INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-net-kasan-gce-0,10.128.15.195' (ECDSA) to the list of known hosts.
2017/09/12 12:33:31 parsed 1 programs
2017/09/12 12:33:31 executed programs: 0
2017/09/12 12:33:36 executed programs: 453
2017/09/12 12:33:41 executed programs: 902
2017/09/12 12:33:46 executed programs: 1346
2017/09/12 12:33:51 executed programs: 1795
2017/09/12 12:33:56 executed programs: 2240
2017/09/12 12:34:01 executed programs: 2687
2017/09/12 12:34:06 executed programs: 3136
syzkaller login: [  125.063330] ==================================================================
[  125.070776] BUG: KASAN: use-after-free in get_work_pool+0x1c2/0x1e0
[  125.077155] Read of size 8 at addr ffff8801cc58c378 by task syz-executor5/21326
[  125.084569] 
[  125.086170] CPU: 1 PID: 21326 Comm: syz-executor5 Not tainted 4.13.0+ #43
[  125.093066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  125.102389] Call Trace:
[  125.104948]  dump_stack+0x194/0x257
[  125.108551]  ? arch_local_irq_restore+0x53/0x53
[  125.113192]  ? show_regs_print_info+0x65/0x65
[  125.117665]  ? __kernel_text_address+0xae/0xe0
[  125.122219]  ? get_work_pool+0x1c2/0x1e0
[  125.126253]  print_address_description+0x73/0x250
[  125.131067]  ? get_work_pool+0x1c2/0x1e0
[  125.135099]  kasan_report+0x24e/0x340
[  125.138878]  __asan_report_load8_noabort+0x14/0x20
[  125.143779]  get_work_pool+0x1c2/0x1e0
[  125.147639]  ? check_flush_dependency+0x370/0x370
[  125.152457]  ? save_stack_trace+0x16/0x20
[  125.156577]  ? save_stack+0x43/0xd0
[  125.160175]  ? kasan_kmalloc+0xad/0xe0
[  125.164031]  ? kasan_slab_alloc+0x12/0x20
[  125.168157]  __queue_work+0x235/0x1150
[  125.172021]  ? retint_kernel+0x10/0x10
[  125.175892]  ? insert_work+0x5d0/0x5d0
[  125.179766]  ? lock_downgrade+0x990/0x990
[  125.183889]  ? SyS_ioctl+0x8f/0xc0
[  125.187404]  ? psock_now_avail+0x34c/0x6c0
[  125.191617]  ? kcm_rcv_strparser+0x9a0/0x9a0
[  125.195999]  ? do_raw_spin_trylock+0x190/0x190
[  125.200555]  ? lockdep_init_map+0x3d/0x70
[  125.204674]  ? unreserve_rx_kcm+0x4d0/0x4d0
[  125.208970]  ? __local_bh_enable_ip+0x9d/0x160
[  125.213528]  queue_work_on+0x16a/0x1c0
[  125.217391]  strp_check_rcv+0x25/0x30
[  125.221164]  kcm_ioctl+0x826/0x1610
[  125.224772]  ? kcm_unattach+0x1510/0x1510
[  125.228892]  ? avc_ss_reset+0x110/0x110
[  125.232843]  ? lock_release+0xd70/0xd70
[  125.236795]  ? __lock_is_held+0xbc/0x140
[  125.240869]  sock_do_ioctl+0x65/0xb0
[  125.244559]  sock_ioctl+0x2c2/0x440
[  125.248161]  ? dlci_ioctl_set+0x40/0x40
[  125.252108]  do_vfs_ioctl+0x1b1/0x1530
[  125.255978]  ? ioctl_preallocate+0x2b0/0x2b0
[  125.260361]  ? selinux_capable+0x40/0x40
[  125.264404]  ? SyS_futex+0x260/0x390
[  125.268087]  ? SyS_futex+0x269/0x390
[  125.271770]  ? SyS_setsockopt+0x1fb/0x360
[  125.275902]  ? security_file_ioctl+0x7d/0xb0
[  125.280279]  ? security_file_ioctl+0x89/0xb0
[  125.284666]  SyS_ioctl+0x8f/0xc0
[  125.288014]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  125.292743] RIP: 0033:0x451e59
[  125.295905] RSP: 002b:00007f95185c3c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  125.303588] RAX: ffffffffffffffda RBX: 0000000000718160 RCX: 0000000000451e59
[  125.310828] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000a
[  125.318069] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  125.325309] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004bb657
[  125.332550] R13: 00000000ffffffff R14: 0000000000000002 R15: 0000000000000001
[  125.339813] 
[  125.341416] Allocated by task 21326:
[  125.345102]  save_stack_trace+0x16/0x20
[  125.349052]  save_stack+0x43/0xd0
[  125.352475]  kasan_kmalloc+0xad/0xe0
[  125.356159]  kasan_slab_alloc+0x12/0x20
[  125.360106]  kmem_cache_alloc+0x12e/0x760
[  125.364228]  kcm_ioctl+0x2d1/0x1610
[  125.367827]  sock_do_ioctl+0x65/0xb0
[  125.371510]  sock_ioctl+0x2c2/0x440
[  125.375109]  do_vfs_ioctl+0x1b1/0x1530
[  125.378969]  SyS_ioctl+0x8f/0xc0
[  125.382308]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  125.387030] 
[  125.388630] Freed by task 21329:
[  125.391965]  save_stack_trace+0x16/0x20
[  125.395908]  save_stack+0x43/0xd0
[  125.399329]  kasan_slab_free+0x71/0xc0
[  125.403186]  kmem_cache_free+0x77/0x280
[  125.407132]  kcm_unattach+0xe50/0x1510
[  125.410988]  kcm_ioctl+0xdf0/0x1610
[  125.414587]  sock_do_ioctl+0x65/0xb0
[  125.418270]  sock_ioctl+0x2c2/0x440
[  125.421865]  do_vfs_ioctl+0x1b1/0x1530
[  125.425724]  SyS_ioctl+0x8f/0xc0
[  125.429063]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  125.433792] 
[  125.435394] The buggy address belongs to the object at ffff8801cc58c240
[  125.435394]  which belongs to the cache kcm_psock_cache of size 664
[  125.448366] The buggy address is located 312 bytes inside of
[  125.448366]  664-byte region [ffff8801cc58c240, ffff8801cc58c4d8)
[  125.460208] The buggy address belongs to the page:
[  125.465110] page:ffffea0007316300 count:1 mapcount:0 mapping:ffff8801cc58c240 index:0x0 compound_mapcount: 0
[  125.475058] flags: 0x200000000008100(slab|head)
[  125.479699] raw: 0200000000008100 ffff8801cc58c240 0000000000000000 0000000100000009
[  125.487550] raw: ffffea000732f520 ffffea0007314ca0 ffff8801d2866e40 0000000000000000
[  125.495397] page dumped because: kasan: bad access detected
[  125.501077] 
[  125.502676] Memory state around the buggy address:
[  125.507583]  ffff8801cc58c200: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[  125.514912]  ffff8801cc58c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  125.522241] >ffff8801cc58c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  125.529575]                                                                 ^
[  125.536816]  ffff8801cc58c380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  125.544144]  ffff8801cc58c400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  125.551471] ==================================================================
[  125.558797] Disabling lock debugging due to kernel taint
[  125.564209] Kernel panic - not syncing: panic_on_warn set ...
[  125.564209] 
[  125.571533] CPU: 1 PID: 21326 Comm: syz-executor5 Tainted: G    B           4.13.0+ #43
[  125.579635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  125.588951] Call Trace:
[  125.591502]  dump_stack+0x194/0x257
[  125.595101]  ? arch_local_irq_restore+0x53/0x53
[  125.599738]  ? vprintk_default+0x28/0x30
[  125.603767]  ? get_work_pool+0xf0/0x1e0
[  125.607708]  panic+0x1e4/0x417
[  125.610865]  ? __warn+0x1d9/0x1d9
[  125.614290]  ? get_work_pool+0x1c2/0x1e0
[  125.618315]  kasan_end_report+0x50/0x50
[  125.622256]  kasan_report+0x137/0x340
[  125.626022]  __asan_report_load8_noabort+0x14/0x20
[  125.630915]  get_work_pool+0x1c2/0x1e0
[  125.634769]  ? check_flush_dependency+0x370/0x370
[  125.639579]  ? save_stack_trace+0x16/0x20
[  125.643691]  ? save_stack+0x43/0xd0
[  125.647283]  ? kasan_kmalloc+0xad/0xe0
[  125.651133]  ? kasan_slab_alloc+0x12/0x20
[  125.655247]  __queue_work+0x235/0x1150
[  125.659102]  ? retint_kernel+0x10/0x10
[  125.662961]  ? insert_work+0x5d0/0x5d0
[  125.666818]  ? lock_downgrade+0x990/0x990
[  125.670931]  ? SyS_ioctl+0x8f/0xc0
[  125.674439]  ? psock_now_avail+0x34c/0x6c0
[  125.678642]  ? kcm_rcv_strparser+0x9a0/0x9a0
[  125.683016]  ? do_raw_spin_trylock+0x190/0x190
[  125.687563]  ? lockdep_init_map+0x3d/0x70
[  125.691674]  ? unreserve_rx_kcm+0x4d0/0x4d0
[  125.695964]  ? __local_bh_enable_ip+0x9d/0x160
[  125.700512]  queue_work_on+0x16a/0x1c0
[  125.704366]  strp_check_rcv+0x25/0x30
[  125.708130]  kcm_ioctl+0x826/0x1610
[  125.711725]  ? kcm_unattach+0x1510/0x1510
[  125.715840]  ? avc_ss_reset+0x110/0x110
[  125.719780]  ? lock_release+0xd70/0xd70
[  125.723722]  ? __lock_is_held+0xbc/0x140
[  125.727767]  sock_do_ioctl+0x65/0xb0
[  125.731446]  sock_ioctl+0x2c2/0x440
[  125.735037]  ? dlci_ioctl_set+0x40/0x40
[  125.738975]  do_vfs_ioctl+0x1b1/0x1530
[  125.742829]  ? ioctl_preallocate+0x2b0/0x2b0
[  125.747202]  ? selinux_capable+0x40/0x40
[  125.751229]  ? SyS_futex+0x260/0x390
[  125.754904]  ? SyS_futex+0x269/0x390
[  125.758585]  ? SyS_setsockopt+0x1fb/0x360
[  125.762706]  ? security_file_ioctl+0x7d/0xb0
[  125.767083]  ? security_file_ioctl+0x89/0xb0
[  125.771459]  SyS_ioctl+0x8f/0xc0
[  125.774792]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  125.779511] RIP: 0033:0x451e59
[  125.782667] RSP: 002b:00007f95185c3c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  125.790338] RAX: ffffffffffffffda RBX: 0000000000718160 RCX: 0000000000451e59
[  125.797573] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000a
[  125.804807] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  125.812042] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004bb657
[  125.819277] R13: 00000000ffffffff R14: 0000000000000002 R15: 0000000000000001
[  125.826866] Dumping ftrace buffer:
[  125.830380]    (ftrace buffer empty)
[  125.834054] Kernel Offset: disabled
[  125.837644] Rebooting in 86400 seconds..