INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-7,10.128.0.56' (ECDSA) to the list of known hosts.
2017/09/30 03:16:31 parsed 1 programs
2017/09/30 03:16:31 executed programs: 0
2017/09/30 03:16:36 executed programs: 307
2017/09/30 03:16:41 executed programs: 570
syzkaller login: [  199.545369] ==================================================================
[  199.552759] BUG: KASAN: use-after-free in __lock_acquire+0x407b/0x4620
[  199.559392] Read of size 8 at addr ffff8801d6aab468 by task syz-executor5/9422
[  199.566714] 
[  199.568314] CPU: 0 PID: 9422 Comm: syz-executor5 Not tainted 4.14.0-rc2-mm1+ #11
[  199.575812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  199.585129] Call Trace:
[  199.587686]  dump_stack+0x194/0x257
[  199.591282]  ? arch_local_irq_restore+0x53/0x53
[  199.595915]  ? show_regs_print_info+0x65/0x65
[  199.600384]  ? __kernel_text_address+0xd/0x40
[  199.604851]  ? __lock_acquire+0x407b/0x4620
[  199.609142]  print_address_description+0x73/0x250
[  199.613949]  ? __lock_acquire+0x407b/0x4620
[  199.618235]  kasan_report+0x25b/0x340
[  199.622004]  __asan_report_load8_noabort+0x14/0x20
[  199.626901]  __lock_acquire+0x407b/0x4620
[  199.631022]  ? unwind_dump+0x4c0/0x4c0
[  199.634876]  ? __unwind_start+0x169/0x330
[  199.638989]  ? __kernel_text_address+0xd/0x40
[  199.643451]  ? unwind_get_return_address+0x61/0xa0
[  199.648348]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[  199.653501]  ? unwind_get_return_address+0x61/0xa0
[  199.658397]  ? __save_stack_trace+0x61/0xd0
[  199.662685]  ? get_signal+0x73f/0x16d0
[  199.666539]  ? save_stack_trace+0x16/0x20
[  199.670653]  ? __lock_acquire+0x20fd/0x4620
[  199.674942]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[  199.680100]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[  199.685257]  ? __bpf_address_lookup+0x2b0/0x2b0
[  199.689891]  ? osq_unlock+0x350/0x350
[  199.693656]  ? lock_release+0xd70/0xd70
[  199.697600]  ? __free_insn_slot+0x5c0/0x5c0
[  199.701888]  ? check_noncircular+0x20/0x20
[  199.706091]  ? is_bpf_text_address+0xa4/0x120
[  199.710551]  ? kernel_text_address+0x102/0x140
[  199.715100]  ? __kernel_text_address+0xd/0x40
[  199.719565]  ? find_held_lock+0x39/0x1d0
[  199.723595]  ? lock_downgrade+0x990/0x990
[  199.727707]  ? check_noncircular+0x20/0x20
[  199.731907]  ? kasan_kmalloc+0xad/0xe0
[  199.735762]  lock_acquire+0x1d5/0x580
[  199.739528]  ? exit_pi_state_list+0x369/0x7a0
[  199.743997]  ? lock_release+0xd70/0xd70
[  199.747939]  ? do_raw_spin_trylock+0x190/0x190
[  199.752484]  ? find_held_lock+0x39/0x1d0
[  199.756520]  _raw_spin_lock_irq+0x5e/0x80
[  199.760631]  ? exit_pi_state_list+0x369/0x7a0
[  199.765091]  exit_pi_state_list+0x369/0x7a0
[  199.769382]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[  199.775406]  ? lock_release+0xd70/0xd70
[  199.779348]  ? trace_event_raw_event_sched_switch+0x770/0x770
[  199.785197]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[  199.790267]  ? __might_sleep+0x95/0x190
[  199.794209]  ? __might_fault+0x188/0x1d0
[  199.798235]  ? do_raw_spin_trylock+0x190/0x190
[  199.802783]  mm_release+0x46d/0x590
[  199.806374]  ? do_raw_spin_trylock+0x190/0x190
[  199.810922]  ? mm_access+0x140/0x140
[  199.814602]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  199.819584]  ? trace_hardirqs_on+0xd/0x10
[  199.823696]  ? _raw_spin_unlock_irq+0x27/0x70
[  199.828154]  ? acct_collect+0x637/0x800
[  199.832093]  do_exit+0x481/0x1b00
[  199.835514]  ? mm_update_next_owner+0x930/0x930
[  199.840153]  ? trace_event_raw_event_sched_switch+0x770/0x770
[  199.846005]  ? rcu_note_context_switch+0x710/0x710
[  199.850904]  ? futex_wait_setup+0x14a/0x3d0
[  199.855191]  ? __might_sleep+0x95/0x190
[  199.859132]  ? osq_unlock+0x350/0x350
[  199.862899]  ? futex_wait_queue_me+0x524/0x7e0
[  199.867448]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[  199.872782]  ? check_noncircular+0x20/0x20
[  199.876984]  ? futex_wait_setup+0x22e/0x3d0
[  199.881273]  ? futex_wake+0x680/0x680
[  199.885042]  ? find_held_lock+0x39/0x1d0
[  199.889074]  ? lock_downgrade+0x990/0x990
[  199.893187]  ? recalc_sigpending_tsk+0x117/0x150
[  199.897908]  ? recalc_sigpending+0x103/0x160
[  199.902282]  ? recalc_sigpending_tsk+0x150/0x150
[  199.907001]  ? get_signal+0x2b2/0x16d0
[  199.910860]  do_group_exit+0x149/0x400
[  199.914714]  ? __lock_is_held+0xbc/0x140
[  199.918741]  ? SyS_exit+0x30/0x30
[  199.922161]  ? _raw_spin_unlock_irq+0x27/0x70
[  199.926621]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  199.931602]  get_signal+0x73f/0x16d0
[  199.935285]  ? ptrace_notify+0x130/0x130
[  199.939315]  ? find_held_lock+0x39/0x1d0
[  199.943345]  ? exit_robust_list+0x240/0x240
[  199.947633]  ? __fget+0xbb/0x580
[  199.950966]  do_signal+0x94/0x1ee0
[  199.954471]  ? lock_release+0xd70/0xd70
[  199.958410]  ? __lock_is_held+0xbc/0x140
[  199.962439]  ? setup_sigcontext+0x7d0/0x7d0
[  199.966729]  ? __fget+0x362/0x580
[  199.970149]  ? vmacache_find+0x5f/0x280
[  199.974091]  ? up_read+0x1a/0x40
[  199.977434]  ? __do_page_fault+0x3d6/0xd60
[  199.981641]  ? exit_to_usermode_loop+0x8c/0x310
[  199.986276]  exit_to_usermode_loop+0x214/0x310
[  199.990824]  ? trace_event_raw_event_sys_exit+0x260/0x260
[  199.996325]  ? fget_raw+0x20/0x20
[  199.999747]  syscall_return_slowpath+0x42f/0x510
[  200.004467]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[  200.009453]  ? entry_SYSCALL_64_fastpath+0x91/0xbe
[  200.014349]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  200.019329]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  200.024051]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[  200.028771] RIP: 0033:0x4520a9
[  200.031925] RSP: 002b:00007f0e9c554cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  200.039596] RAX: 0000000000000000 RBX: 0000000000718028 RCX: 00000000004520a9
[  200.046832] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718028
[  200.054066] RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
[  200.061300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  200.068534] R13: 0000000000a6f7ef R14: 00007f0e9c5559c0 R15: 0000000000000000
[  200.075775] 
[  200.077370] Allocated by task 9464:
[  200.080964]  save_stack_trace+0x16/0x20
[  200.084902]  save_stack+0x43/0xd0
[  200.088319]  kasan_kmalloc+0xad/0xe0
[  200.091999]  kmem_cache_alloc_trace+0x136/0x750
[  200.096641]  refill_pi_state_cache.part.6+0xa5/0x2f0
[  200.101707]  futex_requeue+0x1887/0x2370
[  200.105731]  do_futex+0x7f5/0x20d0
[  200.109236]  SyS_futex+0x260/0x390
[  200.112740]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  200.117456] 
[  200.119048] Freed by task 9432:
[  200.122292]  save_stack_trace+0x16/0x20
[  200.126231]  save_stack+0x43/0xd0
[  200.129647]  kasan_slab_free+0x71/0xc0
[  200.133497]  kfree+0xca/0x250
[  200.136566]  put_pi_state+0x3f4/0x560
[  200.140328]  unqueue_me_pi+0x4a/0xc0
[  200.144007]  futex_wait_requeue_pi.constprop.19+0xc7f/0x1300
[  200.149774]  do_futex+0x825/0x20d0
[  200.153277]  SyS_futex+0x260/0x390
[  200.156782]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  200.161499] 
[  200.163093] The buggy address belongs to the object at ffff8801d6aab440
[  200.163093]  which belongs to the cache kmalloc-256 of size 256
[  200.175712] The buggy address is located 40 bytes inside of
[  200.175712]  256-byte region [ffff8801d6aab440, ffff8801d6aab540)
[  200.187466] The buggy address belongs to the page:
[  200.192358] page:ffffea00075aaac0 count:1 mapcount:0 mapping:ffff8801d6aab080 index:0x0
[  200.200468] flags: 0x200000000000100(slab)
[  200.204675] raw: 0200000000000100 ffff8801d6aab080 0000000000000000 000000010000000c
[  200.212522] raw: ffffea00075821a0 ffffea00075824a0 ffff8801dac007c0 0000000000000000
[  200.220370] page dumped because: kasan: bad access detected
[  200.226040] 
[  200.227631] Memory state around the buggy address:
[  200.232525]  ffff8801d6aab300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  200.239848]  ffff8801d6aab380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  200.247170] >ffff8801d6aab400: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[  200.254489]                                                           ^
[  200.261204]  ffff8801d6aab480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  200.268526]  ffff8801d6aab500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  200.275848] ==================================================================
[  200.283168] Disabling lock debugging due to kernel taint
[  200.288581] Kernel panic - not syncing: panic_on_warn set ...
[  200.288581] 
[  200.295907] CPU: 0 PID: 9422 Comm: syz-executor5 Tainted: G    B           4.14.0-rc2-mm1+ #11
[  200.304617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  200.313942] Call Trace:
[  200.316495]  dump_stack+0x194/0x257
[  200.320089]  ? arch_local_irq_restore+0x53/0x53
[  200.324722]  ? vprintk_default+0x28/0x30
[  200.328749]  ? __lock_acquire+0x4060/0x4620
[  200.333035]  panic+0x1e4/0x41c
[  200.336196]  ? refcount_error_report+0x214/0x214
[  200.340923]  ? __lock_acquire+0x407b/0x4620
[  200.345213]  kasan_end_report+0x50/0x50
[  200.349154]  kasan_report+0x144/0x340
[  200.352920]  __asan_report_load8_noabort+0x14/0x20
[  200.357815]  __lock_acquire+0x407b/0x4620
[  200.361931]  ? unwind_dump+0x4c0/0x4c0
[  200.365782]  ? __unwind_start+0x169/0x330
[  200.369895]  ? __kernel_text_address+0xd/0x40
[  200.374357]  ? unwind_get_return_address+0x61/0xa0
[  200.379252]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[  200.384407]  ? unwind_get_return_address+0x61/0xa0
[  200.389302]  ? __save_stack_trace+0x61/0xd0
[  200.393591]  ? get_signal+0x73f/0x16d0
[  200.397442]  ? save_stack_trace+0x16/0x20
[  200.401554]  ? __lock_acquire+0x20fd/0x4620
[  200.405845]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[  200.411002]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[  200.416161]  ? __bpf_address_lookup+0x2b0/0x2b0
[  200.420795]  ? osq_unlock+0x350/0x350
[  200.424558]  ? lock_release+0xd70/0xd70
[  200.428500]  ? __free_insn_slot+0x5c0/0x5c0
[  200.432787]  ? check_noncircular+0x20/0x20
[  200.436990]  ? is_bpf_text_address+0xa4/0x120
[  200.441450]  ? kernel_text_address+0x102/0x140
[  200.445996]  ? __kernel_text_address+0xd/0x40
[  200.450460]  ? find_held_lock+0x39/0x1d0
[  200.454490]  ? lock_downgrade+0x990/0x990
[  200.458602]  ? check_noncircular+0x20/0x20
[  200.462802]  ? kasan_kmalloc+0xad/0xe0
[  200.466654]  lock_acquire+0x1d5/0x580
[  200.470418]  ? exit_pi_state_list+0x369/0x7a0
[  200.474880]  ? lock_release+0xd70/0xd70
[  200.478818]  ? do_raw_spin_trylock+0x190/0x190
[  200.483364]  ? find_held_lock+0x39/0x1d0
[  200.487395]  _raw_spin_lock_irq+0x5e/0x80
[  200.491509]  ? exit_pi_state_list+0x369/0x7a0
[  200.495970]  exit_pi_state_list+0x369/0x7a0
[  200.500259]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[  200.506281]  ? lock_release+0xd70/0xd70
[  200.510222]  ? trace_event_raw_event_sched_switch+0x770/0x770
[  200.516070]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[  200.521142]  ? __might_sleep+0x95/0x190
[  200.525081]  ? __might_fault+0x188/0x1d0
[  200.529110]  ? do_raw_spin_trylock+0x190/0x190
[  200.533659]  mm_release+0x46d/0x590
[  200.537248]  ? do_raw_spin_trylock+0x190/0x190
[  200.541794]  ? mm_access+0x140/0x140