INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: INIT: Id "6" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "3" respawning too fast: disabled for 5 minutes Warning: Permanently added 'ci-android-49-kasan-gce-6,10.128.0.33' (ECDSA) to the list of known hosts. 2017/08/13 11:41:29 parsed 1 programs 2017/08/13 11:41:29 executed programs: 0 2017/08/13 11:41:34 executed programs: 375 [ 119.356204] ================================================================== [ 119.363569] BUG: KASAN: use-after-free in bio_copy_user_iov+0xe61/0xea0 at addr ffff8801cfc55000 [ 119.372458] Read of size 8 by task syz-executor3/5495 [ 119.377614] CPU: 1 PID: 5495 Comm: syz-executor3 Not tainted 4.9.42-g02f29ab #24 [ 119.385110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 119.394436] ffff8801d6bef4c0 ffffffff81d92909 ffff8801da0013c0 ffff8801cfc55000 [ 119.402411] ffff8801cfc55100 ffffed0039f8aa00 ffff8801cfc55000 ffff8801d6bef4e8 [ 119.410353] ffffffff8153c51c ffffed0039f8aa00 ffff8801da0013c0 0000000000000000 [ 119.418291] Call Trace: [ 119.420849] [] dump_stack+0xc1/0x128 [ 119.426176] [] kasan_object_err+0x1c/0x70 [ 119.431939] [] kasan_report.part.1+0x21c/0x500 [ 119.438135] [] ? bio_copy_user_iov+0xe61/0xea0 [ 119.444329] [] __asan_report_load8_noabort+0x29/0x30 [ 119.451044] [] bio_copy_user_iov+0xe61/0xea0 [ 119.457064] [] ? bio_uncopy_user+0x600/0x600 [ 119.463086] [] ? __sbitmap_queue_get+0xfb/0x230 [ 119.469368] [] ? __bt_get+0x199/0x1f0 [ 119.474781] [] blk_rq_map_user_iov+0x237/0x790 [ 119.480974] [] ? blk_rq_append_bio+0x1a0/0x1a0 [ 119.487169] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 119.494143] [] ? kvm_sched_clock_read+0x9/0x20 [ 119.500339] [] ? import_single_range+0x1d4/0x2b0 [ 119.506709] [] blk_rq_map_user+0x111/0x1a0 [ 119.512556] [] ? blk_rq_map_user_iov+0x790/0x790 [ 119.518926] [] ? sg_res_in_use+0x1f/0x130 [ 119.524685] [] ? sg_res_in_use+0xea/0x130 [ 119.530452] [] ? _raw_read_unlock_irqrestore+0x45/0x70 [ 119.537346] [] sg_common_write.isra.24+0xc1a/0x17c0 [ 119.543973] [] ? sg_open+0x15a0/0x15a0 [ 119.549473] [] ? __might_fault+0xe4/0x1d0 [ 119.555234] [] ? check_stack_object+0x68/0x140 [ 119.561449] [] ? __check_object_size+0x174/0x3a9 [ 119.567820] [] sg_write+0x688/0xad0 [ 119.573059] [] ? sg_ioctl+0x29f0/0x29f0 [ 119.578654] [] ? sock_alloc_inode+0x66/0x250 [ 119.584673] [] ? sock_alloc+0x41/0x270 [ 119.590170] [] ? __sock_create+0xa5/0x640 [ 119.595933] [] ? SyS_socket+0xf0/0x1b0 [ 119.601441] [] ? entry_SYSCALL_64_fastpath+0x23/0xc6 [ 119.608157] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 119.615134] [] ? do_futex+0x3e8/0x1640 [ 119.620632] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 119.627623] [] ? kasan_unpoison_shadow+0x35/0x50 [ 119.633996] [] ? kasan_kmalloc+0xad/0xe0 [ 119.639680] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 119.646652] [] ? sg_ioctl+0x29f0/0x29f0 [ 119.652240] [] __vfs_write+0x103/0x680 [ 119.657741] [] ? default_llseek+0x290/0x290 [ 119.663676] [] ? __might_sleep+0x95/0x1a0 [ 119.669440] [] ? __inode_security_revalidate+0xd9/0x130 [ 119.676421] [] ? avc_policy_seqno+0x9/0x20 [ 119.682275] [] ? selinux_file_permission+0x82/0x460 [ 119.688905] [] ? security_file_permission+0x89/0x1e0 [ 119.695628] [] ? rw_verify_area+0xe5/0x2b0 [ 119.701483] [] vfs_write+0x170/0x4e0 [ 119.706810] [] SyS_write+0xd9/0x1b0 [ 119.712051] [] ? SyS_read+0x1b0/0x1b0 [ 119.717465] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 119.724018] [] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 119.730561] Object at ffff8801cfc55000, in cache kmalloc-256 size: 256 [ 119.737185] Allocated: [ 119.739643] PID = 5500 [ 119.742106] save_stack_trace+0x16/0x20 [ 119.746044] save_stack+0x43/0xd0 [ 119.749462] kasan_kmalloc+0xad/0xe0 [ 119.753136] __kmalloc+0x11d/0x310 [ 119.756640] sg_build_indirect.isra.23+0x8b/0x550 [ 119.761564] sg_build_reserve+0x8d/0xb0 [ 119.765501] sg_open+0x946/0x15a0 [ 119.768915] chrdev_open+0x22b/0x4c0 [ 119.772591] do_dentry_open+0x607/0xc60 [ 119.776527] vfs_open+0x105/0x220 [ 119.779943] path_openat+0x64c/0x2a60 [ 119.783705] do_filp_open+0x197/0x290 [ 119.787470] do_sys_open+0x352/0x4c0 [ 119.791146] SyS_open+0x2d/0x40 [ 119.794391] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 119.799194] Freed: [ 119.801305] PID = 5500 [ 119.803767] save_stack_trace+0x16/0x20 [ 119.807703] save_stack+0x43/0xd0 [ 119.811119] kasan_slab_free+0x73/0xc0 [ 119.814970] kfree+0xf0/0x2f0 [ 119.818042] sg_remove_scat.isra.20+0x212/0x2d0 [ 119.822672] sg_ioctl+0x12d0/0x29f0 [ 119.826264] do_vfs_ioctl+0x1aa/0x10c0 [ 119.830117] SyS_ioctl+0x8f/0xc0 [ 119.833453] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 119.838170] Memory state around the buggy address: [ 119.843068] ffff8801cfc54f00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 119.850390] ffff8801cfc54f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 119.857717] >ffff8801cfc55000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 119.865037] ^ [ 119.868366] ffff8801cfc55080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 119.875695] ffff8801cfc55100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 119.883017] ================================================================== [ 119.891073] ================================================================== [ 119.898409] BUG: KASAN: wild-memory-access on address ffe708727bd00000 [ 119.905039] Write of size 2 by task syz-executor3/5495 [ 119.910278] CPU: 1 PID: 5495 Comm: syz-executor3 Tainted: G B 4.9.42-g02f29ab #24 [ 119.918989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 119.928310] ffff8801d6bef448 ffffffff81d92909 ffff8801d6bef618 0000000000000002 [ 119.936360] 0000000000000001 ffff8801d6bef840 ffe708727bd00000 ffff8801d6bef4d0 [ 119.944306] ffffffff8153c9cf 0000000000000000 0000000000000001 ffffffff81ddc1c4 [ 119.952248] Call Trace: [ 119.954804] [] dump_stack+0xc1/0x128 [ 119.960138] [] kasan_report.part.1+0x40f/0x500 [ 119.966352] [] ? copy_page_from_iter+0x1a4/0x5d0 [ 119.972808] [] ? __might_fault+0xe4/0x1d0 [ 119.978568] [] kasan_report+0x20/0x30 [ 119.983997] [] check_memory_region+0x137/0x190 [ 119.990191] [] kasan_check_write+0x14/0x20 [ 119.996038] [] copy_page_from_iter+0x1a4/0x5d0 [ 120.002232] [] bio_copy_user_iov+0xb05/0xea0 [ 120.008253] [] ? bio_uncopy_user+0x600/0x600 [ 120.014272] [] ? __bt_get+0x199/0x1f0 [ 120.019687] [] blk_rq_map_user_iov+0x237/0x790 [ 120.025881] [] ? blk_rq_append_bio+0x1a0/0x1a0 [ 120.032773] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 120.039749] [] ? kvm_sched_clock_read+0x9/0x20 [ 120.045944] [] ? import_single_range+0x1d4/0x2b0 [ 120.052314] [] blk_rq_map_user+0x111/0x1a0 [ 120.058162] [] ? blk_rq_map_user_iov+0x790/0x790 [ 120.064533] [] ? sg_res_in_use+0x1f/0x130 [ 120.070299] [] ? sg_res_in_use+0xea/0x130 [ 120.076066] [] ? _raw_read_unlock_irqrestore+0x45/0x70 [ 120.082954] [] sg_common_write.isra.24+0xc1a/0x17c0 [ 120.089583] [] ? sg_open+0x15a0/0x15a0 [ 120.095087] [] ? __might_fault+0xe4/0x1d0 [ 120.100846] [] ? check_stack_object+0x68/0x140 [ 120.107041] [] ? __check_object_size+0x174/0x3a9 [ 120.113408] [] sg_write+0x688/0xad0 [ 120.118649] [] ? sg_ioctl+0x29f0/0x29f0 [ 120.124238] [] ? sock_alloc_inode+0x66/0x250 [ 120.130266] [] ? sock_alloc+0x41/0x270 [ 120.135768] [] ? __sock_create+0xa5/0x640 [ 120.141529] [] ? SyS_socket+0xf0/0x1b0 [ 120.147030] [] ? entry_SYSCALL_64_fastpath+0x23/0xc6 [ 120.153756] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 120.160733] [] ? do_futex+0x3e8/0x1640 [ 120.166232] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 120.173209] [] ? kasan_unpoison_shadow+0x35/0x50 [ 120.179578] [] ? kasan_kmalloc+0xad/0xe0 [ 120.185254] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 120.192228] [] ? sg_ioctl+0x29f0/0x29f0 [ 120.197815] [] __vfs_write+0x103/0x680 [ 120.203316] [] ? default_llseek+0x290/0x290 [ 120.209249] [] ? __might_sleep+0x95/0x1a0 [ 120.215009] [] ? __inode_security_revalidate+0xd9/0x130 [ 120.221982] [] ? avc_policy_seqno+0x9/0x20 [ 120.227830] [] ? selinux_file_permission+0x82/0x460 [ 120.234470] [] ? security_file_permission+0x89/0x1e0 [ 120.241186] [] ? rw_verify_area+0xe5/0x2b0 [ 120.247030] [] vfs_write+0x170/0x4e0 [ 120.252356] [] SyS_write+0xd9/0x1b0 [ 120.257611] [] ? SyS_read+0x1b0/0x1b0 [ 120.263032] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 120.269580] [] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 120.276126] ================================================================== [ 120.284147] ================================================================== [ 120.291485] BUG: KASAN: wild-memory-access on address ffe708727bd00000 [ 120.298200] Write of size 2 by task syz-executor3/5495 [ 120.303441] CPU: 1 PID: 5495 Comm: syz-executor3 Tainted: G B 4.9.42-g02f29ab #24 [ 120.312150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 120.321472] ffff8801d6bef3f8 ffffffff81d92909 ffe708727bd00000 0000000000000002 [ 120.329411] 0000000000000001 00000000205cbf9f ffe708727bd00000 ffff8801d6bef480 [ 120.337352] ffffffff8153c9cf 0000000000000000 0000000000000000 ffffffff81dc6014 [ 120.345293] Call Trace: [ 120.347844] [] dump_stack+0xc1/0x128 [ 120.353173] [] kasan_report.part.1+0x40f/0x500