INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-kasan-gce-386-4,10.128.0.25' (ECDSA) to the list of known hosts. 2017/10/04 01:57:46 parsed 1 programs 2017/10/04 01:57:46 executed programs: 0 syzkaller login: [ 34.144129] ================================================================== [ 34.151526] BUG: KASAN: use-after-free in __do_page_fault+0xc03/0xd60 [ 34.158072] Read of size 8 at addr ffff8801cbfd3090 by task syz-executor7/3660 [ 34.165395] [ 34.166993] CPU: 1 PID: 3660 Comm: syz-executor7 Not tainted 4.14.0-rc3+ #23 [ 34.174146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.183466] Call Trace: [ 34.186024] dump_stack+0x194/0x257 [ 34.189623] ? arch_local_irq_restore+0x53/0x53 [ 34.194264] ? show_regs_print_info+0x65/0x65 [ 34.198737] ? __do_page_fault+0xc03/0xd60 [ 34.202944] print_address_description+0x73/0x250 [ 34.207755] ? __do_page_fault+0xc03/0xd60 [ 34.211959] kasan_report+0x25b/0x340 [ 34.215734] __asan_report_load8_noabort+0x14/0x20 [ 34.220633] __do_page_fault+0xc03/0xd60 [ 34.224663] ? exit_to_usermode_loop+0x198/0x310 [ 34.229395] ? mm_fault_error+0x2c0/0x2c0 [ 34.233517] ? lockdep_sys_exit+0x47/0xf0 [ 34.237641] do_page_fault+0xee/0x720 [ 34.241415] ? __do_page_fault+0xd60/0xd60 [ 34.245625] ? lockdep_sys_exit+0x47/0xf0 [ 34.249748] ? syscall_return_slowpath+0x2b3/0x510 [ 34.254645] ? finish_task_switch+0x1aa/0x740 [ 34.259112] ? lockdep_sys_exit+0x47/0xf0 [ 34.263229] ? retint_user+0x18/0x20 [ 34.266918] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 34.271737] page_fault+0x22/0x30 [ 34.275157] RIP: 0023:0x8073f4f [ 34.278405] RSP: 002b:00000000f7f89bd0 EFLAGS: 00010202 [ 34.283739] RAX: 00000000f7f89c8c RBX: 0000000000000400 RCX: 000000000000000e [ 34.290977] RDX: 00000000f7f8aa88 RSI: 0000000020012fe0 RDI: 00000000f7f89c8c [ 34.298214] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000 [ 34.305453] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 34.312698] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 34.319954] [ 34.321550] Allocated by task 3660: [ 34.325146] save_stack_trace+0x16/0x20 [ 34.329091] save_stack+0x43/0xd0 [ 34.332511] kasan_kmalloc+0xad/0xe0 [ 34.336197] kasan_slab_alloc+0x12/0x20 [ 34.340138] kmem_cache_alloc+0x12e/0x760 [ 34.344254] mmap_region+0x7ee/0x15a0 [ 34.348021] do_mmap+0x6a1/0xd50 [ 34.351356] vm_mmap_pgoff+0x1de/0x280 [ 34.355210] SyS_mmap_pgoff+0x23b/0x5f0 [ 34.359154] do_fast_syscall_32+0x3f2/0xf05 [ 34.363441] entry_SYSENTER_compat+0x51/0x60 [ 34.367814] [ 34.369411] Freed by task 3667: [ 34.372656] save_stack_trace+0x16/0x20 [ 34.376597] save_stack+0x43/0xd0 [ 34.380016] kasan_slab_free+0x71/0xc0 [ 34.383869] kmem_cache_free+0x77/0x280 [ 34.387808] remove_vma+0x162/0x1b0 [ 34.391402] do_munmap+0x82a/0xdf0 [ 34.394908] mmap_region+0x59e/0x15a0 [ 34.398678] do_mmap+0x6a1/0xd50 [ 34.402014] vm_mmap_pgoff+0x1de/0x280 [ 34.405867] SyS_mmap_pgoff+0x23b/0x5f0 [ 34.409813] do_fast_syscall_32+0x3f2/0xf05 [ 34.414102] entry_SYSENTER_compat+0x51/0x60 [ 34.418475] [ 34.420072] The buggy address belongs to the object at ffff8801cbfd3040 [ 34.420072] which belongs to the cache vm_area_struct of size 200 [ 34.432954] The buggy address is located 80 bytes inside of [ 34.432954] 200-byte region [ffff8801cbfd3040, ffff8801cbfd3108) [ 34.444706] The buggy address belongs to the page: [ 34.449600] page:ffffea00072ff4c0 count:1 mapcount:0 mapping:ffff8801cbfd3040 index:0x0 [ 34.457715] flags: 0x200000000000100(slab) [ 34.461919] raw: 0200000000000100 ffff8801cbfd3040 0000000000000000 000000010000000f [ 34.469766] raw: ffffea000730c7a0 ffffea00072ff7a0 ffff8801dae069c0 0000000000000000 [ 34.477615] page dumped because: kasan: bad access detected [ 34.483298] [ 34.484906] Memory state around the buggy address: [ 34.489818] ffff8801cbfd2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.497148] ffff8801cbfd3000: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 34.504478] >ffff8801cbfd3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.511808] ^ [ 34.515665] ffff8801cbfd3100: fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb [ 34.522995] ffff8801cbfd3180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.530329] ================================================================== [ 34.537659] Disabling lock debugging due to kernel taint [ 34.543186] Kernel panic - not syncing: panic_on_warn set ... [ 34.543186] [ 34.550531] CPU: 1 PID: 3660 Comm: syz-executor7 Tainted: G B 4.14.0-rc3+ #23 [ 34.558905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.568228] Call Trace: [ 34.570782] dump_stack+0x194/0x257 [ 34.574394] ? arch_local_irq_restore+0x53/0x53 [ 34.579043] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 34.583777] ? __do_page_fault+0xb20/0xd60 [ 34.587993] panic+0x1e4/0x417 [ 34.591164] ? __warn+0x1d9/0x1d9 [ 34.594591] ? __do_page_fault+0xc03/0xd60 [ 34.598796] kasan_end_report+0x50/0x50 [ 34.602745] kasan_report+0x144/0x340 [ 34.606525] __asan_report_load8_noabort+0x14/0x20 [ 34.611420] __do_page_fault+0xc03/0xd60 [ 34.615447] ? exit_to_usermode_loop+0x198/0x310 [ 34.620171] ? mm_fault_error+0x2c0/0x2c0 [ 34.624289] ? lockdep_sys_exit+0x47/0xf0 [ 34.628402] do_page_fault+0xee/0x720 [ 34.632169] ? __do_page_fault+0xd60/0xd60 [ 34.636373] ? lockdep_sys_exit+0x47/0xf0 [ 34.640484] ? syscall_return_slowpath+0x2b3/0x510 [ 34.645378] ? finish_task_switch+0x1aa/0x740 [ 34.649841] ? lockdep_sys_exit+0x47/0xf0 [ 34.653953] ? retint_user+0x18/0x20 [ 34.657633] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 34.662448] page_fault+0x22/0x30 [ 34.665869] RIP: 0023:0x8073f4f [ 34.669109] RSP: 002b:00000000f7f89bd0 EFLAGS: 00010202 [ 34.674438] RAX: 00000000f7f89c8c RBX: 0000000000000400 RCX: 000000000000000e [ 34.681672] RDX: 00000000f7f8aa88 RSI: 0000000020012fe0 RDI: 00000000f7f89c8c [ 34.688904] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000 [ 34.696140] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 34.703376] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 34.711042] Dumping ftrace buffer: [ 34.714550] (ftrace buffer empty) [ 34.718224] Kernel Offset: disabled [ 34.721814] Rebooting in 86400 seconds..