serialport: Connected to syzkaller.us-central1-c.ci-upstream-kasan-gce-5 port 1 (session ID: 290b7ec161cd940e9e1ecace4a529c2e87072030d31b1470604c9f07740cc5a7, active connections: 1).
INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-5,10.128.0.16' (ECDSA) to the list of known hosts.
2017/08/01 13:38:45 parsed 1 programs
2017/08/01 13:38:45 executed programs: 0
syzkaller login: [   50.806248] kvm: KVM_SET_TSS_ADDR need to be called before entering vcpu
2017/08/01 13:38:50 executed programs: 311
[   56.057550] ==================================================================
[   56.065027] BUG: KASAN: use-after-free in irq_bypass_register_consumer+0x4b4/0x500
[   56.072725] Write of size 8 at addr ffff8801cca6c8e8 by task syz-executor1/4123
[   56.080142] 
[   56.081743] CPU: 1 PID: 4123 Comm: syz-executor1 Not tainted 4.13.0-rc3+ #13
[   56.088895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   56.098218] Call Trace:
[   56.100780]  dump_stack+0x194/0x257
[   56.104382]  ? arch_local_irq_restore+0x53/0x53
[   56.109024]  ? show_regs_print_info+0x65/0x65
[   56.113497]  ? irq_bypass_register_consumer+0x4b4/0x500
[   56.118831]  print_address_description+0x7f/0x260
[   56.123642]  ? irq_bypass_register_consumer+0x4b4/0x500
[   56.128976]  kasan_report+0x24e/0x340
[   56.132750]  __asan_report_store8_noabort+0x17/0x20
[   56.137732]  irq_bypass_register_consumer+0x4b4/0x500
[   56.142892]  ? __disconnect+0x1a0/0x1a0
[   56.146837]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   56.151822]  ? trace_hardirqs_on+0xd/0x10
[   56.155941]  ? queue_work_on+0x106/0x1c0
[   56.159975]  kvm_irqfd+0x137a/0x1d50
[   56.163675]  ? kvm_eventfd_init+0x2a0/0x2a0
[   56.167975]  ? __lock_acquire+0x6ef/0x3dc0
[   56.172186]  ? find_held_lock+0x35/0x1d0
[   56.176227]  ? __might_fault+0x110/0x1d0
[   56.180258]  ? lock_downgrade+0x990/0x990
[   56.184377]  ? lock_release+0xa40/0xa40
[   56.188320]  ? check_same_owner+0x320/0x320
[   56.192611]  ? drop_futex_key_refs.isra.12+0x63/0xb0
[   56.197693]  ? __might_sleep+0x95/0x190
[   56.201643]  ? kasan_check_write+0x14/0x20
[   56.205846]  ? _copy_from_user+0x99/0x110
[   56.209971]  kvm_vm_ioctl+0x1079/0x1c40
[   56.213919]  ? futex_wake+0x2ca/0x680
[   56.217693]  ? kvm_set_memory_region+0x50/0x50
[   56.222247]  ? get_futex_key+0x1cf0/0x1cf0
[   56.226450]  ? SyS_eventfd2+0x5f/0xb0
[   56.230220]  ? kasan_slab_alloc+0x12/0x20
[   56.234351]  ? check_noncircular+0x20/0x20
[   56.238556]  ? check_noncircular+0x20/0x20
[   56.242763]  ? do_futex+0x77f/0x1fd0
[   56.246449]  ? __pmd_alloc+0x4f0/0x4f0
[   56.250317]  ? find_held_lock+0x35/0x1d0
[   56.254359]  ? __fget+0x333/0x570
[   56.257781]  ? lock_downgrade+0x990/0x990
[   56.261901]  ? lock_release+0xa40/0xa40
[   56.265849]  ? __lock_is_held+0xb6/0x140
[   56.269895]  ? __fget+0x35c/0x570
[   56.273329]  ? iterate_fd+0x3f0/0x3f0
[   56.277100]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   56.281832]  ? retint_kernel+0x10/0x10
[   56.285697]  ? kvm_set_memory_region+0x50/0x50
[   56.290248]  do_vfs_ioctl+0x1b1/0x1520
[   56.294111]  ? ioctl_preallocate+0x2b0/0x2b0
[   56.298493]  ? selinux_capable+0x40/0x40
[   56.302530]  ? SyS_futex+0x285/0x380
[   56.306211]  ? SyS_futex+0x28e/0x380
[   56.309909]  ? security_file_ioctl+0x7d/0xb0
[   56.314283]  ? security_file_ioctl+0x89/0xb0
[   56.318664]  SyS_ioctl+0x8f/0xc0
[   56.322006]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   56.326732] RIP: 0033:0x4512c9
[   56.329889] RSP: 002b:00007f9eaeeddc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[   56.337568] RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004512c9
[   56.344805] RDX: 0000000020ae9000 RSI: 000000004020ae76 RDI: 0000000000000009
[   56.352042] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   56.359283] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b706a
[   56.366520] R13: 00000000ffffffff R14: 0000000020000000 R15: 0000000000afc000
[   56.373777] 
[   56.375372] Allocated by task 4123:
[   56.378970]  save_stack_trace+0x16/0x20
[   56.382914]  save_stack+0x43/0xd0
[   56.386333]  kasan_kmalloc+0xaa/0xd0
[   56.390020]  kmem_cache_alloc_trace+0x101/0x6f0
[   56.394662]  kvm_irqfd+0x16c/0x1d50
[   56.398257]  kvm_vm_ioctl+0x1079/0x1c40
[   56.402199]  do_vfs_ioctl+0x1b1/0x1520
[   56.406053]  SyS_ioctl+0x8f/0xc0
[   56.409387]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   56.414105] 
[   56.415701] Freed by task 1146:
[   56.418948]  save_stack_trace+0x16/0x20
[   56.422889]  save_stack+0x43/0xd0
[   56.426311]  kasan_slab_free+0x6e/0xc0
[   56.430164]  kfree+0xd3/0x260
[   56.433237]  irqfd_shutdown+0x13c/0x1a0
[   56.437178]  process_one_work+0xbf3/0x1bc0
[   56.441377]  worker_thread+0x223/0x1860
[   56.445322]  kthread+0x35e/0x430
[   56.448656]  ret_from_fork+0x2a/0x40
[   56.452333] 
[   56.453930] The buggy address belongs to the object at ffff8801cca6c780
[   56.453930]  which belongs to the cache kmalloc-512 of size 512
[   56.466553] The buggy address is located 360 bytes inside of
[   56.466553]  512-byte region [ffff8801cca6c780, ffff8801cca6c980)
[   56.478392] The buggy address belongs to the page:
[   56.483289] page:ffffea00064c47a0 count:1 mapcount:0 mapping:ffff8801cca6c000 index:0xffff8801cca6c280
[   56.492705] flags: 0x200000000000100(slab)
[   56.496911] raw: 0200000000000100 ffff8801cca6c000 ffff8801cca6c280 0000000100000005
[   56.504761] raw: ffffea00065c7e50 ffffea00064c4cc8 ffff8801dbc00600
[   56.511131] page dumped because: kasan: bad access detected
[   56.516804] 
[   56.518397] Memory state around the buggy address:
[   56.523293]  ffff8801cca6c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.530619]  ffff8801cca6c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.537946] >ffff8801cca6c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.545272]                                                           ^
[   56.551996]  ffff8801cca6c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   56.559326]  ffff8801cca6c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.566650] ==================================================================
[   56.573974] Disabling lock debugging due to kernel taint
[   56.579504] Kernel panic - not syncing: panic_on_warn set ...
[   56.579504] 
[   56.586847] CPU: 1 PID: 4123 Comm: syz-executor1 Tainted: G    B           4.13.0-rc3+ #13
[   56.595217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   56.604546] Call Trace:
[   56.607120]  dump_stack+0x194/0x257
[   56.610730]  ? arch_local_irq_restore+0x53/0x53
[   56.615373]  ? kasan_end_report+0x32/0x50
[   56.619490]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   56.624216]  ? irq_bypass_register_consumer+0x480/0x500
[   56.629547]  panic+0x1e4/0x417
[   56.632707]  ? __warn+0x1d9/0x1d9
[   56.636133]  ? irq_bypass_register_consumer+0x4b4/0x500
[   56.641464]  kasan_end_report+0x50/0x50
[   56.645403]  kasan_report+0x137/0x340
[   56.649174]  __asan_report_store8_noabort+0x17/0x20
[   56.654171]  irq_bypass_register_consumer+0x4b4/0x500
[   56.659327]  ? __disconnect+0x1a0/0x1a0
[   56.663269]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   56.668251]  ? trace_hardirqs_on+0xd/0x10
[   56.672364]  ? queue_work_on+0x106/0x1c0
[   56.676392]  kvm_irqfd+0x137a/0x1d50
[   56.680080]  ? kvm_eventfd_init+0x2a0/0x2a0
[   56.684372]  ? __lock_acquire+0x6ef/0x3dc0
[   56.688576]  ? find_held_lock+0x35/0x1d0
[   56.692609]  ? __might_fault+0x110/0x1d0
[   56.696638]  ? lock_downgrade+0x990/0x990
[   56.700752]  ? lock_release+0xa40/0xa40
[   56.704694]  ? check_same_owner+0x320/0x320
[   56.708981]  ? drop_futex_key_refs.isra.12+0x63/0xb0
[   56.714059]  ? __might_sleep+0x95/0x190
[   56.718008]  ? kasan_check_write+0x14/0x20
[   56.722210]  ? _copy_from_user+0x99/0x110
[   56.726326]  kvm_vm_ioctl+0x1079/0x1c40
[   56.730264]  ? futex_wake+0x2ca/0x680
[   56.734034]  ? kvm_set_memory_region+0x50/0x50
[   56.738583]  ? get_futex_key+0x1cf0/0x1cf0
[   56.742784]  ? SyS_eventfd2+0x5f/0xb0
[   56.746551]  ? kasan_slab_alloc+0x12/0x20
[   56.750672]  ? check_noncircular+0x20/0x20
[   56.754873]  ? check_noncircular+0x20/0x20
[   56.759080]  ? do_futex+0x77f/0x1fd0
[   56.762761]  ? __pmd_alloc+0x4f0/0x4f0
[   56.766620]  ? find_held_lock+0x35/0x1d0
[   56.770650]  ? __fget+0x333/0x570
[   56.774069]  ? lock_downgrade+0x990/0x990
[   56.778187]  ? lock_release+0xa40/0xa40
[   56.782130]  ? __lock_is_held+0xb6/0x140
[   56.786164]  ? __fget+0x35c/0x570
[   56.789587]  ? iterate_fd+0x3f0/0x3f0
[   56.793356]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   56.798084]  ? retint_kernel+0x10/0x10
[   56.801942]  ? kvm_set_memory_region+0x50/0x50
[   56.806491]  do_vfs_ioctl+0x1b1/0x1520
[   56.810349]  ? ioctl_preallocate+0x2b0/0x2b0
[   56.814726]  ? selinux_capable+0x40/0x40
[   56.818756]  ? SyS_futex+0x285/0x380
[   56.822437]  ? SyS_futex+0x28e/0x380
[   56.826124]  ? security_file_ioctl+0x7d/0xb0
[   56.830499]  ? security_file_ioctl+0x89/0xb0
[   56.834875]  SyS_ioctl+0x8f/0xc0
[   56.838213]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   56.842935] RIP: 0033:0x4512c9
[   56.846092] RSP: 002b:00007f9eaeeddc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[   56.853767] RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004512c9
[   56.861004] RDX: 0000000020ae9000 RSI: 000000004020ae76 RDI: 0000000000000009
[   56.868241] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   56.875477] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b706a
[   56.882713] R13: 00000000ffffffff R14: 0000000020000000 R15: 0000000000afc000
[   56.890446] Dumping ftrace buffer:
[   56.893958]    (ftrace buffer empty)
[   56.897634] Kernel Offset: disabled
[   56.901227] Rebooting in 86400 seconds..