] ? dev_gro_receive+0x19b0/0x19b0 [ 56.759381] ? eth_type_trans+0x2a3/0x650 [ 56.763505] ? eth_gro_receive+0x810/0x810 [ 56.767725] receive_buf+0xcc5/0x51f0 [ 56.771501] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 56.776495] ? unwind_dump+0x4c0/0x4c0 [ 56.780364] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 56.784930] ? __lock_acquire+0x732/0x4620 [ 56.789137] ? unwind_get_return_address+0x61/0xa0 [ 56.794041] ? __save_stack_trace+0x61/0xd0 [ 56.798343] ? rcu_report_qs_rnp+0x613/0x880 [ 56.802733] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 56.807897] ? unwind_dump+0x4c0/0x4c0 [ 56.811772] ? find_held_lock+0x39/0x1d0 [ 56.815815] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 56.820979] ? lock_downgrade+0x990/0x990 [ 56.825103] ? check_noncircular+0x20/0x20 [ 56.829318] ? pvclock_read_flags+0x160/0x160 [ 56.833788] ? lock_release+0xd70/0xd70 [ 56.837739] ? _find_next_bit+0xee/0x120 [ 56.841774] ? print_usage_bug+0x480/0x480 [ 56.845987] ? print_usage_bug+0x480/0x480 [ 56.850212] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 56.856067] ? print_usage_bug+0x480/0x480 [ 56.860274] ? smp_apic_timer_interrupt+0x177/0x710 [ 56.865274] ? check_noncircular+0x20/0x20 [ 56.869486] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 56.874477] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 56.879468] ? unwind_dump+0x4c0/0x4c0 [ 56.883338] ? __lock_acquire+0x732/0x4620 [ 56.887556] ? __unwind_start+0x169/0x330 [ 56.891694] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 56.896874] ? smp_apic_timer_interrupt+0x177/0x710 [ 56.901867] ? save_stack_trace+0x16/0x20 [ 56.905988] ? __lock_acquire+0x20fd/0x4620 [ 56.910290] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 56.915280] ? unwind_dump+0x4c0/0x4c0 [ 56.919151] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 56.924314] ? check_noncircular+0x20/0x20 [ 56.928523] ? check_noncircular+0x20/0x20 [ 56.932727] ? __unwind_start+0x169/0x330 [ 56.936850] ? print_usage_bug+0x480/0x480 [ 56.941057] ? unwind_get_return_address+0x61/0xa0 [ 56.945960] ? __save_stack_trace+0x61/0xd0 [ 56.950269] ? check_noncircular+0x20/0x20 [ 56.954480] ? vring_use_dma_api+0x7f/0xa0 [ 56.958693] ? vring_unmap_one+0x49/0x3d0 [ 56.962819] ? detach_buf+0x463/0x6a0 [ 56.966592] ? print_usage_bug+0x480/0x480 [ 56.970810] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 56.975548] ? common_interrupt+0x9d/0x9d [ 56.979676] ? detach_buf+0x6a0/0x6a0 [ 56.983451] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 56.988444] virtnet_poll+0x304/0xad0 [ 56.992227] ? receive_buf+0x51f0/0x51f0 [ 56.996257] ? unwind_dump+0x4c0/0x4c0 [ 57.000121] ? mark_held_locks+0xb2/0x100 [ 57.004242] ? net_rx_action+0x49b/0x1910 [ 57.008370] net_rx_action+0x792/0x1910 [ 57.012328] ? napi_complete_done+0x6c0/0x6c0 [ 57.016794] ? save_stack_trace+0x16/0x20 [ 57.020914] ? __lock_acquire+0x20fd/0x4620 [ 57.025211] ? rcu_pm_notify+0xc0/0xc0 [ 57.029083] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 57.034250] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 57.039431] ? __lock_is_held+0xbc/0x140 [ 57.043483] ? rcu_read_lock_sched_held+0x108/0x120 [ 57.048480] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 57.053297] ? raise_softirq+0x490/0x490 [ 57.057334] ? lock_downgrade+0x990/0x990 [ 57.061461] ? print_usage_bug+0x480/0x480 [ 57.065668] ? lock_acquire+0x1d5/0x580 [ 57.069614] ? clockevents_program_event+0x163/0x2e0 [ 57.074690] ? trace_hardirqs_off+0xd/0x10 [ 57.078896] ? __napi_schedule+0x25e/0x370 [ 57.083106] ? netdev_info+0x170/0x170 [ 57.086964] ? check_noncircular+0x20/0x20 [ 57.091171] ? rcu_pm_notify+0xc0/0xc0 [ 57.095035] ? check_noncircular+0x20/0x20 [ 57.099242] ? __lock_is_held+0xbc/0x140 [ 57.103290] ? rcu_read_lock_sched_held+0x108/0x120 [ 57.108278] ? __handle_irq_event_percpu+0x308/0x9d0 [ 57.113359] ? __lock_is_held+0xbc/0x140 [ 57.117407] __do_softirq+0x2bb/0xbd0 [ 57.121192] ? __softirqentry_text_start+0x8/0x8 [ 57.125925] ? do_raw_spin_trylock+0x190/0x190 [ 57.130480] ? handle_irq_event_percpu+0x141/0x1b0 [ 57.135384] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 57.140470] ? _raw_spin_lock+0x32/0x40 [ 57.144443] ? _raw_spin_unlock+0x22/0x30 [ 57.148564] ? handle_edge_irq+0x2b4/0x7c0 [ 57.152786] irq_exit+0x1d3/0x210 [ 57.156215] do_IRQ+0xf6/0x190 [ 57.159392] common_interrupt+0x9d/0x9d [ 57.163337] [ 57.165546] RIP: 0010:lock_acquire+0x256/0x580 [ 57.170097] RSP: 0018:ffff8801ce566ea8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff6e [ 57.177780] RAX: dffffc0000000000 RBX: ffff8801cf7484c0 RCX: 0000000000000000 [ 57.185023] RDX: 1ffffffff0b592fd RSI: ffffffff813f058e RDI: 0000000000000282 [ 57.192267] RBP: ffff8801ce566fa0 R08: ffff8801ce566920 R09: ffff8801ce566918 [ 57.199512] R10: ffff8801ce566890 R11: 1ffff10039ee932b R12: 1ffff10039cacddb [ 57.206756] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 57.214025] ? copy_process.part.36+0x1eae/0x4af0 [ 57.218865] ? lock_release+0xd70/0xd70 [ 57.222826] ? anon_vma_fork+0x16f/0x870 [ 57.226867] fs_reclaim_acquire.part.85+0x24/0x30 [ 57.231680] ? bad_range+0x1e0/0x1e0 [ 57.235366] fs_reclaim_acquire+0x14/0x20 [ 57.239487] kmem_cache_alloc+0x29/0x760 [ 57.243534] anon_vma_fork+0x2e6/0x870 [ 57.247401] ? anon_vma_clone+0x700/0x700 [ 57.251526] ? rcu_read_lock_sched_held+0x108/0x120 [ 57.256514] ? kmem_cache_alloc+0x469/0x760 [ 57.260819] copy_mm+0xb4d/0x1310 [ 57.264262] ? list_add_tail_rcu+0x193/0x193 [ 57.268661] ? check_same_owner+0x320/0x320 [ 57.272958] ? rcu_pm_notify+0xc0/0xc0 [ 57.276825] ? copy_process.part.36+0x202f/0x4af0 [ 57.281651] ? rcu_read_lock_sched_held+0x108/0x120 [ 57.286644] ? kmem_cache_alloc+0x469/0x760 [ 57.290943] ? _raw_spin_unlock+0x22/0x30 [ 57.295071] copy_process.part.36+0x1eae/0x4af0 [ 57.299725] ? __cleanup_sighand+0x40/0x40 [ 57.303932] ? show_initstate+0xb0/0xb0 [ 57.307881] ? bpf_prog_alloc+0x310/0x310 [ 57.312014] ? lock_release+0xd70/0xd70 [ 57.315961] ? __free_insn_slot+0x5c0/0x5c0 [ 57.320255] ? unwind_dump+0x4c0/0x4c0 [ 57.324126] ? is_bpf_text_address+0xa4/0x120 [ 57.328596] ? __kernel_text_address+0xae/0xe0 [ 57.333151] ? unwind_get_return_address+0x61/0xa0 [ 57.338066] ? __save_stack_trace+0x7e/0xd0 [ 57.342371] ? save_stack_trace+0x16/0x20 [ 57.346491] ? __lock_acquire+0x20fd/0x4620 [ 57.350784] ? find_held_lock+0x39/0x1d0 [ 57.354835] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 57.360001] ? do_wait+0x441/0xa90 [ 57.363521] ? do_raw_spin_trylock+0x190/0x190 [ 57.368077] ? lock_release+0xd50/0xd70 [ 57.372034] ? find_held_lock+0x39/0x1d0 [ 57.376083] ? lock_downgrade+0x990/0x990 [ 57.380214] ? remove_wait_queue+0x81/0x350 [ 57.384517] ? do_raw_spin_trylock+0x190/0x190 [ 57.389072] ? do_raw_spin_trylock+0x190/0x190 [ 57.393641] ? check_noncircular+0x20/0x20 [ 57.397852] ? lock_acquire+0x1d5/0x580 [ 57.401811] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 57.406802] ? trace_hardirqs_on+0xd/0x10 [ 57.410926] ? remove_wait_queue+0x1b4/0x350 [ 57.415304] ? add_wait_queue+0x1bb/0x2d0 [ 57.419443] _do_fork+0x1ef/0xfe0 [ 57.422875] ? fork_idle+0x2d0/0x2d0 [ 57.426579] ? __might_fault+0xe0/0x1d0 [ 57.430555] ? lock_release+0xd70/0xd70 [ 57.434508] ? check_same_owner+0x320/0x320 [ 57.438815] ? lock_downgrade+0x990/0x990 [ 57.442945] ? __might_sleep+0x95/0x190 [ 57.446901] ? __might_fault+0x188/0x1d0 [ 57.450936] ? kernel_wait4+0x26e/0x370 [ 57.454883] ? SyS_waitid+0x50/0x50 [ 57.458491] ? task_stopped_code+0x140/0x140 [ 57.462881] SyS_clone+0x37/0x50 [ 57.466224] ? ptregs_sys_rt_sigreturn+0x10/0x10 [ 57.470953] do_syscall_64+0x26c/0x8c0 [ 57.474816] ? kernel_wait4+0x370/0x370 [ 57.478762] ? put_timespec64+0xfc/0x180 [ 57.482799] ? syscall_return_slowpath+0x500/0x500 [ 57.487705] ? syscall_return_slowpath+0x2b3/0x500 [ 57.492619] ? entry_SYSCALL_64_fastpath+0x5/0xbe [ 57.497440] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 57.502258] ? sys_vfork+0x30/0x30 [ 57.505776] entry_SYSCALL64_slow_path+0x25/0x25 [ 57.510504] RIP: 0033:0x44470a [ 57.513669] RSP: 002b:00007ffc042a24c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 57.521353] RAX: ffffffffffffffda RBX: 00007ffc042a24c0 RCX: 000000000044470a [ 57.528596] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 57.535844] RBP: 00007ffc042a2500 R08: 0000000000000bab R09: 0000000001496880 [ 57.543088] R10: 0000000001496b50 R11: 0000000000000246 R12: 0000000000000bab