[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 12.622785] sshd (3022) used greatest stack depth: 15072 bytes left [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 34.384233] audit: type=1400 audit(1512812716.858:6): avc: denied { map } for pid=3138 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added 'ci-upstream-next-kasan-gce-4,10.128.0.31' (ECDSA) to the list of known hosts. executing program [ 40.463874] audit: type=1400 audit(1512812722.937:7): avc: denied { map } for pid=3150 comm="syzkaller945393" path="/root/syzkaller945393497" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 40.466865] ================================================================== [ 40.466881] BUG: KASAN: double-free or invalid-free in relay_open+0x6a1/0xa40 [ 40.466884] [ 40.466891] CPU: 0 PID: 3150 Comm: syzkaller945393 Not tainted 4.15.0-rc2-next-20171208+ #63 [ 40.466895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.466898] Call Trace: [ 40.466907] dump_stack+0x194/0x257 [ 40.466917] ? arch_local_irq_restore+0x53/0x53 [ 40.466926] ? show_regs_print_info+0x18/0x18 [ 40.466932] ? __lock_is_held+0xbc/0x140 [ 40.466944] ? relay_open+0x6a1/0xa40 [ 40.466953] print_address_description+0x73/0x250 [ 40.466959] ? relay_open+0x6a1/0xa40 [ 40.466964] ? relay_open+0x6a1/0xa40 [ 40.466971] kasan_report_double_free+0x55/0x80 [ 40.466979] kasan_slab_free+0xa3/0xc0 [ 40.466989] kfree+0xca/0x250 [ 40.466998] relay_open+0x6a1/0xa40 [ 40.467013] ? relay_open_buf.part.10+0x9b0/0x9b0 [ 40.467025] ? __debugfs_create_file+0x2cf/0x3d0 [ 40.467037] ? debugfs_create_file+0x57/0x70 [ 40.467050] do_blk_trace_setup+0x4a4/0xcd0 [ 40.467061] ? blk_tracer_print_line+0x40/0x40 [ 40.467069] ? __might_sleep+0x95/0x190 [ 40.467081] ? kasan_check_write+0x14/0x20 [ 40.467089] ? _copy_from_user+0x99/0x110 [ 40.467099] __blk_trace_setup+0xb6/0x140 [ 40.467106] ? do_blk_trace_setup+0xcd0/0xcd0 [ 40.467120] ? disk_name+0x98/0x100 [ 40.467135] blk_trace_ioctl+0x1d5/0x2a0 [ 40.467142] ? blk_add_trace_rq_remap+0x680/0x680 [ 40.467155] ? avc_has_extended_perms+0x7fa/0x12c0 [ 40.467165] blkdev_ioctl+0x1845/0x1e00 [ 40.467173] ? blkpg_ioctl+0xb20/0xb20 [ 40.467180] ? avc_ss_reset+0x110/0x110 [ 40.467192] ? lock_downgrade+0x980/0x980 [ 40.467213] ? down_read_trylock+0xdb/0x170 [ 40.467230] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 40.467235] ? up_read+0x1a/0x40 [ 40.467243] ? rcu_note_context_switch+0x710/0x710 [ 40.467255] block_ioctl+0xea/0x130 [ 40.467263] ? blkdev_fallocate+0x3b0/0x3b0 [ 40.467270] do_vfs_ioctl+0x1b1/0x1530 [ 40.467276] ? _cond_resched+0x14/0x30 [ 40.467287] ? ioctl_preallocate+0x2b0/0x2b0 [ 40.467296] ? selinux_capable+0x40/0x40 [ 40.467305] ? putname+0xf3/0x130 [ 40.467315] ? do_sys_open+0x320/0x6d0 [ 40.467330] ? security_file_ioctl+0x89/0xb0 [ 40.467340] SyS_ioctl+0x8f/0xc0 [ 40.467351] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 40.467357] RIP: 0033:0x443e59 [ 40.467361] RSP: 002b:00007ffd0e9e9a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [ 40.467368] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000443e59 [ 40.467372] RDX: 0000000020f74000 RSI: 00000000c0481273 RDI: 0000000000000003 [ 40.467375] RBP: 00000000006ce018 R08: 0000000000000000 R09: 0000000000000000 [ 40.467379] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000401b40 [ 40.467383] R13: 0000000000401bd0 R14: 0000000000000000 R15: 0000000000000000 [ 40.467402] [ 40.467405] Allocated by task 3150: [ 40.467410] save_stack+0x43/0xd0 [ 40.467415] kasan_kmalloc+0xad/0xe0 [ 40.467420] kmem_cache_alloc_trace+0x136/0x750 [ 40.467425] relay_open+0xf2/0xa40 [ 40.467429] do_blk_trace_setup+0x4a4/0xcd0 [ 40.467434] __blk_trace_setup+0xb6/0x140 [ 40.467439] blk_trace_ioctl+0x1d5/0x2a0 [ 40.467443] blkdev_ioctl+0x1845/0x1e00 [ 40.467447] block_ioctl+0xea/0x130 [ 40.467452] do_vfs_ioctl+0x1b1/0x1530 [ 40.467457] SyS_ioctl+0x8f/0xc0 [ 40.467462] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 40.467464] [ 40.467467] Freed by task 3150: [ 40.467471] save_stack+0x43/0xd0 [ 40.467475] kasan_slab_free+0x71/0xc0 [ 40.467480] kfree+0xca/0x250 [ 40.467485] relay_open+0x84a/0xa40 [ 40.467489] do_blk_trace_setup+0x4a4/0xcd0 [ 40.467494] __blk_trace_setup+0xb6/0x140 [ 40.467498] blk_trace_ioctl+0x1d5/0x2a0 [ 40.467503] blkdev_ioctl+0x1845/0x1e00 [ 40.467507] block_ioctl+0xea/0x130 [ 40.467512] do_vfs_ioctl+0x1b1/0x1530 [ 40.467516] SyS_ioctl+0x8f/0xc0 [ 40.467521] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 40.467524] [ 40.467528] The buggy address belongs to the object at ffff8801c4e50780 [ 40.467528] which belongs to the cache kmalloc-512 of size 512 [ 40.467533] The buggy address is located 0 bytes inside of [ 40.467533] 512-byte region [ffff8801c4e50780, ffff8801c4e50980) [ 40.467535] The buggy address belongs to the page: [ 40.467541] page:00000000b61a821a count:1 mapcount:0 mapping:0000000024c1219c index:0x0 [ 40.467547] flags: 0x2fffc0000000100(slab) [ 40.467555] raw: 02fffc0000000100 ffff8801c4e50000 0000000000000000 0000000100000006 [ 40.467565] raw: ffffea0007137060 ffffea0007137260 ffff8801dac00940 0000000000000000 [ 40.467569] page dumped because: kasan: bad access detected [ 40.467571] [ 40.467574] Memory state around the buggy address: [ 40.467578] ffff8801c4e50680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.467582] ffff8801c4e50700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.467586] >ffff8801c4e50780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.467589] ^ [ 40.467593] ffff8801c4e50800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.467597] ffff8801c4e50880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.467600] ================================================================== [ 40.467602] Disabling lock debugging due to kernel taint [ 40.467605] Kernel panic - not syncing: panic_on_warn set ... [ 40.467605] [ 40.467609] CPU: 0 PID: 3150 Comm: syzkaller945393 Tainted: G B 4.15.0-rc2-next-20171208+ #63 [ 40.467611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.467612] Call Trace: [ 40.467616] dump_stack+0x194/0x257 [ 40.467623] ? arch_local_irq_restore+0x53/0x53 [ 40.467628] ? vprintk_default+0x28/0x30 [ 40.467633] ? vsnprintf+0x1ed/0x1900 [ 40.467641] panic+0x1e4/0x41c [ 40.467645] ? refcount_error_report+0x214/0x214 [ 40.467652] ? add_taint+0x40/0x50 [ 40.467655] ? add_taint+0x1c/0x50 [ 40.467660] ? relay_open+0x6a1/0xa40 [ 40.467664] ? relay_open+0x6a1/0xa40 [ 40.467668] kasan_end_report+0x50/0x50 [ 40.467672] kasan_report_double_free+0x72/0x80 [ 40.467677] kasan_slab_free+0xa3/0xc0 [ 40.467682] kfree+0xca/0x250 [ 40.467688] relay_open+0x6a1/0xa40 [ 40.467695] ? relay_open_buf.part.10+0x9b0/0x9b0 [ 40.467700] ? __debugfs_create_file+0x2cf/0x3d0 [ 40.467707] ? debugfs_create_file+0x57/0x70 [ 40.467713] do_blk_trace_setup+0x4a4/0xcd0 [ 40.467720] ? blk_tracer_print_line+0x40/0x40 [ 40.467724] ? __might_sleep+0x95/0x190 [ 40.467731] ? kasan_check_write+0x14/0x20 [ 40.467734] ? _copy_from_user+0x99/0x110 [ 40.467741] __blk_trace_setup+0xb6/0x140 [ 40.467746] ? do_blk_trace_setup+0xcd0/0xcd0 [ 40.467753] ? disk_name+0x98/0x100 [ 40.467761] blk_trace_ioctl+0x1d5/0x2a0 [ 40.467766] ? blk_add_trace_rq_remap+0x680/0x680 [ 40.467772] ? avc_has_extended_perms+0x7fa/0x12c0 [ 40.467778] blkdev_ioctl+0x1845/0x1e00 [ 40.467783] ? blkpg_ioctl+0xb20/0xb20 [ 40.467787] ? avc_ss_reset+0x110/0x110 [ 40.467794] ? lock_downgrade+0x980/0x980 [ 40.467805] ? down_read_trylock+0xdb/0x170 [ 40.467815] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 40.467818] ? up_read+0x1a/0x40 [ 40.467823] ? rcu_note_context_switch+0x710/0x710 [ 40.467828] block_ioctl+0xea/0x130 [ 40.467833] ? blkdev_fallocate+0x3b0/0x3b0 [ 40.467837] do_vfs_ioctl+0x1b1/0x1530 [ 40.467840] ? _cond_resched+0x14/0x30 [ 40.467846] ? ioctl_preallocate+0x2b0/0x2b0 [ 40.467851] ? selinux_capable+0x40/0x40 [ 40.467856] ? putname+0xf3/0x130 [ 40.467862] ? do_sys_open+0x320/0x6d0 [ 40.467870] ? security_file_ioctl+0x89/0xb0 [ 40.467877] SyS_ioctl+0x8f/0xc0 [ 40.467883] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 40.467886] RIP: 0033:0x443e59 [ 40.467888] RSP: 002b:00007ffd0e9e9a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [ 40.467891] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000443e59 [ 40.467893] RDX: 0000000020f74000 RSI: 00000000c0481273 RDI: 0000000000000003 [ 40.467895] RBP: 00000000006ce018 R08: 0000000000000000 R09: 0000000000000000 [ 40.467898] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000401b40 [ 40.467900] R13: 0000000000401bd0 R14: 0000000000000000 R15: 0000000000000000 [ 40.489753] Dumping ftrace buffer: [ 40.489758] (ftrace buffer empty) [ 40.489759] Kernel Offset: disabled [ 41.269385] Rebooting in 86400 seconds..