INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-net-kasan-gce-9,10.128.0.50' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 41.948746] dev_remove_pack: ffff8801cb4a3480 not found executing program executing program executing program [ 42.005632] ================================================================== [ 42.013044] BUG: KASAN: use-after-free in fanout_demux_rollover+0x49b/0x4d0 [ 42.020114] Read of size 8 at addr ffff8801cb4a3430 by task syzkaller614050/4204 [ 42.027615] [ 42.029218] CPU: 0 PID: 4204 Comm: syzkaller614050 Not tainted 4.13.0+ #43 [ 42.036197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.045519] Call Trace: [ 42.048071] [ 42.050196] dump_stack+0x194/0x257 [ 42.053797] ? arch_local_irq_restore+0x53/0x53 [ 42.058440] ? show_regs_print_info+0x65/0x65 [ 42.062914] ? fanout_demux_rollover+0x49b/0x4d0 [ 42.067641] print_address_description+0x73/0x250 [ 42.072457] ? fanout_demux_rollover+0x49b/0x4d0 [ 42.077185] kasan_report+0x24e/0x340 [ 42.080961] __asan_report_load8_noabort+0x14/0x20 [ 42.085861] fanout_demux_rollover+0x49b/0x4d0 [ 42.090416] ? skb_split+0x1310/0x1310 [ 42.094287] packet_rcv_fanout+0x52e/0x7d0 [ 42.098497] ? compat_packet_setsockopt+0x140/0x140 [ 42.103501] ? refcount_add+0x60/0x60 [ 42.107275] ? packet_rcv_fanout+0x7d0/0x7d0 [ 42.111670] __netif_receive_skb_core+0xc12/0x33d0 [ 42.116572] ? __bpf_address_lookup+0x2b0/0x2b0 [ 42.121224] ? nf_ingress+0x9f0/0x9f0 [ 42.124997] ? unwind_dump+0x4c0/0x4c0 [ 42.128858] ? check_noncircular+0x20/0x20 [ 42.133076] ? check_noncircular+0x20/0x20 [ 42.137292] ? __kernel_text_address+0xae/0xe0 [ 42.141844] ? unwind_get_return_address+0x61/0xa0 [ 42.146748] ? __save_stack_trace+0x7e/0xd0 [ 42.151064] ? print_usage_bug+0x480/0x480 [ 42.155282] ? find_held_lock+0x39/0x1d0 [ 42.159327] ? lock_downgrade+0x990/0x990 [ 42.163445] ? alloc_set_pte+0x89a/0x18f0 [ 42.167570] ? lock_acquire+0x1d5/0x580 [ 42.171517] ? netif_receive_skb_internal+0x1d7/0x670 [ 42.176682] ? find_held_lock+0x39/0x1d0 [ 42.180724] ? pvclock_read_flags+0x160/0x160 [ 42.185192] ? mark_held_locks+0xb2/0x100 [ 42.189328] ? lock_acquire+0x1d5/0x580 [ 42.193283] ? netif_receive_skb_internal+0xa2/0x670 [ 42.198361] ? ktime_get_with_offset+0x2c1/0x420 [ 42.203092] ? lock_release+0xd70/0xd70 [ 42.207034] ? ktime_get+0x3a0/0x3a0 [ 42.210731] __netif_receive_skb+0x2c/0x1b0 [ 42.215022] ? __netif_receive_skb+0x2c/0x1b0 [ 42.219489] netif_receive_skb_internal+0x10b/0x670 [ 42.224476] ? dev_cpu_dead+0xb00/0xb00 [ 42.228422] ? __alloc_pages_nodemask+0xd80/0xd80 [ 42.233236] ? net_rx_action+0x1910/0x1910 [ 42.237444] ? __lock_is_held+0xbc/0x140 [ 42.241484] ? skb_gro_reset_offset+0x17b/0x300 [ 42.246128] napi_gro_receive+0x3d0/0x500 [ 42.250250] ? dev_gro_receive+0x19b0/0x19b0 [ 42.254634] ? eth_type_trans+0x2a3/0x650 [ 42.258756] ? eth_gro_receive+0x810/0x810 [ 42.262974] receive_buf+0xcc5/0x51f0 [ 42.266759] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 42.271315] ? print_usage_bug+0x480/0x480 [ 42.275532] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.280702] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 42.286555] ? complete+0x5f/0x80 [ 42.289976] ? complete+0x5f/0x80 [ 42.293403] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.298572] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 42.303563] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 42.308549] ? unwind_dump+0x4c0/0x4c0 [ 42.312410] ? unwind_dump+0x4c0/0x4c0 [ 42.316280] ? lock_downgrade+0x990/0x990 [ 42.320400] ? check_noncircular+0x20/0x20 [ 42.324615] ? __unwind_start+0x169/0x330 [ 42.328738] ? unwind_get_return_address+0x61/0xa0 [ 42.333637] ? __save_stack_trace+0x61/0xd0 [ 42.337935] ? complete+0x5f/0x80 [ 42.341365] ? save_stack_trace+0x16/0x20 [ 42.345483] ? __lock_acquire+0x20fd/0x4620 [ 42.349783] ? find_held_lock+0x39/0x1d0 [ 42.353824] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.358984] ? lock_downgrade+0x990/0x990 [ 42.363101] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 42.368101] ? pvclock_read_flags+0x160/0x160 [ 42.372568] ? lock_release+0xd70/0xd70 [ 42.376512] ? _find_next_bit+0xee/0x120 [ 42.380544] ? _find_next_bit+0xee/0x120 [ 42.384578] ? find_next_bit+0x27/0x30 [ 42.388443] ? select_task_rq_fair+0xe9e/0x3060 [ 42.393082] ? check_noncircular+0x20/0x20 [ 42.397293] ? irq_exit+0x1d3/0x210 [ 42.400903] ? check_noncircular+0x20/0x20 [ 42.405107] ? check_noncircular+0x20/0x20 [ 42.409317] ? check_noncircular+0x20/0x20 [ 42.413524] ? __lock_is_held+0xbc/0x140 [ 42.417555] ? check_noncircular+0x20/0x20 [ 42.421776] ? find_held_lock+0x39/0x1d0 [ 42.425820] ? lock_downgrade+0x990/0x990 [ 42.429936] ? lock_downgrade+0x990/0x990 [ 42.434061] ? check_noncircular+0x20/0x20 [ 42.438269] ? vring_use_dma_api+0x7f/0xa0 [ 42.442476] ? vring_unmap_one+0x49/0x3d0 [ 42.446598] ? detach_buf+0x463/0x6a0 [ 42.450369] ? print_usage_bug+0x480/0x480 [ 42.454585] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 42.459313] ? common_interrupt+0x9d/0x9d [ 42.463435] ? detach_buf+0x6a0/0x6a0 [ 42.467209] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 42.472202] virtnet_poll+0x304/0xad0 [ 42.475985] ? receive_buf+0x51f0/0x51f0 [ 42.480016] ? unwind_dump+0x4c0/0x4c0 [ 42.483879] ? mark_held_locks+0xb2/0x100 [ 42.488000] ? net_rx_action+0x49b/0x1910 [ 42.492124] net_rx_action+0x792/0x1910 [ 42.496086] ? napi_complete_done+0x6c0/0x6c0 [ 42.500549] ? save_stack_trace+0x16/0x20 [ 42.504668] ? __lock_acquire+0x20fd/0x4620 [ 42.509056] ? rcu_pm_notify+0xc0/0xc0 [ 42.512924] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.518088] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.523264] ? __lock_is_held+0xbc/0x140 [ 42.527313] ? rcu_read_lock_sched_held+0x108/0x120 [ 42.532305] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 42.537117] ? raise_softirq+0x490/0x490 [ 42.541151] ? lock_downgrade+0x990/0x990 [ 42.545273] ? print_usage_bug+0x480/0x480 [ 42.549480] ? lock_acquire+0x1d5/0x580 [ 42.553429] ? clockevents_program_event+0x163/0x2e0 [ 42.558508] ? trace_hardirqs_off+0xd/0x10 [ 42.562714] ? __napi_schedule+0x25e/0x370 [ 42.566923] ? netdev_info+0x170/0x170 [ 42.570779] ? check_noncircular+0x20/0x20 [ 42.574985] ? rcu_pm_notify+0xc0/0xc0 [ 42.578845] ? check_noncircular+0x20/0x20 [ 42.583052] ? __lock_is_held+0xbc/0x140 [ 42.587095] ? rcu_read_lock_sched_held+0x108/0x120 [ 42.592094] ? __handle_irq_event_percpu+0x308/0x9d0 [ 42.597176] ? __lock_is_held+0xbc/0x140 [ 42.601235] __do_softirq+0x2bb/0xbd0 [ 42.605021] ? __softirqentry_text_start+0x8/0x8 [ 42.609751] ? do_raw_spin_trylock+0x190/0x190 [ 42.614302] ? handle_irq_event_percpu+0x141/0x1b0 [ 42.619204] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 42.624289] ? _raw_spin_lock+0x32/0x40 [ 42.628237] ? _raw_spin_unlock+0x22/0x30 [ 42.632357] ? handle_edge_irq+0x2b4/0x7c0 [ 42.636579] irq_exit+0x1d3/0x210 [ 42.640009] do_IRQ+0xf6/0x190 [ 42.643179] common_interrupt+0x9d/0x9d [ 42.647125] [ 42.649337] RIP: 0010:lock_acquire+0x256/0x580 [ 42.653886] RSP: 0000:ffff8801cb90f018 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff6e [ 42.661567] RAX: dffffc0000000000 RBX: ffff8801ce576280 RCX: 0000000000000000 [ 42.668810] RDX: 1ffffffff0b592fd RSI: 000000006b208cd2 RDI: 0000000000000282 [ 42.676050] RBP: ffff8801cb90f110 R08: 0000000000000000 R09: 0000000000000001 [ 42.683300] R10: 0000000000000000 R11: ffffffff87060ca0 R12: 1ffff10039721e09 [ 42.690544] R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000 [ 42.697811] ? lock_release+0xd70/0xd70 [ 42.701766] ? rcutorture_record_progress+0x10/0x10 [ 42.706766] lock_page_memcg+0x8f/0x3b0 [ 42.710712] ? __mem_cgroup_largest_soft_limit_node+0x780/0x780 [ 42.716747] ? __mem_cgroup_largest_soft_limit_node+0x780/0x780 [ 42.722791] page_add_file_rmap+0xef/0xa90 [ 42.727000] ? page_add_new_anon_rmap+0x750/0x750 [ 42.731836] ? lock_acquire+0x1d5/0x580 [ 42.735783] ? alloc_set_pte+0x1162/0x18f0 [ 42.739995] ? lock_release+0xd70/0xd70 [ 42.743947] ? idr_preload+0x30/0x30 [ 42.747643] alloc_set_pte+0x89a/0x18f0 [ 42.751601] ? do_swap_page+0x29e0/0x29e0 [ 42.755723] ? unlock_page+0x19f/0x270 [ 42.759586] ? __lock_is_held+0xbc/0x140 [ 42.763630] filemap_map_pages+0x1080/0x15d0 [ 42.768011] ? is_bpf_text_address+0x7b/0x120 [ 42.772487] ? find_get_entries_tag+0xeb0/0xeb0 [ 42.777134] ? __lock_acquire+0x732/0x4620 [ 42.781339] ? __lock_acquire+0x732/0x4620 [ 42.785547] ? __free_insn_slot+0x5c0/0x5c0 [ 42.789842] ? unwind_dump+0x4c0/0x4c0 [ 42.793715] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.798877] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.804036] ? unwind_get_return_address+0x61/0xa0 [ 42.809193] ? __save_stack_trace+0x7e/0xd0 [ 42.813514] ? save_stack_trace+0x16/0x20 [ 42.817638] ? __lock_acquire+0x20fd/0x4620 [ 42.821951] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 42.827130] ? check_noncircular+0x20/0x20 [ 42.831357] __handle_mm_fault+0x1f57/0x39c0 [ 42.835744] ? __pmd_alloc+0x4e0/0x4e0 [ 42.839613] ? lock_downgrade+0x990/0x990 [ 42.843732] ? check_noncircular+0x20/0x20 [ 42.847954] ? __lock_is_held+0xbc/0x140 [ 42.852016] handle_mm_fault+0x334/0x8d0 [ 42.856049] ? down_read_trylock+0xdb/0x170 [ 42.860344] ? __do_page_fault+0x2b8/0xb60 [ 42.864551] ? __handle_mm_fault+0x39c0/0x39c0 [ 42.869109] ? vmacache_find+0x61/0x270 [ 42.873056] ? vmacache_update+0xfe/0x130 [ 42.877180] ? find_vma+0x30/0x150 [ 42.880696] __do_page_fault+0x4f6/0xb60 [ 42.884741] do_page_fault+0xee/0x720 [ 42.888516] ? _raw_spin_unlock_irq+0x27/0x70 [ 42.892986] ? __do_page_fault+0xb60/0xb60 [ 42.897194] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 42.902183] ? lockdep_sys_exit+0x47/0xf0 [ 42.906305] ? syscall_return_slowpath+0x2b3/0x500 [ 42.911206] ? finish_task_switch+0x1aa/0x740 [ 42.915677] ? prepare_exit_to_usermode+0x2c0/0x2c0 [ 42.920669] ? ret_from_fork+0x1a/0x40 [ 42.924535] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 42.929356] page_fault+0x22/0x30 [ 42.932780] RIP: 0033:0x407275 [ 42.935942] RSP: 002b:00007fdf2a2a8dd8 EFLAGS: 00010206 [ 42.941282] RAX: 00000000006dba00 RBX: 00007fdf2a2a9700 RCX: ffffffffffffffe8 [ 42.948523] RDX: 00000000004b5360 RSI: 00007fdf2a2a8e70 RDI: 00007fdf2a2a9700 [ 42.955765] RBP: 0000000000000000 R08: 00007fdf2a2a9700 R09: 00007fdf2a2a9700 [ 42.963008] R10: 00007fdf2a2a99d0 R11: 0000000000000202 R12: 0000000000000000 [ 42.970250] R13: 00007fffff18df0f R14: 00007fdf2a2a99c0 R15: 0000000000000000 [ 42.977508] [ 42.979108] Allocated by task 4184: [ 42.982708] save_stack_trace+0x16/0x20 [ 42.986660] save_stack+0x43/0xd0 [ 42.990085] kasan_kmalloc+0xad/0xe0 [ 42.993767] __kmalloc+0x162/0x760 [ 42.997283] sk_prot_alloc+0x101/0x2a0 [ 43.001140] sk_alloc+0x89/0x700 [ 43.004478] packet_create+0x169/0xb00