[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   12.150245] audit: type=1400 audit(1514014190.224:6): avc:  denied  { map } for  pid=3129 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-3,10.128.0.56' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   18.315917] audit: type=1400 audit(1514014196.389:7): avc:  denied  { map } for  pid=3143 comm="syzkaller273355" path="/root/syzkaller273355047" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   18.321664] ==================================================================
[   18.321679] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00
[   18.321685] Read of size 8 at addr ffff8801c9895db0 by task syzkaller273355/3143
[   18.321686] 
[   18.321693] CPU: 0 PID: 3143 Comm: syzkaller273355 Not tainted 4.15.0-rc4+ #235
[   18.321696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.321698] Call Trace:
[   18.321707]  dump_stack+0x194/0x257
[   18.321714]  ? arch_local_irq_restore+0x53/0x53
[   18.321722]  ? show_regs_print_info+0x18/0x18
[   18.321727]  ? print_irqtrace_events+0x270/0x270
[   18.321733]  ? __lock_acquire+0x664/0x3e00
[   18.321740]  ? __lock_acquire+0x3d4d/0x3e00
[   18.321748]  print_address_description+0x73/0x250
[   18.321754]  ? __lock_acquire+0x3d4d/0x3e00
[   18.321759]  kasan_report+0x25b/0x340
[   18.321767]  __asan_report_load8_noabort+0x14/0x20
[   18.321773]  __lock_acquire+0x3d4d/0x3e00
[   18.321778]  ? __lock_acquire+0x664/0x3e00
[   18.321783]  ? lock_downgrade+0x980/0x980
[   18.321788]  ? lock_downgrade+0x980/0x980
[   18.321796]  ? remove_wait_queue+0x81/0x350
[   18.321805]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.321811]  ? __lock_acquire+0x664/0x3e00
[   18.321816]  ? check_noncircular+0x20/0x20
[   18.321829]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.321835]  ? lock_acquire+0x1d5/0x580
[   18.321841]  ? lock_acquire+0x1d5/0x580
[   18.321846]  ? ep_free+0xf4/0x320
[   18.321855]  ? lock_release+0xa40/0xa40
[   18.321862]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.321868]  ? print_irqtrace_events+0x270/0x270
[   18.321876]  ? rcu_note_context_switch+0x710/0x710
[   18.321883]  ? __might_sleep+0x95/0x190
[   18.321888]  ? ep_free+0xf4/0x320
[   18.321894]  ? __mutex_lock+0x16f/0x1a80
[   18.321898]  ? ep_free+0xf4/0x320
[   18.321905]  ? print_irqtrace_events+0x270/0x270
[   18.321909]  ? ep_free+0xf4/0x320
[   18.321918]  lock_acquire+0x1d5/0x580
[   18.321922]  ? lock_acquire+0x1d5/0x580
[   18.321928]  ? remove_wait_queue+0x81/0x350
[   18.321934]  ? __lock_acquire+0x664/0x3e00
[   18.321941]  ? lock_release+0xa40/0xa40
[   18.321950]  ? lock_acquire+0x1d5/0x580
[   18.321955]  ? lock_acquire+0x1d5/0x580
[   18.321960]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.321969]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.321974]  ? remove_wait_queue+0x81/0x350
[   18.321981]  remove_wait_queue+0x81/0x350
[   18.321988]  ? add_wait_queue+0x290/0x290
[   18.321994]  ? rcutorture_record_progress+0x10/0x10
[   18.322007]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.322015]  ? __kernel_text_address+0xd/0x40
[   18.322022]  ? clear_tfile_check_list+0x370/0x370
[   18.322029]  ? check_noncircular+0x20/0x20
[   18.322037]  ? locks_remove_file+0x3fa/0x5a0
[   18.322046]  ep_free+0x13f/0x320
[   18.322052]  ? ep_remove+0x800/0x800
[   18.322058]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.322066]  ? ep_free+0x320/0x320
[   18.322071]  ep_eventpoll_release+0x44/0x60
[   18.322078]  __fput+0x327/0x7e0
[   18.322085]  ? fput+0x140/0x140
[   18.322092]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.322100]  ____fput+0x15/0x20
[   18.322106]  task_work_run+0x199/0x270
[   18.322113]  ? task_work_cancel+0x210/0x210
[   18.322119]  ? _raw_spin_unlock+0x22/0x30
[   18.322125]  ? switch_task_namespaces+0x87/0xc0
[   18.322134]  do_exit+0x9bb/0x1ad0
[   18.322143]  ? binder_ioctl+0x4c1/0x1417
[   18.322149]  ? mm_update_next_owner+0x930/0x930
[   18.322157]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.322167]  ? avc_ss_reset+0x110/0x110
[   18.322172]  ? mutex_unlock+0xd/0x10
[   18.322178]  ? SyS_epoll_ctl+0x30a/0x1ab0
[   18.322197]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.322202]  ? up_read+0x1a/0x40
[   18.322208]  ? rcu_note_context_switch+0x710/0x710
[   18.322215]  ? __fd_install+0x288/0x740
[   18.322224]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.322234]  ? do_vfs_ioctl+0x486/0x1520
[   18.322240]  ? _cond_resched+0x14/0x30
[   18.322248]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.322256]  ? selinux_capable+0x40/0x40
[   18.322263]  ? __alloc_fd+0x750/0x750
[   18.322271]  do_group_exit+0x149/0x400
[   18.322277]  ? SyS_exit+0x30/0x30
[   18.322284]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.322292]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.322299]  SyS_exit_group+0x1d/0x20
[   18.322305]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.322310] RIP: 0033:0x4429f8
[   18.322313] RSP: 002b:00007fff94291b48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.322319] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.322322] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.322326] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.322329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.322332] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.322341] 
[   18.322344] Allocated by task 3143:
[   18.322349]  save_stack+0x43/0xd0
[   18.322353]  kasan_kmalloc+0xad/0xe0
[   18.322360]  kmem_cache_alloc_trace+0x136/0x750
[   18.322365]  binder_get_thread+0x1cf/0x870
[   18.322370]  binder_poll+0x8c/0x390
[   18.322374]  ep_item_poll.isra.10+0xec/0x320
[   18.322378]  ep_insert+0x6a3/0x1b10
[   18.322383]  SyS_epoll_ctl+0x12e4/0x1ab0
[   18.322388]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.322389] 
[   18.322391] Freed by task 3143:
[   18.322395]  save_stack+0x43/0xd0
[   18.322400]  kasan_slab_free+0x71/0xc0
[   18.322404]  kfree+0xd6/0x260
[   18.322409]  binder_thread_dec_tmpref+0x27f/0x310
[   18.322414]  binder_thread_release+0x27d/0x540
[   18.322419]  binder_ioctl+0xc02/0x1417
[   18.322424]  do_vfs_ioctl+0x1b1/0x1520
[   18.322429]  SyS_ioctl+0x8f/0xc0
[   18.322434]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.322435] 
[   18.322439] The buggy address belongs to the object at ffff8801c9895d00
[   18.322439]  which belongs to the cache kmalloc-512 of size 512
[   18.322444] The buggy address is located 176 bytes inside of
[   18.322444]  512-byte region [ffff8801c9895d00, ffff8801c9895f00)
[   18.322445] The buggy address belongs to the page:
[   18.322450] page:000000006ccde9b6 count:1 mapcount:0 mapping:0000000042d97a19 index:0x0
[   18.322455] flags: 0x2fffc0000000100(slab)
[   18.322463] raw: 02fffc0000000100 ffff8801c9895080 0000000000000000 0000000100000006
[   18.322470] raw: ffffea000727fd20 ffffea000727ffe0 ffff8801db000940 0000000000000000
[   18.322472] page dumped because: kasan: bad access detected
[   18.322473] 
[   18.322475] Memory state around the buggy address:
[   18.322479]  ffff8801c9895c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.322483]  ffff8801c9895d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.322488] >ffff8801c9895d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.322490]                                      ^
[   18.322494]  ffff8801c9895e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.322498]  ffff8801c9895e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.322500] ==================================================================
[   18.322502] Disabling lock debugging due to kernel taint
[   18.322505] Kernel panic - not syncing: panic_on_warn set ...
[   18.322505] 
[   18.322511] CPU: 0 PID: 3143 Comm: syzkaller273355 Tainted: G    B            4.15.0-rc4+ #235
[   18.322514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.322515] Call Trace:
[   18.322521]  dump_stack+0x194/0x257
[   18.322528]  ? arch_local_irq_restore+0x53/0x53
[   18.322533]  ? kasan_end_report+0x32/0x50
[   18.322539]  ? lock_downgrade+0x980/0x980
[   18.322544]  ? vsnprintf+0x1ed/0x1900
[   18.322550]  ? __lock_acquire+0x3cf0/0x3e00
[   18.322555]  panic+0x1e4/0x41c
[   18.322561]  ? refcount_error_report+0x214/0x214
[   18.322568]  ? add_taint+0x40/0x50
[   18.322572]  ? add_taint+0x1c/0x50
[   18.322579]  ? __lock_acquire+0x3d4d/0x3e00
[   18.322584]  kasan_end_report+0x50/0x50
[   18.322590]  kasan_report+0x144/0x340
[   18.322598]  __asan_report_load8_noabort+0x14/0x20
[   18.322603]  __lock_acquire+0x3d4d/0x3e00
[   18.322608]  ? __lock_acquire+0x664/0x3e00
[   18.322614]  ? lock_downgrade+0x980/0x980
[   18.322618]  ? lock_downgrade+0x980/0x980
[   18.322626]  ? remove_wait_queue+0x81/0x350
[   18.322634]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.322640]  ? __lock_acquire+0x664/0x3e00
[   18.322645]  ? check_noncircular+0x20/0x20
[   18.322657]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.322663]  ? lock_acquire+0x1d5/0x580
[   18.322668]  ? lock_acquire+0x1d5/0x580
[   18.322673]  ? ep_free+0xf4/0x320
[   18.322681]  ? lock_release+0xa40/0xa40
[   18.322687]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.322692]  ? print_irqtrace_events+0x270/0x270
[   18.322699]  ? rcu_note_context_switch+0x710/0x710
[   18.322705]  ? __might_sleep+0x95/0x190
[   18.322711]  ? ep_free+0xf4/0x320
[   18.322716]  ? __mutex_lock+0x16f/0x1a80
[   18.322720]  ? ep_free+0xf4/0x320
[   18.322726]  ? print_irqtrace_events+0x270/0x270
[   18.322731]  ? ep_free+0xf4/0x320
[   18.322739]  lock_acquire+0x1d5/0x580
[   18.322744]  ? lock_acquire+0x1d5/0x580
[   18.322749]  ? remove_wait_queue+0x81/0x350
[   18.322754]  ? __lock_acquire+0x664/0x3e00
[   18.322762]  ? lock_release+0xa40/0xa40
[   18.322770]  ? lock_acquire+0x1d5/0x580
[   18.322775]  ? lock_acquire+0x1d5/0x580
[   18.322781]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.322788]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.322793]  ? remove_wait_queue+0x81/0x350
[   18.322799]  remove_wait_queue+0x81/0x350
[   18.322807]  ? add_wait_queue+0x290/0x290
[   18.322812]  ? rcutorture_record_progress+0x10/0x10
[   18.322821]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.322827]  ? __kernel_text_address+0xd/0x40
[   18.322835]  ? clear_tfile_check_list+0x370/0x370
[   18.322842]  ? check_noncircular+0x20/0x20
[   18.322849]  ? locks_remove_file+0x3fa/0x5a0
[   18.322857]  ep_free+0x13f/0x320
[   18.322863]  ? ep_remove+0x800/0x800
[   18.322869]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.322876]  ? ep_free+0x320/0x320
[   18.322881]  ep_eventpoll_release+0x44/0x60
[   18.322886]  __fput+0x327/0x7e0
[   18.322894]  ? fput+0x140/0x140
[   18.322900]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.322908]  ____fput+0x15/0x20
[   18.322914]  task_work_run+0x199/0x270
[   18.322921]  ? task_work_cancel+0x210/0x210
[   18.322927]  ? _raw_spin_unlock+0x22/0x30
[   18.322932]  ? switch_task_namespaces+0x87/0xc0
[   18.322939]  do_exit+0x9bb/0x1ad0
[   18.322947]  ? binder_ioctl+0x4c1/0x1417
[   18.322953]  ? mm_update_next_owner+0x930/0x930
[   18.322960]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.322968]  ? avc_ss_reset+0x110/0x110
[   18.322973]  ? mutex_unlock+0xd/0x10
[   18.322978]  ? SyS_epoll_ctl+0x30a/0x1ab0
[   18.322996]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.323000]  ? up_read+0x1a/0x40
[   18.323007]  ? rcu_note_context_switch+0x710/0x710
[   18.323012]  ? __fd_install+0x288/0x740
[   18.323021]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.323026]  ? do_vfs_ioctl+0x486/0x1520
[   18.323032]  ? _cond_resched+0x14/0x30
[   18.323040]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.323046]  ? selinux_capable+0x40/0x40
[   18.323053]  ? __alloc_fd+0x750/0x750
[   18.323061]  do_group_exit+0x149/0x400
[   18.323067]  ? SyS_exit+0x30/0x30
[   18.323073]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.323080]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.323087]  SyS_exit_group+0x1d/0x20
[   18.323093]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.323096] RIP: 0033:0x4429f8
[   18.323099] RSP: 002b:00007fff94291b48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.323104] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.323108] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.323111] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.323114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.323117] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.342250] Dumping ftrace buffer:
[   18.342253]    (ftrace buffer empty)
[   18.342256] Kernel Offset: disabled
[   19.463826] Rebooting in 86400 seconds..