INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.11' (ECDSA) to the list of known hosts. 2018/04/15 14:25:02 parsed 1 programs 2018/04/15 14:25:02 executed programs: 0 syzkaller login: [ 90.739419] IPVS: Creating netns size=2536 id=1 [ 90.751905] IPVS: Creating netns size=2536 id=2 [ 90.763960] IPVS: Creating netns size=2536 id=3 [ 90.775952] IPVS: Creating netns size=2536 id=4 [ 90.788510] IPVS: Creating netns size=2536 id=5 [ 90.814078] IPVS: Creating netns size=2536 id=6 [ 90.852244] IPVS: Creating netns size=2536 id=7 [ 90.903953] IPVS: Creating netns size=2536 id=8 [ 91.806609] ================================================================== [ 91.814014] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 91.820758] Read of size 8 at addr ffff8801d4c93860 by task syz-executor4/4091 [ 91.828115] [ 91.829745] CPU: 1 PID: 4091 Comm: syz-executor4 Not tainted 4.9.94-g8683408 #3 [ 91.837182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.846532] ffff8801d4fcf6d8 ffffffff81d9b509 ffffea0007532400 ffff8801d4c93860 [ 91.854621] 0000000000000000 ffff8801d4c93860 0000000000000000 ffff8801d4fcf710 [ 91.862699] ffffffff815652cb ffff8801d4c93860 0000000000000008 0000000000000000 [ 91.870704] Call Trace: [ 91.873273] [] dump_stack+0xc1/0x128 [ 91.878622] [] print_address_description+0x6c/0x234 [ 91.885278] [] kasan_report.cold.6+0x242/0x2fe [ 91.891487] [] ? disk_unblock_events+0x51/0x60 [ 91.897705] [] __asan_report_load8_noabort+0x14/0x20 [ 91.904442] [] disk_unblock_events+0x51/0x60 [ 91.910479] [] __blkdev_get+0x6b6/0xd60 [ 91.916081] [] ? __blkdev_put+0x840/0x840 [ 91.921860] [] ? fsnotify+0xcae/0x1100 [ 91.927382] [] ? fsnotify+0x114/0x1100 [ 91.932924] [] blkdev_get+0x2da/0x920 [ 91.938361] [] ? bd_may_claim+0xd0/0xd0 [ 91.943980] [] ? bd_acquire+0x27/0x250 [ 91.949494] [] ? bd_acquire+0x88/0x250 [ 91.955016] [] ? _raw_spin_unlock+0x2c/0x50 [ 91.960963] [] blkdev_open+0x1a5/0x250 [ 91.966476] [] do_dentry_open+0x703/0xc80 [ 91.972248] [] ? blkdev_get_by_dev+0x70/0x70 [ 91.978305] [] vfs_open+0x11c/0x210 [ 91.983588] [] ? may_open.isra.57+0x14f/0x2a0 [ 91.989714] [] path_openat+0x758/0x3590 [ 91.995314] [] ? save_stack+0xa9/0xd0 [ 92.000738] [] ? path_lookupat.isra.41+0x410/0x410 [ 92.007295] [] ? __lock_is_held+0xa2/0xf0 [ 92.013071] [] do_filp_open+0x197/0x270 [ 92.018697] [] ? may_open_dev+0xe0/0xe0 [ 92.024313] [] ? _raw_spin_unlock+0x2c/0x50 [ 92.030279] [] ? __alloc_fd+0x1d7/0x4a0 [ 92.035889] [] do_sys_open+0x30d/0x5c0 [ 92.041404] [] ? filp_open+0x70/0x70 [ 92.046752] [] ? do_futex+0x1770/0x1770 [ 92.052460] [] ? __do_page_fault+0x183/0xd50 [ 92.058497] [] SyS_open+0x2d/0x40 [ 92.063586] [] ? do_sys_open+0x5c0/0x5c0 [ 92.069294] [] do_syscall_64+0x1a6/0x490 [ 92.075001] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 92.081898] [ 92.083497] Allocated by task 4095: [ 92.087099] save_stack_trace+0x16/0x20 [ 92.091052] save_stack+0x43/0xd0 [ 92.094476] kasan_kmalloc+0xc7/0xe0 [ 92.098174] kmem_cache_alloc_trace+0xfd/0x2b0 [ 92.102730] alloc_disk_node+0x54/0x3a0 [ 92.106675] alloc_disk+0x18/0x20 [ 92.110104] loop_add+0x33b/0x770 [ 92.113526] loop_probe+0x14f/0x180 [ 92.117134] kobj_lookup+0x223/0x410 [ 92.120817] get_gendisk+0x39/0x2d0 [ 92.124424] __blkdev_get+0x351/0xd60 [ 92.128368] blkdev_get+0x2da/0x920 [ 92.131964] blkdev_open+0x1a5/0x250 [ 92.135648] do_dentry_open+0x703/0xc80 [ 92.139594] vfs_open+0x11c/0x210 [ 92.143021] path_openat+0x758/0x3590 [ 92.146795] do_filp_open+0x197/0x270 [ 92.150567] do_sys_open+0x30d/0x5c0 [ 92.154251] SyS_open+0x2d/0x40 [ 92.157504] do_syscall_64+0x1a6/0x490 [ 92.161373] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 92.166444] [ 92.168046] Freed by task 4091: [ 92.171297] save_stack_trace+0x16/0x20 [ 92.175244] save_stack+0x43/0xd0 [ 92.178669] kasan_slab_free+0x72/0xc0 [ 92.182529] kfree+0xfb/0x310 [ 92.185612] disk_release+0x259/0x330 [ 92.189384] device_release+0x7e/0x220 [ 92.193260] kobject_release+0x103/0x1b0 [ 92.197325] kobject_put+0x6d/0xd0 [ 92.200839] put_disk+0x23/0x30 [ 92.204112] __blkdev_get+0x616/0xd60 [ 92.207886] blkdev_get+0x2da/0x920 [ 92.211484] blkdev_open+0x1a5/0x250 [ 92.215172] do_dentry_open+0x703/0xc80 [ 92.219121] vfs_open+0x11c/0x210 [ 92.222548] path_openat+0x758/0x3590 [ 92.226318] do_filp_open+0x197/0x270 [ 92.230092] do_sys_open+0x30d/0x5c0 [ 92.233776] SyS_open+0x2d/0x40 [ 92.237031] do_syscall_64+0x1a6/0x490 [ 92.240890] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 92.245965] [ 92.247580] The buggy address belongs to the object at ffff8801d4c93300 [ 92.247580] which belongs to the cache kmalloc-2048 of size 2048 [ 92.260386] The buggy address is located 1376 bytes inside of [ 92.260386] 2048-byte region [ffff8801d4c93300, ffff8801d4c93b00) [ 92.272418] The buggy address belongs to the page: [ 92.277327] page:ffffea0007532400 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 92.287507] flags: 0x8000000000004080(slab|head) [ 92.292233] page dumped because: kasan: bad access detected [ 92.297913] [ 92.299512] Memory state around the buggy address: [ 92.304415] ffff8801d4c93700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.311746] ffff8801d4c93780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.319080] >ffff8801d4c93800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.326411] ^ [ 92.332877] ffff8801d4c93880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.340207] ffff8801d4c93900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.347538] ================================================================== [ 92.354868] Disabling lock debugging due to kernel taint [ 92.363567] Kernel panic - not syncing: panic_on_warn set ... [ 92.363567] [ 92.370935] CPU: 1 PID: 4091 Comm: syz-executor4 Tainted: G B 4.9.94-g8683408 #3 [ 92.379583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 92.388912] ffff8801d4fcf638 ffffffff81d9b509 ffffffff841a8a65 00000000ffffffff [ 92.396900] 0000000000000000 0000000000000001 0000000000000000 ffff8801d4fcf6f8 [ 92.404891] ffffffff8141f845 0000000041b58ab3 ffffffff8419c168 ffffffff8141f686 [ 92.412881] Call Trace: [ 92.415446] [] dump_stack+0xc1/0x128 [ 92.420790] [] panic+0x1bf/0x3bc [ 92.425783] [] ? add_taint.cold.6+0x16/0x16 [ 92.431731] [] ? ___preempt_schedule+0x16/0x18 [ 92.437943] [] kasan_end_report+0x47/0x4f [ 92.443714] [] kasan_report.cold.6+0x76/0x2fe [ 92.449831] [] ? disk_unblock_events+0x51/0x60 [ 92.456052] [] __asan_report_load8_noabort+0x14/0x20 [ 92.462809] [] disk_unblock_events+0x51/0x60 [ 92.468876] [] __blkdev_get+0x6b6/0xd60 [ 92.474496] [] ? __blkdev_put+0x840/0x840 [ 92.480279] [] ? fsnotify+0xcae/0x1100 [ 92.485790] [] ? fsnotify+0x114/0x1100 [ 92.491306] [] blkdev_get+0x2da/0x920 [ 92.496729] [] ? bd_may_claim+0xd0/0xd0 [ 92.502324] [] ? bd_acquire+0x27/0x250 [ 92.507832] [] ? bd_acquire+0x88/0x250 [ 92.513341] [] ? _raw_spin_unlock+0x2c/0x50 [ 92.519284] [] blkdev_open+0x1a5/0x250 [ 92.524797] [] do_dentry_open+0x703/0xc80 [ 92.530570] [] ? blkdev_get_by_dev+0x70/0x70 [ 92.536601] [] vfs_open+0x11c/0x210 [ 92.541853] [] ? may_open.isra.57+0x14f/0x2a0 [ 92.547975] [] path_openat+0x758/0x3590 [ 92.553575] [] ? save_stack+0xa9/0xd0 [ 92.559000] [] ? path_lookupat.isra.41+0x410/0x410 [ 92.565551] [] ? __lock_is_held+0xa2/0xf0 [ 92.571322] [] do_filp_open+0x197/0x270 [ 92.576919] [] ? may_open_dev+0xe0/0xe0 [ 92.583394] [] ? _raw_spin_unlock+0x2c/0x50 [ 92.589343] [] ? __alloc_fd+0x1d7/0x4a0 [ 92.594939] [] do_sys_open+0x30d/0x5c0 [ 92.600447] [] ? filp_open+0x70/0x70 [ 92.605780] [] ? do_futex+0x1770/0x1770 [ 92.611375] [] ? __do_page_fault+0x183/0xd50 [ 92.617403] [] SyS_open+0x2d/0x40 [ 92.622478] [] ? do_sys_open+0x5c0/0x5c0 [ 92.628164] [] do_syscall_64+0x1a6/0x490 [ 92.633847] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 92.641373] Dumping ftrace buffer: [ 92.644891] (ftrace buffer empty) [ 92.648580] Kernel Offset: disabled [ 92.652189] Rebooting in 86400 seconds..