INIT: Entering runlevel: 2
[[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added 'ci-upstream-mmots-kasan-gce-3,10.128.0.36' (ECDSA) to the list of known hosts.
2017/09/14 02:47:39 parsed 1 programs
2017/09/14 02:47:39 executed programs: 0
2017/09/14 02:47:44 executed programs: 1681
2017/09/14 02:47:49 executed programs: 3194
2017/09/14 02:47:54 executed programs: 4694
2017/09/14 02:47:59 executed programs: 6261
2017/09/14 02:48:04 executed programs: 7810
2017/09/14 02:48:09 executed programs: 9365
2017/09/14 02:48:14 executed programs: 10919
2017/09/14 02:48:19 executed programs: 12446
syzkaller login: [ 122.150272] ==================================================================
[ 122.157754] BUG: KASAN: use-after-free in snd_timer_interrupt+0x1510/0x1520
[ 122.164836] Read of size 4 at addr ffff8801d11a2310 by task syz-executor5/9916
[ 122.172167]
[ 122.173776] CPU: 0 PID: 9916 Comm: syz-executor5 Not tainted 4.13.0-mm1+ #7
[ 122.180848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 122.190177] Call Trace:
[ 122.192734]
[ 122.194867] dump_stack+0x194/0x257
[ 122.198477] ? arch_local_irq_restore+0x53/0x53
[ 122.203122] ? show_regs_print_info+0x65/0x65
[ 122.207605] ? snd_timer_interrupt+0x1510/0x1520
[ 122.212339] print_address_description+0x73/0x250
[ 122.217157] ? snd_timer_interrupt+0x1510/0x1520
[ 122.221892] kasan_report+0x24e/0x340
[ 122.225676] __asan_report_load4_noabort+0x14/0x20
[ 122.230582] snd_timer_interrupt+0x1510/0x1520
[ 122.235154] ? snd_timer_user_disconnect+0x80/0x80
[ 122.240069] ? snd_timer_start_slave+0x490/0x490
[ 122.244807] ? _raw_spin_unlock_irq+0x56/0x70
[ 122.249283] ? save_stack_trace+0x16/0x20
[ 122.253412] ? __lock_acquire+0x20fd/0x4620
[ 122.257745] ? check_noncircular+0x20/0x20
[ 122.261968] ? lock_acquire+0x1d5/0x580
[ 122.265939] ? __lock_is_held+0xbc/0x140
[ 122.269989] snd_timer_s_function+0xbd/0x120
[ 122.274377] call_timer_fn+0x246/0x850
[ 122.278242] ? snd_timer_interrupt+0x1520/0x1520
[ 122.282975] ? __next_timer_interrupt+0x150/0x150
[ 122.287792] ? lock_downgrade+0x990/0x990
[ 122.291926] ? __run_timers+0x1ce/0xb90
[ 122.295889] ? do_raw_spin_trylock+0x190/0x190
[ 122.300455] ? __lock_is_held+0xbc/0x140
[ 122.304499] ? snd_timer_interrupt+0x1520/0x1520
[ 122.309230] ? trace_hardirqs_on_caller+0x19e/0x5c0
[ 122.314225] ? snd_timer_interrupt+0x1520/0x1520
[ 122.318957] __run_timers+0x7fd/0xb90
[ 122.322749] ? del_timer_sync+0x240/0x240
[ 122.326883] ? __lock_is_held+0xbc/0x140
[ 122.330930] ? timerqueue_add+0x1e9/0x280
[ 122.335061] ? find_held_lock+0x39/0x1d0
[ 122.339113] ? lock_downgrade+0x990/0x990
[ 122.343251] ? lock_acquire+0x1d5/0x580
[ 122.347203] ? clockevents_program_event+0x163/0x2e0
[ 122.352300] ? rcu_pm_notify+0xc0/0xc0
[ 122.356179] run_timer_softirq+0x4c/0xb0
[ 122.360217] __do_softirq+0x2bb/0xbd0
[ 122.363991] ? ktime_get+0x26f/0x3a0
[ 122.367686] ? do_gettimeofday+0x190/0x190
[ 122.371901] ? __softirqentry_text_start+0x8/0x8
[ 122.376632] ? do_raw_spin_trylock+0x190/0x190
[ 122.381189] ? do_timer+0x50/0x50
[ 122.384633] ? native_apic_msr_write+0x5c/0x80
[ 122.389193] ? kvm_clock_get_cycles+0x25/0x30
[ 122.393665] ? lapic_next_event+0x5a/0x90
[ 122.397791] ? clockevents_program_event+0x108/0x2e0
[ 122.402874] ? tick_program_event+0x7f/0xd0
[ 122.407177] ? hrtimer_interrupt+0x489/0x5f0
[ 122.411562] ? rcu_pm_notify+0xc0/0xc0
[ 122.415448] irq_exit+0x1d3/0x210
[ 122.418877] smp_apic_timer_interrupt+0x177/0x710
[ 122.423692] ? smp_reschedule_interrupt+0xf2/0x670
[ 122.428598] ? smp_call_function_single_interrupt+0x650/0x650
[ 122.434461] ? _raw_spin_lock+0x32/0x40
[ 122.438423] ? handle_edge_irq+0x2b4/0x7c0
[ 122.442653] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 122.447482] apic_timer_interrupt+0x9d/0xb0
[ 122.451778]
[ 122.453992] RIP: 0010:_raw_spin_unlock_irq+0x56/0x70
[ 122.459068] RSP: 0018:ffff8801d6917220 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
[ 122.466933] RAX: dffffc0000000000 RBX: ffff8801db225c00 RCX: 0000000000000000
[ 122.474179] RDX: 1ffffffff0b592ff RSI: 0000000000000001 RDI: ffffffff85ac97f8
[ 122.481426] RBP: ffff8801d6917228 R08: ffff8801d6916ba8 R09: 0000000000000000
[ 122.488671] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cf65c500
[ 122.495917] R13: 1ffff1003ad22e4d R14: ffff8801cff76300 R15: ffff8801cff76300
[ 122.503194] finish_task_switch+0x1d3/0x740
[ 122.507492] ? finish_task_switch+0x1aa/0x740
[ 122.511969] ? preempt_notifier_dec+0x20/0x20
[ 122.516456] __schedule+0x8f0/0x2070
[ 122.520156] ? __sched_text_start+0x8/0x8
[ 122.524282] ? timerqueue_add+0x1e9/0x280
[ 122.528416] ? do_raw_spin_trylock+0x190/0x190
[ 122.532975] ? __remove_hrtimer+0x190/0x190
[ 122.537271] ? find_held_lock+0x39/0x1d0
[ 122.541314] ? _raw_spin_unlock_irqrestore+0x31/0xba
[ 122.546395] ? trace_hardirqs_on_caller+0x421/0x5c0
[ 122.551389] ? trace_hardirqs_on+0xd/0x10
[ 122.555527] schedule+0x108/0x440
[ 122.558961] ? __schedule+0x2070/0x2070
[ 122.562910] ? print_usage_bug+0x480/0x480
[ 122.567122] ? do_raw_spin_trylock+0x190/0x190
[ 122.571679] ? lock_downgrade+0x8e0/0x990
[ 122.575812] ? futex_wait_setup+0x14a/0x3d0
[ 122.580136] futex_wait_queue_me+0x3ed/0x7e0
[ 122.584528] ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[ 122.589874] ? memset+0x31/0x40
[ 122.593135] ? get_futex_value_locked+0xc3/0xf0
[ 122.597785] ? futex_wait_setup+0x22e/0x3d0
[ 122.602097] ? __kernel_text_address+0xae/0xe0
[ 122.606665] ? futex_wake+0x680/0x680
[ 122.610460] futex_wait+0x357/0xa00
[ 122.614079] ? futex_wait_setup+0x3d0/0x3d0
[ 122.618388] ? debug_check_no_locks_freed+0x3d0/0x3d0
[ 122.623555] ? hash_futex+0x15/0x210
[ 122.627246] ? drop_futex_key_refs.isra.13+0x63/0xb0
[ 122.632326] ? futex_wake+0x2ca/0x680
[ 122.636111] ? __hrtimer_init+0x140/0x140
[ 122.640238] ? get_futex_key+0x1d50/0x1d50
[ 122.644453] ? __lock_is_held+0xbc/0x140
[ 122.648522] ? wake_up_new_task+0x62b/0xc00
[ 122.652912] do_futex+0x10c6/0x2130
[ 122.656521] ? check_noncircular+0x20/0x20
[ 122.660731] ? check_same_owner+0x320/0x320
[ 122.665035] ? put_pid+0x184/0x1f0
[ 122.668553] ? check_noncircular+0x20/0x20
[ 122.672773] ? exit_robust_list+0x240/0x240
[ 122.677078] ? find_held_lock+0x39/0x1d0
[ 122.681131] ? lock_downgrade+0x990/0x990
[ 122.685257] ? find_held_lock+0x39/0x1d0
[ 122.689299] ? lock_acquire+0x1d5/0x580
[ 122.693248] ? SyS_futex+0x2d3/0x390
[ 122.696959] ? pvclock_read_flags+0x160/0x160
[ 122.701435] ? __might_fault+0xe0/0x1d0
[ 122.705392] ? ktime_get+0x15c/0x3a0
[ 122.709089] ? kvm_clock_get_cycles+0x25/0x30
[ 122.713559] ? ktime_get+0x26f/0x3a0
[ 122.717254] ? do_gettimeofday+0x190/0x190
[ 122.721472] ? __might_sleep+0x95/0x190
[ 122.725434] ? kasan_check_write+0x14/0x20
[ 122.729650] SyS_futex+0x260/0x390
[ 122.733174] ? do_futex+0x2130/0x2130
[ 122.736957] ? entry_SYSCALL_64_fastpath+0x5/0xbe
[ 122.741779] ? trace_hardirqs_on_caller+0x421/0x5c0
[ 122.746774] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 122.751526] entry_SYSCALL_64_fastpath+0x1f/0xbe
[ 122.756256] RIP: 0033:0x451e59
[ 122.759510] RSP: 002b:0000000000a6f918 EFLAGS: 00000206 ORIG_RAX: 00000000000000ca
[ 122.767196] RAX: ffffffffffffffda RBX: 00000000007180dc RCX: 0000000000451e59
[ 122.774442] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000007180dc
[ 122.781687] RBP: 0000000000000082 R08: 00000000007180b0 R09: 000000030001dce9
[ 122.788933] R10: 0000000000a6f980 R11: 0000000000000206 R12: 0000000000000000
[ 122.796178] R13: 0000000000a6f7ef R14: 00007f78708069c0 R15: 0000000000000002
[ 122.803449]
[ 122.805051] Allocated by task 9922:
[ 122.808654] save_stack_trace+0x16/0x20
[ 122.812603] save_stack+0x43/0xd0
[ 122.816030] kasan_kmalloc+0xad/0xe0
[ 122.819718] kmem_cache_alloc_trace+0x136/0x750
[ 122.824362] snd_timer_instance_new+0xda/0x610
[ 122.828921] snd_timer_open+0x902/0x1790
[ 122.832964] snd_timer_user_ioctl+0x96f/0x32e0
[ 122.837522] do_vfs_ioctl+0x1b1/0x1530
[ 122.841390] SyS_ioctl+0x8f/0xc0
[ 122.844731] entry_SYSCALL_64_fastpath+0x1f/0xbe
[ 122.849465]
[ 122.851064] Freed by task 9935:
[ 122.854316] save_stack_trace+0x16/0x20
[ 122.858264] save_stack+0x43/0xd0
[ 122.861690] kasan_slab_free+0x71/0xc0
[ 122.865557] kfree+0xca/0x250
[ 122.868638] snd_timer_close+0x888/0xf20
[ 122.872673] snd_timer_user_ioctl+0x80d/0x32e0
[ 122.877229] do_vfs_ioctl+0x1b1/0x1530
[ 122.881090] SyS_ioctl+0x8f/0xc0
[ 122.884430] entry_SYSCALL_64_fastpath+0x1f/0xbe
[ 122.889154]
[ 122.890756] The buggy address belongs to the object at ffff8801d11a2300
[ 122.890756] which belongs to the cache kmalloc-256 of size 256
[ 122.903387] The buggy address is located 16 bytes inside of
[ 122.903387] 256-byte region [ffff8801d11a2300, ffff8801d11a2400)
[ 122.915144] The buggy address belongs to the page:
[ 122.920056] page:ffffea0007446880 count:1 mapcount:0 mapping:ffff8801d11a2080 index:0x0
[ 122.928189] flags: 0x200000000000100(slab)
[ 122.932403] raw: 0200000000000100 ffff8801d11a2080 0000000000000000 000000010000000c
[ 122.940257] raw: ffffea000763b060 ffffea00074155a0 ffff8801dac007c0 0000000000000000
[ 122.948108] page dumped because: kasan: bad access detected
[ 122.953789]
[ 122.955393] Memory state around the buggy address:
[ 122.960294] ffff8801d11a2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 122.967625] ffff8801d11a2280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 122.974958] >ffff8801d11a2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 122.982287] ^
[ 122.986147] ffff8801d11a2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 122.993480] ffff8801d11a2400: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 123.000821] ==================================================================
[ 123.008150] Disabling lock debugging due to kernel taint
[ 123.013565] Kernel panic - not syncing: panic_on_warn set ...
[ 123.013565]
[ 123.020895] CPU: 0 PID: 9916 Comm: syz-executor5 Tainted: G B 4.13.0-mm1+ #7
[ 123.029177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 123.038507] Call Trace:
[ 123.041074]
[ 123.043196] dump_stack+0x194/0x257
[ 123.046795] ? arch_local_irq_restore+0x53/0x53
[ 123.051435] ? vprintk_default+0x28/0x30
[ 123.055468] ? snd_timer_interrupt+0x14a0/0x1520
[ 123.060194] panic+0x1e4/0x417
[ 123.063358] ? __warn+0x1d9/0x1d9
[ 123.066791] ? snd_timer_interrupt+0x1510/0x1520
[ 123.071514] kasan_end_report+0x50/0x50
[ 123.075455] kasan_report+0x137/0x340
[ 123.079229] __asan_report_load4_noabort+0x14/0x20
[ 123.084125] snd_timer_interrupt+0x1510/0x1520
[ 123.088688] ? snd_timer_user_disconnect+0x80/0x80
[ 123.093590] ? snd_timer_start_slave+0x490/0x490
[ 123.098314] ? _raw_spin_unlock_irq+0x56/0x70
[ 123.102780] ? save_stack_trace+0x16/0x20
[ 123.106904] ? __lock_acquire+0x20fd/0x4620
[ 123.111207] ? check_noncircular+0x20/0x20
[ 123.115415] ? lock_acquire+0x1d5/0x580
[ 123.119372] ? __lock_is_held+0xbc/0x140
[ 123.123406] snd_timer_s_function+0xbd/0x120
[ 123.127787] call_timer_fn+0x246/0x850
[ 123.131644] ? snd_timer_interrupt+0x1520/0x1520
[ 123.136384] ? __next_timer_interrupt+0x150/0x150
[ 123.141192] ? lock_downgrade+0x990/0x990
[ 123.145312] ? __run_timers+0x1ce/0xb90
[ 123.149260] ? do_raw_spin_trylock+0x190/0x190