INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-1,10.128.15.214' (ECDSA) to the list of known hosts.
2017/10/04 11:42:29 parsed 1 programs
2017/10/04 11:42:29 executed programs: 0
syzkaller login: [   26.714755] ==================================================================
[   26.722137] BUG: KASAN: use-after-free in __lock_acquire+0x407b/0x4620
[   26.728767] Read of size 8 at addr ffff8801ce19e668 by task syz-executor0/3098
[   26.736086] 
[   26.737682] CPU: 0 PID: 3098 Comm: syz-executor0 Not tainted 4.14.0-rc3+ #24
[   26.744831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   26.754155] Call Trace:
[   26.756712]  dump_stack+0x194/0x257
[   26.760306]  ? arch_local_irq_restore+0x53/0x53
[   26.764951]  ? show_regs_print_info+0x65/0x65
[   26.769411]  ? __kernel_text_address+0xd/0x40
[   26.773873]  ? __lock_acquire+0x407b/0x4620
[   26.778171]  print_address_description+0x73/0x250
[   26.782978]  ? __lock_acquire+0x407b/0x4620
[   26.787265]  kasan_report+0x25b/0x340
[   26.791031]  __asan_report_load8_noabort+0x14/0x20
[   26.795924]  __lock_acquire+0x407b/0x4620
[   26.800036]  ? unwind_dump+0x4c0/0x4c0
[   26.803888]  ? __kernel_text_address+0xd/0x40
[   26.808346]  ? unwind_get_return_address+0x61/0xa0
[   26.813242]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   26.818398]  ? __save_stack_trace+0x61/0xd0
[   26.822688]  ? get_signal+0x73f/0x16d0
[   26.826540]  ? save_stack_trace+0x16/0x20
[   26.830653]  ? __lock_acquire+0x20fd/0x4620
[   26.834939]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   26.840094]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   26.845249]  ? __bpf_address_lookup+0x2b0/0x2b0
[   26.849882]  ? osq_unlock+0x350/0x350
[   26.853647]  ? lock_release+0xd70/0xd70
[   26.857585]  ? __free_insn_slot+0x5c0/0x5c0
[   26.861872]  ? check_noncircular+0x20/0x20
[   26.866070]  ? is_bpf_text_address+0xa4/0x120
[   26.870529]  ? kernel_text_address+0x102/0x140
[   26.875074]  ? __kernel_text_address+0xd/0x40
[   26.879541]  ? find_held_lock+0x39/0x1d0
[   26.883568]  ? lock_downgrade+0x990/0x990
[   26.887678]  ? check_noncircular+0x20/0x20
[   26.891877]  ? save_stack+0x43/0xd0
[   26.895469]  ? kasan_kmalloc+0xad/0xe0
[   26.899321]  lock_acquire+0x1d5/0x580
[   26.903268]  ? exit_pi_state_list+0x369/0x7a0
[   26.907729]  ? lock_release+0xd70/0xd70
[   26.911665]  ? do_raw_spin_trylock+0x190/0x190
[   26.916209]  ? find_held_lock+0x39/0x1d0
[   26.920240]  _raw_spin_lock_irq+0x5e/0x80
[   26.924352]  ? exit_pi_state_list+0x369/0x7a0
[   26.928812]  exit_pi_state_list+0x369/0x7a0
[   26.933100]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[   26.939121]  ? lock_release+0xd70/0xd70
[   26.943058]  ? check_same_owner+0x320/0x320
[   26.947344]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[   26.952416]  ? __might_sleep+0x95/0x190
[   26.956355]  ? __might_fault+0x188/0x1d0
[   26.960382]  ? do_raw_spin_trylock+0x190/0x190
[   26.964929]  mm_release+0x46d/0x590
[   26.968519]  ? do_raw_spin_trylock+0x190/0x190
[   26.973066]  ? mm_access+0x140/0x140
[   26.976745]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   26.981725]  ? trace_hardirqs_on+0xd/0x10
[   26.985837]  ? _raw_spin_unlock_irq+0x27/0x70
[   26.990295]  ? acct_collect+0x637/0x800
[   26.994235]  do_exit+0x481/0x1af0
[   26.997665]  ? mm_update_next_owner+0x930/0x930
[   27.002297]  ? lock_downgrade+0x990/0x990
[   27.006408]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[   27.011738]  ? futex_wait+0x3ad/0x990
[   27.015506]  ? osq_unlock+0x350/0x350
[   27.019270]  ? fault_in_user_writeable+0x90/0x90
[   27.023991]  ? futex_wake+0x680/0x680
[   27.027755]  ? check_noncircular+0x20/0x20
[   27.031965]  ? drop_futex_key_refs.isra.13+0x63/0xb0
[   27.037031]  ? futex_wait+0x69e/0x990
[   27.040796]  ? futex_wait_setup+0x3d0/0x3d0
[   27.045081]  ? find_held_lock+0x39/0x1d0
[   27.049108]  ? lock_downgrade+0x990/0x990
[   27.053220]  ? recalc_sigpending_tsk+0x117/0x150
[   27.057943]  ? recalc_sigpending+0x103/0x160
[   27.062314]  ? recalc_sigpending_tsk+0x150/0x150
[   27.067033]  ? get_signal+0x2b2/0x16d0
[   27.070886]  do_group_exit+0x149/0x400
[   27.074738]  ? __lock_is_held+0xbc/0x140
[   27.078761]  ? SyS_exit+0x30/0x30
[   27.082178]  ? _raw_spin_unlock_irq+0x27/0x70
[   27.086638]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   27.091620]  get_signal+0x73f/0x16d0
[   27.095300]  ? ptrace_notify+0x130/0x130
[   27.099325]  ? lock_downgrade+0x990/0x990
[   27.103437]  ? SyS_brk+0x6f0/0x6f0
[   27.106941]  ? arch_get_unmapped_area+0x750/0x750
[   27.111744]  ? lock_acquire+0x1d5/0x580
[   27.115682]  ? vm_mmap_pgoff+0x198/0x280
[   27.119708]  ? userfaultfd_unmap_complete+0x327/0x510
[   27.124864]  do_signal+0x94/0x1ee0
[   27.128369]  ? do_mmap+0x34f/0xd50
[   27.131873]  ? up_write+0x6b/0x120
[   27.135381]  ? setup_sigcontext+0x7d0/0x7d0
[   27.139666]  ? security_mmap_file+0x143/0x180
[   27.144126]  ? vm_mmap_pgoff+0x1fc/0x280
[   27.148149]  ? vm_mmap_pgoff+0x13b/0x280
[   27.152176]  ? vma_is_stack_for_current+0xa0/0xa0
[   27.156981]  ? find_held_lock+0x39/0x1d0
[   27.161008]  ? __compat_get_timespec+0xd9/0x120
[   27.165644]  ? exit_to_usermode_loop+0x8c/0x310
[   27.170279]  exit_to_usermode_loop+0x214/0x310
[   27.174826]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   27.180327]  ? lock_acquire+0x1d5/0x580
[   27.184265]  ? do_fast_syscall_32+0x158/0xf05
[   27.188724]  do_fast_syscall_32+0x83e/0xf05
[   27.193009]  ? compat_start_thread+0x80/0x80
[   27.197382]  ? do_int80_syscall_32+0x940/0x940
[   27.201929]  ? lockdep_sys_exit+0x47/0xf0
[   27.206041]  ? syscall_return_slowpath+0x2b3/0x510
[   27.210934]  ? finish_task_switch+0x1aa/0x740
[   27.215396]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   27.220380]  ? sysret32_from_system_call+0x5/0x3b
[   27.225188]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   27.229994]  entry_SYSENTER_compat+0x51/0x60
[   27.234366] RIP: 0023:0xf7f22c79
[   27.237693] RSP: 002b:00000000f7f1e12c EFLAGS: 00000292 ORIG_RAX: 00000000000000f0
[   27.245364] RAX: fffffffffffffe00 RBX: 0000000008128018 RCX: 0000000000000000
[   27.252607] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   27.259842] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   27.267079] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   27.274314] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   27.281553] 
[   27.283145] Allocated by task 3100:
[   27.286737]  save_stack_trace+0x16/0x20
[   27.290675]  save_stack+0x43/0xd0
[   27.294093]  kasan_kmalloc+0xad/0xe0
[   27.297769]  kmem_cache_alloc_trace+0x136/0x750
[   27.302413]  refill_pi_state_cache.part.6+0xa5/0x2f0
[   27.307482]  futex_requeue+0x1887/0x2370
[   27.311505]  do_futex+0x7f5/0x20d0
[   27.315014]  compat_SyS_futex+0x27f/0x380
[   27.319128]  do_fast_syscall_32+0x3f2/0xf05
[   27.323413]  entry_SYSENTER_compat+0x51/0x60
[   27.327781] 
[   27.329375] Freed by task 3099:
[   27.332620]  save_stack_trace+0x16/0x20
[   27.336559]  save_stack+0x43/0xd0
[   27.339973]  kasan_slab_free+0x71/0xc0
[   27.343823]  kfree+0xca/0x250
[   27.346891]  put_pi_state+0x3f4/0x560
[   27.350653]  unqueue_me_pi+0x4a/0xc0
[   27.354329]  futex_wait_requeue_pi.constprop.19+0xc7f/0x1300
[   27.360088]  do_futex+0x825/0x20d0
[   27.363589]  compat_SyS_futex+0x27f/0x380
[   27.367699]  do_fast_syscall_32+0x3f2/0xf05
[   27.371991]  entry_SYSENTER_compat+0x51/0x60
[   27.376360] 
[   27.377952] The buggy address belongs to the object at ffff8801ce19e640
[   27.377952]  which belongs to the cache kmalloc-256 of size 256
[   27.390579] The buggy address is located 40 bytes inside of
[   27.390579]  256-byte region [ffff8801ce19e640, ffff8801ce19e740)
[   27.402328] The buggy address belongs to the page:
[   27.407222] page:ffffea0007386780 count:1 mapcount:0 mapping:ffff8801ce19e000 index:0x0
[   27.415326] flags: 0x200000000000100(slab)
[   27.419527] raw: 0200000000000100 ffff8801ce19e000 0000000000000000 000000010000000c
[   27.427372] raw: ffffea00073877e0 ffffea000736a060 ffff8801dac007c0 0000000000000000
[   27.435214] page dumped because: kasan: bad access detected
[   27.440884] 
[   27.442475] Memory state around the buggy address:
[   27.447369]  ffff8801ce19e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   27.454699]  ffff8801ce19e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   27.462020] >ffff8801ce19e600: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   27.470005]                                                           ^
[   27.476722]  ffff8801ce19e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   27.484045]  ffff8801ce19e700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   27.491367] ==================================================================
[   27.498688] Disabling lock debugging due to kernel taint
[   27.504099] Kernel panic - not syncing: panic_on_warn set ...
[   27.504099] 
[   27.511425] CPU: 0 PID: 3098 Comm: syz-executor0 Tainted: G    B           4.14.0-rc3+ #24
[   27.519787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   27.529104] Call Trace:
[   27.531659]  dump_stack+0x194/0x257
[   27.535250]  ? arch_local_irq_restore+0x53/0x53
[   27.539886]  ? vprintk_default+0x28/0x30
[   27.543912]  ? __lock_acquire+0x3ff0/0x4620
[   27.548197]  panic+0x1e4/0x417
[   27.551356]  ? __warn+0x1d9/0x1d9
[   27.554775]  ? __lock_acquire+0x407b/0x4620
[   27.559060]  kasan_end_report+0x50/0x50
[   27.562996]  kasan_report+0x144/0x340
[   27.566760]  __asan_report_load8_noabort+0x14/0x20
[   27.571652]  __lock_acquire+0x407b/0x4620
[   27.575763]  ? unwind_dump+0x4c0/0x4c0
[   27.579612]  ? __kernel_text_address+0xd/0x40
[   27.584070]  ? unwind_get_return_address+0x61/0xa0
[   27.588966]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   27.594119]  ? __save_stack_trace+0x61/0xd0
[   27.598407]  ? get_signal+0x73f/0x16d0
[   27.602258]  ? save_stack_trace+0x16/0x20
[   27.606371]  ? __lock_acquire+0x20fd/0x4620
[   27.610658]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   27.615821]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   27.620981]  ? __bpf_address_lookup+0x2b0/0x2b0
[   27.625615]  ? osq_unlock+0x350/0x350
[   27.629380]  ? lock_release+0xd70/0xd70
[   27.633322]  ? __free_insn_slot+0x5c0/0x5c0
[   27.637608]  ? check_noncircular+0x20/0x20
[   27.641809]  ? is_bpf_text_address+0xa4/0x120
[   27.646277]  ? kernel_text_address+0x102/0x140
[   27.650826]  ? __kernel_text_address+0xd/0x40
[   27.655298]  ? find_held_lock+0x39/0x1d0
[   27.659326]  ? lock_downgrade+0x990/0x990
[   27.663438]  ? check_noncircular+0x20/0x20
[   27.667638]  ? save_stack+0x43/0xd0
[   27.671229]  ? kasan_kmalloc+0xad/0xe0
[   27.675082]  lock_acquire+0x1d5/0x580
[   27.678847]  ? exit_pi_state_list+0x369/0x7a0
[   27.683306]  ? lock_release+0xd70/0xd70
[   27.687242]  ? do_raw_spin_trylock+0x190/0x190
[   27.691787]  ? find_held_lock+0x39/0x1d0
[   27.695818]  _raw_spin_lock_irq+0x5e/0x80
[   27.699929]  ? exit_pi_state_list+0x369/0x7a0
[   27.704392]  exit_pi_state_list+0x369/0x7a0
[   27.708679]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[   27.714701]  ? lock_release+0xd70/0xd70