INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.20' (ECDSA) to the list of known hosts. 2018/04/15 14:22:14 parsed 1 programs 2018/04/15 14:22:14 executed programs: 0 syzkaller login: [ 26.918440] IPVS: Creating netns size=2536 id=1 [ 26.940097] IPVS: Creating netns size=2536 id=2 [ 26.967713] IPVS: Creating netns size=2536 id=3 [ 26.980914] IPVS: Creating netns size=2536 id=4 [ 27.003033] IPVS: Creating netns size=2536 id=5 [ 27.036379] IPVS: Creating netns size=2536 id=6 [ 27.055965] IPVS: Creating netns size=2536 id=7 [ 27.070546] IPVS: Creating netns size=2536 id=8 [ 27.247083] ================================================================== [ 27.254467] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 27.261193] Read of size 8 at addr ffff8801b604c0e0 by task syz-executor2/3857 [ 27.268520] [ 27.270124] CPU: 0 PID: 3857 Comm: syz-executor2 Not tainted 4.9.94-g8683408 #3 [ 27.277543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.286867] ffff8801b61bf6c8 ffffffff81d9b509 ffffea0006d81200 ffff8801b604c0e0 [ 27.294837] 0000000000000000 ffff8801b604c0e0 0000000000000000 ffff8801b61bf700 [ 27.302820] ffffffff815652cb ffff8801b604c0e0 0000000000000008 0000000000000000 [ 27.310792] Call Trace: [ 27.313355] [] dump_stack+0xc1/0x128 [ 27.318699] [] print_address_description+0x6c/0x234 [ 27.325334] [] kasan_report.cold.6+0x242/0x2fe [ 27.331717] [] ? disk_unblock_events+0x51/0x60 [ 27.337919] [] __asan_report_load8_noabort+0x14/0x20 [ 27.344638] [] disk_unblock_events+0x51/0x60 [ 27.350668] [] __blkdev_get+0x6b6/0xd60 [ 27.356261] [] ? __blkdev_put+0x840/0x840 [ 27.362031] [] ? fsnotify+0x114/0x1100 [ 27.367539] [] blkdev_get+0x2da/0x920 [ 27.372961] [] ? bd_may_claim+0xd0/0xd0 [ 27.378558] [] ? bd_acquire+0x27/0x250 [ 27.384073] [] ? bd_acquire+0x88/0x250 [ 27.389580] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.395525] [] blkdev_open+0x1a5/0x250 [ 27.401031] [] do_dentry_open+0x703/0xc80 [ 27.406797] [] ? blkdev_get_by_dev+0x70/0x70 [ 27.412823] [] vfs_open+0x11c/0x210 [ 27.418070] [] ? may_open.isra.57+0x14f/0x2a0 [ 27.424192] [] path_openat+0x758/0x3590 [ 27.429785] [] ? save_stack+0xa9/0xd0 [ 27.435212] [] ? path_lookupat.isra.41+0x410/0x410 [ 27.441762] [] ? __lock_is_held+0xa2/0xf0 [ 27.447532] [] do_filp_open+0x197/0x270 [ 27.453133] [] ? may_open_dev+0xe0/0xe0 [ 27.458728] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.464675] [] ? __alloc_fd+0x1d7/0x4a0 [ 27.470271] [] do_sys_open+0x30d/0x5c0 [ 27.475778] [] ? filp_open+0x70/0x70 [ 27.481111] [] ? up_read+0x1a/0x40 [ 27.486279] [] compat_SyS_open+0x2a/0x40 [ 27.491961] [] ? compat_SyS_getdents64+0x280/0x280 [ 27.498516] [] do_fast_syscall_32+0x2f7/0x870 [ 27.504639] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.511276] [] entry_SYSENTER_compat+0x90/0xa2 [ 27.517485] [ 27.519084] Allocated by task 3859: [ 27.522686] save_stack_trace+0x16/0x20 [ 27.526639] save_stack+0x43/0xd0 [ 27.530063] kasan_kmalloc+0xc7/0xe0 [ 27.533749] kmem_cache_alloc_trace+0xfd/0x2b0 [ 27.538303] alloc_disk_node+0x54/0x3a0 [ 27.542250] alloc_disk+0x18/0x20 [ 27.545674] loop_add+0x33b/0x770 [ 27.549106] loop_probe+0x14f/0x180 [ 27.552704] kobj_lookup+0x223/0x410 [ 27.556388] get_gendisk+0x39/0x2d0 [ 27.559986] __blkdev_get+0x351/0xd60 [ 27.563767] blkdev_get+0x2da/0x920 [ 27.567365] blkdev_open+0x1a5/0x250 [ 27.571050] do_dentry_open+0x703/0xc80 [ 27.575002] vfs_open+0x11c/0x210 [ 27.578428] path_openat+0x758/0x3590 [ 27.582198] do_filp_open+0x197/0x270 [ 27.585967] do_sys_open+0x30d/0x5c0 [ 27.589653] compat_SyS_open+0x2a/0x40 [ 27.593516] do_fast_syscall_32+0x2f7/0x870 [ 27.597810] entry_SYSENTER_compat+0x90/0xa2 [ 27.602187] [ 27.603785] Freed by task 3857: [ 27.607035] save_stack_trace+0x16/0x20 [ 27.610977] save_stack+0x43/0xd0 [ 27.614408] kasan_slab_free+0x72/0xc0 [ 27.618268] kfree+0xfb/0x310 [ 27.621344] disk_release+0x259/0x330 [ 27.625115] device_release+0x7e/0x220 [ 27.628985] kobject_release+0x103/0x1b0 [ 27.633025] kobject_put+0x6d/0xd0 [ 27.636541] put_disk+0x23/0x30 [ 27.639794] __blkdev_get+0x616/0xd60 [ 27.643563] blkdev_get+0x2da/0x920 [ 27.647160] blkdev_open+0x1a5/0x250 [ 27.650851] do_dentry_open+0x703/0xc80 [ 27.654796] vfs_open+0x11c/0x210 [ 27.658219] path_openat+0x758/0x3590 [ 27.661988] do_filp_open+0x197/0x270 [ 27.665759] do_sys_open+0x30d/0x5c0 [ 27.669454] compat_SyS_open+0x2a/0x40 [ 27.673312] do_fast_syscall_32+0x2f7/0x870 [ 27.677613] entry_SYSENTER_compat+0x90/0xa2 [ 27.681987] [ 27.683585] The buggy address belongs to the object at ffff8801b604bb80 [ 27.683585] which belongs to the cache kmalloc-2048 of size 2048 [ 27.696383] The buggy address is located 1376 bytes inside of [ 27.696383] 2048-byte region [ffff8801b604bb80, ffff8801b604c380) [ 27.708398] The buggy address belongs to the page: [ 27.713299] page:ffffea0006d81200 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 27.723474] flags: 0x8000000000004080(slab|head) [ 27.728199] page dumped because: kasan: bad access detected [ 27.733886] [ 27.735484] Memory state around the buggy address: [ 27.740388] ffff8801b604bf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.747717] ffff8801b604c000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.755057] >ffff8801b604c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.762385] ^ [ 27.768943] ffff8801b604c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.776277] ffff8801b604c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.783604] ================================================================== [ 27.790929] Disabling lock debugging due to kernel taint [ 27.796653] Kernel panic - not syncing: panic_on_warn set ... [ 27.796653] [ 27.804001] CPU: 0 PID: 3857 Comm: syz-executor2 Tainted: G B 4.9.94-g8683408 #3 [ 27.812633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.821970] ffff8801b61bf628 ffffffff81d9b509 ffffffff841a8a65 00000000ffffffff [ 27.829946] 0000000000000000 0000000000000000 0000000000000000 ffff8801b61bf6e8 [ 27.837927] ffffffff8141f845 0000000041b58ab3 ffffffff8419c168 ffffffff8141f686 [ 27.845907] Call Trace: [ 27.848472] [] dump_stack+0xc1/0x128 [ 27.853808] [] panic+0x1bf/0x3bc [ 27.858795] [] ? add_taint.cold.6+0x16/0x16 [ 27.864741] [] ? ___preempt_schedule+0x16/0x18 [ 27.870943] [] kasan_end_report+0x47/0x4f [ 27.876711] [] kasan_report.cold.6+0x76/0x2fe [ 27.882834] [] ? disk_unblock_events+0x51/0x60 [ 27.889035] [] __asan_report_load8_noabort+0x14/0x20 [ 27.895753] [] disk_unblock_events+0x51/0x60 [ 27.901781] [] __blkdev_get+0x6b6/0xd60 [ 27.907372] [] ? __blkdev_put+0x840/0x840 [ 27.913140] [] ? fsnotify+0x114/0x1100 [ 27.918646] [] blkdev_get+0x2da/0x920 [ 27.924153] [] ? bd_may_claim+0xd0/0xd0 [ 27.929745] [] ? bd_acquire+0x27/0x250 [ 27.935251] [] ? bd_acquire+0x88/0x250 [ 27.940765] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.946708] [] blkdev_open+0x1a5/0x250 [ 27.952214] [] do_dentry_open+0x703/0xc80 [ 27.957988] [] ? blkdev_get_by_dev+0x70/0x70 [ 27.964020] [] vfs_open+0x11c/0x210 [ 27.969268] [] ? may_open.isra.57+0x14f/0x2a0 [ 27.975386] [] path_openat+0x758/0x3590 [ 27.980979] [] ? save_stack+0xa9/0xd0 [ 27.986398] [] ? path_lookupat.isra.41+0x410/0x410 [ 27.992950] [] ? __lock_is_held+0xa2/0xf0 [ 27.998726] [] do_filp_open+0x197/0x270 [ 28.004319] [] ? may_open_dev+0xe0/0xe0 [ 28.009910] [] ? _raw_spin_unlock+0x2c/0x50 [ 28.015860] [] ? __alloc_fd+0x1d7/0x4a0 [ 28.021456] [] do_sys_open+0x30d/0x5c0 [ 28.026965] [] ? filp_open+0x70/0x70 [ 28.032300] [] ? up_read+0x1a/0x40 [ 28.037461] [] compat_SyS_open+0x2a/0x40 [ 28.043142] [] ? compat_SyS_getdents64+0x280/0x280 [ 28.049695] [] do_fast_syscall_32+0x2f7/0x870 [ 28.055810] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.062444] [] entry_SYSENTER_compat+0x90/0xa2 [ 28.069001] Dumping ftrace buffer: [ 28.072526] (ftrace buffer empty) [ 28.076208] Kernel Offset: disabled [ 28.079813] Rebooting in 86400 seconds..