INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-8,10.128.15.217' (ECDSA) to the list of known hosts.
2017/09/29 08:55:54 parsed 1 programs
2017/09/29 08:55:54 executed programs: 0
syzkaller login: [   33.738868] ==================================================================
[   33.746313] BUG: KASAN: use-after-free in __do_page_fault+0xc03/0xd60
[   33.752865] Read of size 8 at addr ffff8801cc6d3cb0 by task syz-executor2/3339
[   33.760193] 
[   33.761794] CPU: 1 PID: 3339 Comm: syz-executor2 Not tainted 4.14.0-rc2-next-20170929+ #32
[   33.770163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   33.779488] Call Trace:
[   33.782048]  dump_stack+0x194/0x257
[   33.785650]  ? arch_local_irq_restore+0x53/0x53
[   33.790293]  ? show_regs_print_info+0x65/0x65
[   33.794776]  ? __do_page_fault+0xc03/0xd60
[   33.798984]  print_address_description+0x73/0x250
[   33.803798]  ? __do_page_fault+0xc03/0xd60
[   33.808006]  kasan_report+0x25b/0x340
[   33.811784]  __asan_report_load8_noabort+0x14/0x20
[   33.816682]  __do_page_fault+0xc03/0xd60
[   33.820725]  ? mm_fault_error+0x2c0/0x2c0
[   33.824848]  ? free_pidmap.isra.0+0x70/0x70
[   33.829148]  do_page_fault+0xee/0x720
[   33.832921]  ? __do_page_fault+0xd60/0xd60
[   33.837131]  ? SyS_futex+0x269/0x390
[   33.840825]  ? do_futex+0x20d0/0x20d0
[   33.844598]  ? __task_pid_nr_ns+0x2c7/0x540
[   33.848901]  ? entry_SYSCALL_64_fastpath+0x4b/0xbe
[   33.853808]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   33.858628]  page_fault+0x22/0x30
[   33.862051] RIP: 0033:0x44bcf0
[   33.865212] RSP: 002b:00007f2e3f589758 EFLAGS: 00010202
[   33.870550] RAX: 00007f2e3f589800 RBX: 0000000000718000 RCX: 000000000000000e
[   33.877791] RDX: 0000000000000400 RSI: 0000000020012fe0 RDI: 00007f2e3f589800
[   33.885031] RBP: 0000000000005e10 R08: 0000000000000400 R09: 0000000000000000
[   33.892271] R10: 00000000000f4245 R11: 0000000000000246 R12: 00000000004bbc27
[   33.899514] R13: 00000000ffffffff R14: 0000000020012fee R15: 0000000000000000
[   33.906776] 
[   33.908375] Allocated by task 3339:
[   33.912280]  save_stack_trace+0x16/0x20
[   33.916224]  save_stack+0x43/0xd0
[   33.919646]  kasan_kmalloc+0xad/0xe0
[   33.923331]  kasan_slab_alloc+0x12/0x20
[   33.927277]  kmem_cache_alloc+0x12e/0x760
[   33.931397]  mmap_region+0x7ee/0x15a0
[   33.935600]  do_mmap+0x6a1/0xd50
[   33.938939]  vm_mmap_pgoff+0x1de/0x280
[   33.942795]  SyS_mmap_pgoff+0x23b/0x5f0
[   33.946742]  SyS_mmap+0x16/0x20
[   33.949993]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   33.954716] 
[   33.956314] Freed by task 3348:
[   33.959572]  save_stack_trace+0x16/0x20
[   33.963515]  save_stack+0x43/0xd0
[   33.966940]  kasan_slab_free+0x71/0xc0
[   33.970797]  kmem_cache_free+0x77/0x280
[   33.974740]  remove_vma+0x162/0x1b0
[   33.978341]  do_munmap+0x82a/0xdf0
[   33.981851]  mmap_region+0x59e/0x15a0
[   33.985618]  do_mmap+0x6a1/0xd50
[   33.988954]  vm_mmap_pgoff+0x1de/0x280
[   33.992822]  SyS_mmap_pgoff+0x23b/0x5f0
[   33.996775]  SyS_mmap+0x16/0x20
[   34.000023]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   34.004744] 
[   34.006343] The buggy address belongs to the object at ffff8801cc6d3c60
[   34.006343]  which belongs to the cache vm_area_struct of size 200
[   34.019228] The buggy address is located 80 bytes inside of
[   34.019228]  200-byte region [ffff8801cc6d3c60, ffff8801cc6d3d28)
[   34.030989] The buggy address belongs to the page:
[   34.035888] page:ffffea000731b4c0 count:1 mapcount:0 mapping:ffff8801cc6d3000 index:0x0
[   34.044011] flags: 0x200000000000100(slab)
[   34.048224] raw: 0200000000000100 ffff8801cc6d3000 0000000000000000 000000010000000f
[   34.056073] raw: ffffea000731aca0 ffffea000732ee20 ffff8801dae049c0 0000000000000000
[   34.063932] page dumped because: kasan: bad access detected
[   34.069695] 
[   34.071290] Memory state around the buggy address:
[   34.076188]  ffff8801cc6d3b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.083516]  ffff8801cc6d3c00: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
[   34.090845] >ffff8801cc6d3c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.098172]                                      ^
[   34.103069]  ffff8801cc6d3d00: fb fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb
[   34.110398]  ffff8801cc6d3d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.117726] ==================================================================
[   34.125052] Disabling lock debugging due to kernel taint
[   34.130565] Kernel panic - not syncing: panic_on_warn set ...
[   34.130565] 
[   34.137897] CPU: 1 PID: 3339 Comm: syz-executor2 Tainted: G    B           4.14.0-rc2-next-20170929+ #32
[   34.147478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   34.156795] Call Trace:
[   34.159351]  dump_stack+0x194/0x257
[   34.162943]  ? arch_local_irq_restore+0x53/0x53
[   34.167579]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   34.172304]  ? __do_page_fault+0xb90/0xd60
[   34.176506]  panic+0x1e4/0x41c
[   34.179666]  ? refcount_error_report+0x214/0x214
[   34.184394]  ? __do_page_fault+0xc03/0xd60
[   34.188597]  kasan_end_report+0x50/0x50
[   34.192537]  kasan_report+0x144/0x340
[   34.196303]  __asan_report_load8_noabort+0x14/0x20
[   34.201199]  __do_page_fault+0xc03/0xd60
[   34.205228]  ? mm_fault_error+0x2c0/0x2c0
[   34.209342]  ? free_pidmap.isra.0+0x70/0x70
[   34.213636]  do_page_fault+0xee/0x720
[   34.217403]  ? __do_page_fault+0xd60/0xd60
[   34.221608]  ? SyS_futex+0x269/0x390
[   34.225289]  ? do_futex+0x20d0/0x20d0
[   34.229071]  ? __task_pid_nr_ns+0x2c7/0x540
[   34.233359]  ? entry_SYSCALL_64_fastpath+0x4b/0xbe
[   34.238254]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   34.243067]  page_fault+0x22/0x30
[   34.246486] RIP: 0033:0x44bcf0
[   34.249641] RSP: 002b:00007f2e3f589758 EFLAGS: 00010202
[   34.254970] RAX: 00007f2e3f589800 RBX: 0000000000718000 RCX: 000000000000000e
[   34.262215] RDX: 0000000000000400 RSI: 0000000020012fe0 RDI: 00007f2e3f589800
[   34.269458] RBP: 0000000000005e10 R08: 0000000000000400 R09: 0000000000000000
[   34.276701] R10: 00000000000f4245 R11: 0000000000000246 R12: 00000000004bbc27
[   34.283936] R13: 00000000ffffffff R14: 0000000020012fee R15: 0000000000000000
[   34.291220] Dumping ftrace buffer:
[   34.294727]    (ftrace buffer empty)
[   34.298404] Kernel Offset: disabled
[   34.301995] Rebooting in 86400 seconds..