INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-8,10.128.0.62' (ECDSA) to the list of known hosts.
2017/10/20 01:02:09 parsed 1 programs
2017/10/20 01:02:09 executed programs: 0
2017/10/20 01:02:14 executed programs: 209
2017/10/20 01:02:19 executed programs: 420
2017/10/20 01:02:24 executed programs: 629
2017/10/20 01:02:29 executed programs: 840
2017/10/20 01:02:34 executed programs: 1053
2017/10/20 01:02:39 executed programs: 1264
2017/10/20 01:02:44 executed programs: 1473
2017/10/20 01:02:49 executed programs: 1685
2017/10/20 01:02:54 executed programs: 1901
2017/10/20 01:02:59 executed programs: 2111
2017/10/20 01:03:04 executed programs: 2321
2017/10/20 01:03:09 executed programs: 2535
2017/10/20 01:03:14 executed programs: 2746
2017/10/20 01:03:19 executed programs: 2957
2017/10/20 01:03:24 executed programs: 3167
2017/10/20 01:03:29 executed programs: 3379
2017/10/20 01:03:35 executed programs: 3587
2017/10/20 01:03:40 executed programs: 3800
2017/10/20 01:03:45 executed programs: 4012
2017/10/20 01:03:50 executed programs: 4221
2017/10/20 01:03:55 executed programs: 4428
2017/10/20 01:04:00 executed programs: 4638
2017/10/20 01:04:05 executed programs: 4849
2017/10/20 01:04:10 executed programs: 5058
2017/10/20 01:04:15 executed programs: 5270
2017/10/20 01:04:20 executed programs: 5483
2017/10/20 01:04:25 executed programs: 5695
2017/10/20 01:04:30 executed programs: 5903
2017/10/20 01:04:35 executed programs: 6114
2017/10/20 01:04:40 executed programs: 6329
2017/10/20 01:04:45 executed programs: 6547
2017/10/20 01:04:50 executed programs: 6763
2017/10/20 01:04:55 executed programs: 6978
2017/10/20 01:05:00 executed programs: 7190
2017/10/20 01:05:05 executed programs: 7400
2017/10/20 01:05:10 executed programs: 7612
2017/10/20 01:05:15 executed programs: 7821
2017/10/20 01:05:20 executed programs: 8030
2017/10/20 01:05:25 executed programs: 8238
2017/10/20 01:05:30 executed programs: 8449
2017/10/20 01:05:35 executed programs: 8659
2017/10/20 01:05:40 executed programs: 8869
2017/10/20 01:05:45 executed programs: 9080
2017/10/20 01:05:51 executed programs: 9290
2017/10/20 01:05:56 executed programs: 9503
2017/10/20 01:06:01 executed programs: 9710
2017/10/20 01:06:06 executed programs: 9918
2017/10/20 01:06:11 executed programs: 10128
2017/10/20 01:06:16 executed programs: 10339
2017/10/20 01:06:21 executed programs: 10548
syzkaller login: [ 1106.861383] ==================================================================
[ 1106.862522] BUG: KASAN: use-after-free in __lock_acquire+0x3c9f/0x3d50
[ 1106.863411] Read of size 8 at addr ffff8801cfa03de8 by task syz-executor3/12735
[ 1106.864446] 
[ 1106.864707] CPU: 1 PID: 12735 Comm: syz-executor3 Not tainted 4.14.0-rc5-next-20171018+ #36
[ 1106.865853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1106.868497] Call Trace:
[ 1106.869076]  dump_stack+0x194/0x257
[ 1106.870038]  ? arch_local_irq_restore+0x53/0x53
[ 1106.871214]  ? show_regs_print_info+0x65/0x65
[ 1106.872299]  ? print_irqtrace_events+0x270/0x270
[ 1106.872965]  ? print_irqtrace_events+0x270/0x270
[ 1106.873638]  ? __lock_acquire+0x3c9f/0x3d50
[ 1106.874217]  print_address_description+0x73/0x250
[ 1106.874864]  ? __lock_acquire+0x3c9f/0x3d50
[ 1106.875462]  kasan_report+0x25b/0x340
[ 1106.876005]  __asan_report_load8_noabort+0x14/0x20
[ 1106.876663]  __lock_acquire+0x3c9f/0x3d50
[ 1106.877219]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1106.877909]  ? exit_pi_state_list+0x369/0x7a0
[ 1106.878509]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1106.879213]  ? __lock_acquire+0x6aa/0x3d50
[ 1106.879780]  ? __lock_acquire+0x6aa/0x3d50
[ 1106.880365]  ? __lock_acquire+0x6aa/0x3d50
[ 1106.880934]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1106.881648]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1106.886802]  ? find_held_lock+0x35/0x1d0
[ 1106.890833]  ? osq_unlock+0x350/0x350
[ 1106.894603]  ? __lock_acquire+0x6aa/0x3d50
[ 1106.898805]  ? check_noncircular+0x20/0x20
[ 1106.903009]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1106.908168]  ? check_noncircular+0x20/0x20
[ 1106.912371]  ? find_held_lock+0x35/0x1d0
[ 1106.916402]  ? kprobe_flush_task+0x1a3/0x5d0
[ 1106.920779]  ? find_held_lock+0x35/0x1d0
[ 1106.924808]  lock_acquire+0x1d5/0x580
[ 1106.928575]  ? lock_acquire+0x1d5/0x580
[ 1106.932516]  ? exit_pi_state_list+0x369/0x7a0
[ 1106.936979]  ? lock_downgrade+0x990/0x990
[ 1106.941097]  ? lock_release+0xa40/0xa40
[ 1106.945036]  ? do_raw_spin_trylock+0x190/0x190
[ 1106.949582]  ? trace_hardirqs_on+0xd/0x10
[ 1106.953702]  _raw_spin_lock_irq+0x5e/0x80
[ 1106.957816]  ? exit_pi_state_list+0x369/0x7a0
[ 1106.962275]  exit_pi_state_list+0x369/0x7a0
[ 1106.966566]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[ 1106.972591]  ? lock_release+0xa40/0xa40
[ 1106.976535]  ? trace_event_raw_event_sched_switch+0x8a0/0x8a0
[ 1106.982387]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[ 1106.987460]  ? __might_sleep+0x95/0x190
[ 1106.991404]  ? __might_fault+0x188/0x1d0
[ 1106.995432]  ? do_raw_spin_trylock+0x190/0x190
[ 1106.999981]  mm_release+0x46d/0x590
[ 1107.003573]  ? do_raw_spin_trylock+0x190/0x190
[ 1107.008122]  ? mm_access+0x140/0x140
[ 1107.011804]  ? _raw_spin_unlock_irq+0x27/0x70
[ 1107.016267]  ? trace_hardirqs_on_caller+0x421/0x5c0
[ 1107.021248]  ? trace_hardirqs_on+0xd/0x10
[ 1107.025362]  ? _raw_spin_unlock_irq+0x27/0x70
[ 1107.029826]  ? acct_collect+0x637/0x800
[ 1107.033767]  do_exit+0x481/0x1ad0
[ 1107.037188]  ? mm_update_next_owner+0x930/0x930
[ 1107.041825]  ? trace_event_raw_event_sched_switch+0x8a0/0x8a0
[ 1107.047681]  ? rcu_note_context_switch+0x710/0x710
[ 1107.052577]  ? futex_wait_setup+0x14a/0x3d0
[ 1107.056867]  ? __might_sleep+0x95/0x190
[ 1107.060807]  ? _cond_resched+0x14/0x30
[ 1107.064659]  ? futex_wait_queue_me+0x524/0x7e0
[ 1107.069207]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[ 1107.074538]  ? memset+0x31/0x40
[ 1107.077872]  ? get_futex_value_locked+0xc3/0xf0
[ 1107.082513]  ? futex_wait_setup+0x22e/0x3d0
[ 1107.086829]  ? check_noncircular+0x20/0x20
[ 1107.091034]  ? futex_wake+0x680/0x680
[ 1107.094800]  ? mmdrop+0x18/0x30
[ 1107.098047]  ? drop_futex_key_refs.isra.13+0x63/0xa0
[ 1107.103118]  ? futex_wait+0x69e/0x990
[ 1107.106887]  ? find_held_lock+0x35/0x1d0
[ 1107.110918]  ? get_signal+0x7ae/0x16d0
[ 1107.114769]  ? lock_downgrade+0x990/0x990
[ 1107.118884]  do_group_exit+0x149/0x400
[ 1107.122738]  ? __lock_is_held+0xb6/0x140
[ 1107.126764]  ? SyS_exit+0x30/0x30
[ 1107.130186]  ? _raw_spin_unlock_irq+0x27/0x70
[ 1107.134649]  ? trace_hardirqs_on_caller+0x421/0x5c0
[ 1107.139632]  get_signal+0x73f/0x16d0
[ 1107.143313]  ? ptrace_notify+0x130/0x130
[ 1107.147342]  ? rcu_note_context_switch+0x710/0x710
[ 1107.152239]  ? vmacache_find+0x5f/0x280
[ 1107.156182]  ? bad_area_access_error+0x16b/0x240
[ 1107.160903]  ? find_vma+0x30/0x150
[ 1107.164413]  ? exit_robust_list+0x240/0x240
[ 1107.168702]  ? mm_fault_error+0x2c0/0x2c0
[ 1107.172819]  do_signal+0x94/0x1ee0
[ 1107.176329]  ? do_page_fault+0xee/0x720
[ 1107.180269]  ? __do_page_fault+0xd60/0xd60
[ 1107.184471]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[ 1107.189539]  ? setup_sigcontext+0x7d0/0x7d0
[ 1107.193828]  ? find_held_lock+0x35/0x1d0
[ 1107.197856]  ? retint_kernel+0x10/0x10
[ 1107.201710]  ? trace_hardirqs_on_caller+0x421/0x5c0
[ 1107.206694]  ? cmp_ex_sort+0xb0/0xb0
[ 1107.210373]  ? __do_page_fault+0x3d6/0xd60
[ 1107.214575]  ? retint_kernel+0x10/0x10
[ 1107.218432]  ? exit_to_usermode_loop+0x8c/0x310
[ 1107.223070]  exit_to_usermode_loop+0x214/0x310
[ 1107.228055]  ? trace_event_raw_event_sys_exit+0x260/0x260
[ 1107.233560]  syscall_return_slowpath+0x42f/0x510
[ 1107.238283]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[ 1107.243265]  ? entry_SYSCALL_64_fastpath+0x91/0xbe
[ 1107.248160]  ? trace_hardirqs_on_caller+0x421/0x5c0
[ 1107.253141]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 1107.257874]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[ 1107.262598] RIP: 0033:0x452719
[ 1107.265754] RSP: 002b:00007f762c54dce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 1107.273428] RAX: 0000000000000000 RBX: 0000000000758100 RCX: 0000000000452719
[ 1107.280663] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000758100
[ 1107.287899] RBP: 0000000000758100 R08: 0000000000000000 R09: 00000000007580d8
[ 1107.295134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 1107.302369] R13: 00007ffde9666a0f R14: 00007f762c54e9c0 R15: 0000000000000002
[ 1107.309617] 
[ 1107.311213] Allocated by task 12780:
[ 1107.314896]  save_stack+0x43/0xd0
[ 1107.318317]  kasan_kmalloc+0xad/0xe0
[ 1107.321998]  kmem_cache_alloc_trace+0x136/0x750
[ 1107.326639]  refill_pi_state_cache.part.6+0xa5/0x2f0
[ 1107.331705]  futex_requeue+0x1887/0x2370
[ 1107.335732]  do_futex+0x7f5/0x20d0
[ 1107.339237]  SyS_futex+0x260/0x390
[ 1107.342742]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[ 1107.347459] 
[ 1107.349053] Freed by task 12745:
[ 1107.352385]  save_stack+0x43/0xd0
[ 1107.355803]  kasan_slab_free+0x71/0xc0
[ 1107.359658]  kfree+0xca/0x250
[ 1107.362730]  put_pi_state+0x3f4/0x560
[ 1107.366503]  unqueue_me_pi+0x4a/0xc0
[ 1107.370182]  futex_wait_requeue_pi.constprop.19+0xc7f/0x1300
[ 1107.375947]  do_futex+0x825/0x20d0
[ 1107.379452]  SyS_futex+0x260/0x390
[ 1107.382958]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[ 1107.387676] 
[ 1107.389274] The buggy address belongs to the object at ffff8801cfa03dc0
[ 1107.389274]  which belongs to the cache kmalloc-256 of size 256
[ 1107.401893] The buggy address is located 40 bytes inside of
[ 1107.401893]  256-byte region [ffff8801cfa03dc0, ffff8801cfa03ec0)
[ 1107.413644] The buggy address belongs to the page:
[ 1107.418538] page:ffffea00073e80c0 count:1 mapcount:0 mapping:ffff8801cfa03000 index:0x0
[ 1107.426644] flags: 0x200000000000100(slab)
[ 1107.430846] raw: 0200000000000100 ffff8801cfa03000 0000000000000000 000000010000000c
[ 1107.438693] raw: ffffea00073c8f60 ffffea000737a6a0 ffff8801dac007c0 0000000000000000
[ 1107.446625] page dumped because: kasan: bad access detected
[ 1107.452344] 
[ 1107.453936] Memory state around the buggy address:
[ 1107.458831]  ffff8801cfa03c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1107.466154]  ffff8801cfa03d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1107.473484] >ffff8801cfa03d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 1107.480807]                                                           ^
[ 1107.487524]  ffff8801cfa03e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1107.494847]  ffff8801cfa03e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 1107.502168] ==================================================================
[ 1107.509489] Disabling lock debugging due to kernel taint
[ 1107.514900] Kernel panic - not syncing: panic_on_warn set ...
[ 1107.514900] 
[ 1107.522229] CPU: 1 PID: 12735 Comm: syz-executor3 Tainted: G    B            4.14.0-rc5-next-20171018+ #36
[ 1107.531981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1107.541299] Call Trace:
[ 1107.543861]  dump_stack+0x194/0x257
[ 1107.547455]  ? arch_local_irq_restore+0x53/0x53
[ 1107.552095]  ? kasan_end_report+0x32/0x50
[ 1107.556208]  ? lock_downgrade+0x990/0x990
[ 1107.560322]  ? vsnprintf+0x1ed/0x1900
[ 1107.564091]  ? __lock_acquire+0x3c50/0x3d50
[ 1107.568378]  panic+0x1e4/0x41c
[ 1107.571536]  ? refcount_error_report+0x214/0x214
[ 1107.576260]  ? add_taint+0x40/0x50
[ 1107.579765]  ? add_taint+0x1c/0x50
[ 1107.583270]  ? __lock_acquire+0x3c9f/0x3d50
[ 1107.587558]  kasan_end_report+0x50/0x50
[ 1107.591498]  kasan_report+0x144/0x340
[ 1107.595266]  __asan_report_load8_noabort+0x14/0x20
[ 1107.600160]  __lock_acquire+0x3c9f/0x3d50
[ 1107.604274]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1107.609431]  ? exit_pi_state_list+0x369/0x7a0
[ 1107.613895]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1107.619051]  ? __lock_acquire+0x6aa/0x3d50
[ 1107.623250]  ? __lock_acquire+0x6aa/0x3d50
[ 1107.627451]  ? __lock_acquire+0x6aa/0x3d50
[ 1107.631655]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1107.636814]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1107.641973]  ? find_held_lock+0x35/0x1d0
[ 1107.646000]  ? osq_unlock+0x350/0x350
[ 1107.649769]  ? __lock_acquire+0x6aa/0x3d50
[ 1107.653969]  ? check_noncircular+0x20/0x20
[ 1107.658170]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 1107.663324]  ? check_noncircular+0x20/0x20
[ 1107.667529]  ? find_held_lock+0x35/0x1d0
[ 1107.671560]  ? kprobe_flush_task+0x1a3/0x5d0
[ 1107.675935]  ? find_held_lock+0x35/0x1d0
[ 1107.679964]  lock_acquire+0x1d5/0x580
[ 1107.683729]  ? lock_acquire+0x1d5/0x580
[ 1107.687673]  ? exit_pi_state_list+0x369/0x7a0
[ 1107.692135]  ? lock_downgrade+0x990/0x990
[ 1107.696248]  ? lock_release+0xa40/0xa40
[ 1107.700187]  ? do_raw_spin_trylock+0x190/0x190
[ 1107.704733]  ? trace_hardirqs_on+0xd/0x10
[ 1107.708850]  _raw_spin_lock_irq+0x5e/0x80
[ 1107.712963]  ? exit_pi_state_list+0x369/0x7a0
[ 1107.717422]  exit_pi_state_list+0x369/0x7a0
[ 1107.721712]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[ 1107.727736]  ? lock_release+0xa40/0xa40
[ 1107.731676]  ? trace_event_raw_event_sched_switch+0x8a0/0x8a0
[ 1107.737524]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[ 1107.742596]  ? __might_sleep+0x95/0x190
[ 1107.746537]  ? __might_fault+0x188/0x1d0
[ 1107.750567]  ? do_raw_spin_trylock+0x190/0x190
[ 1107.755119]  mm_release+0x46d/0x590
[ 1107.758710]  ? do_raw_spin_trylock+0x190/0x190
[ 1107.763258]  ? mm_access+0x140/0x140
[ 1107.766939]  ? _raw_spin_unlock_irq+0x27/0x70
[ 1107.771400]  ? trace_hardirqs_on_caller+0x421/0x5c0
[ 1107.776381]  ? trace_hardirqs_on+0xd/0x10
[ 1107.780496]  ? _raw_spin_unlock_irq+0x27/0x70
[ 1107.784956]  ? acct_collect+0x637/0x800
[ 1107.788897]  do_exit+0x481/0x1ad0
[ 1107.792317]  ? mm_update_next_owner+0x930/0x930
[ 1107.796954]  ? trace_event_raw_event_sched_switch+0x8a0/0x8a0
[ 1107.802807]  ? rcu_note_context_switch+0x710/0x710
[ 1107.807702]  ? futex_wait_setup+0x14a/0x3d0
[ 1107.812033]  ? __might_sleep+0x95/0x190
[ 1107.815975]  ? _cond_resched+0x14/0x30
[ 1107.819828]  ? futex_wait_queue_me+0x524/0x7e0
[ 1107.824376]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[ 1107.829707]  ? memset+0x31/0x40
[ 1107.832963]  ? get_futex_value_locked+0xc3/0xf0
[ 1107.837598]  ? futex_wait_setup+0x22e/0x3d0
[ 1107.841889]  ? check_noncircular+0x20/0x20
[ 1107.846092]  ? futex_wake+0x680/0x680
[ 1107.849860]  ? mmdrop+0x18/0x30
[ 1107.853104]  ? drop_futex_key_refs.isra.13+0x63/0xa0
[ 1107.858173]  ? futex_wait+0x69e/0x990
[ 1107.861942]  ? find_held_lock+0x35/0x1d0