INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-android-49-kasan-gce-5,10.128.0.27' (ECDSA) to the list of known hosts. 2017/10/06 04:00:10 parsed 1 programs 2017/10/06 04:00:10 executed programs: 0 syzkaller login: [ 48.990237] ================================================================== [ 48.991381] BUG: KASAN: use-after-free in __do_page_fault+0xc80/0xd70 at addr ffff8801c8807a00 [ 48.992837] Read of size 8 by task syz-executor7/6596 [ 48.993536] CPU: 0 PID: 6596 Comm: syz-executor7 Not tainted 4.9.53-g379e3b2 #59 [ 48.994547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.996047] ffff8801ca1d7d88 ffffffff81d93789 ffff8801da150140 ffff8801c88079b0 [ 48.997947] ffff8801c8807a68 ffffed0039100f40 ffff8801c8807a00 ffff8801ca1d7db0 [ 48.999189] ffffffff8153cfdc ffffed0039100f40 ffff8801da150140 0000000000000000 [ 49.000587] Call Trace: [ 49.000965] [] dump_stack+0xc1/0x128 [ 49.001743] [] kasan_object_err+0x1c/0x70 [ 49.002524] [] kasan_report.part.1+0x21c/0x500 [ 49.003359] [] ? __do_page_fault+0xc80/0xd70 [ 49.004193] [] __asan_report_load8_noabort+0x29/0x30 [ 49.005097] [] __do_page_fault+0xc80/0xd70 [ 49.005888] [] ? mm_fault_error+0x2c0/0x2c0 [ 49.006706] [] ? __task_pid_nr_ns+0x20e/0x450 [ 49.007546] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 49.008474] [] do_page_fault+0x27/0x30 [ 49.009219] [] page_fault+0x28/0x30 [ 49.009947] Object at ffff8801c88079b0, in cache vm_area_struct size: 184 [ 49.012321] Allocated: [ 49.014792] PID = 6596 [ 49.017272] save_stack_trace+0x16/0x20 [ 49.021222] save_stack+0x43/0xd0 [ 49.024673] kasan_kmalloc+0xad/0xe0 [ 49.028365] kasan_slab_alloc+0x12/0x20 [ 49.032316] kmem_cache_alloc+0xba/0x290 [ 49.036360] mmap_region+0x587/0xfd0 [ 49.040054] do_mmap+0x57b/0xbe0 [ 49.043402] vm_mmap_pgoff+0x16b/0x1b0 [ 49.047266] SyS_mmap_pgoff+0xd0/0x560 [ 49.051130] SyS_mmap+0x16/0x20 [ 49.054388] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 49.059114] Freed: [ 49.061241] PID = 6623 [ 49.063719] save_stack_trace+0x16/0x20 [ 49.067674] save_stack+0x43/0xd0 [ 49.071114] kasan_slab_free+0x73/0xc0 [ 49.074978] kmem_cache_free+0xb2/0x2e0 [ 49.078929] remove_vma+0x11d/0x160 [ 49.082535] do_munmap+0x7ff/0xeb0 [ 49.086055] mmap_region+0x14d/0xfd0 [ 49.089749] do_mmap+0x57b/0xbe0 [ 49.093103] vm_mmap_pgoff+0x16b/0x1b0 [ 49.096970] SyS_mmap_pgoff+0xd0/0x560 [ 49.100833] SyS_mmap+0x16/0x20 [ 49.104092] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 49.108818] Memory state around the buggy address: [ 49.113722] ffff8801c8807900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 49.121061] ffff8801c8807980: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb [ 49.128399] >ffff8801c8807a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 49.135735] ^ [ 49.139082] ffff8801c8807a80: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb [ 49.146414] ffff8801c8807b00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 49.153738] ==================================================================