INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-0,10.128.15.220' (ECDSA) to the list of known hosts.
2017/10/04 11:31:35 parsed 1 programs
2017/10/04 11:31:35 executed programs: 0
syzkaller login: [   36.638934] ==================================================================
[   36.646350] BUG: KASAN: use-after-free in __lock_acquire+0x407b/0x4620
[   36.652997] Read of size 8 at addr ffff8801ca6ed168 by task syz-executor4/4232
[   36.660331] 
[   36.661934] CPU: 0 PID: 4232 Comm: syz-executor4 Not tainted 4.14.0-rc3+ #24
[   36.669095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   36.678424] Call Trace:
[   36.680983]  dump_stack+0x194/0x257
[   36.684582]  ? arch_local_irq_restore+0x53/0x53
[   36.689218]  ? show_regs_print_info+0x65/0x65
[   36.693679]  ? __kernel_text_address+0xd/0x40
[   36.698143]  ? __lock_acquire+0x407b/0x4620
[   36.702434]  print_address_description+0x73/0x250
[   36.707251]  ? __lock_acquire+0x407b/0x4620
[   36.711545]  kasan_report+0x25b/0x340
[   36.715319]  __asan_report_load8_noabort+0x14/0x20
[   36.720220]  __lock_acquire+0x407b/0x4620
[   36.724357]  ? unwind_dump+0x4c0/0x4c0
[   36.728218]  ? __kernel_text_address+0xd/0x40
[   36.732687]  ? unwind_get_return_address+0x61/0xa0
[   36.737589]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   36.742751]  ? __save_stack_trace+0x61/0xd0
[   36.747057]  ? get_signal+0x73f/0x16d0
[   36.750921]  ? save_stack_trace+0x16/0x20
[   36.755054]  ? __lock_acquire+0x20fd/0x4620
[   36.759353]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   36.764529]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   36.769690]  ? save_stack_trace+0x16/0x20
[   36.773809]  ? __lock_acquire+0x20fd/0x4620
[   36.778102]  ? osq_unlock+0x350/0x350
[   36.781868]  ? save_stack_trace+0x16/0x20
[   36.785990]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   36.791160]  ? check_noncircular+0x20/0x20
[   36.795366]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   36.800523]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   36.805683]  ? save_stack_trace+0x16/0x20
[   36.809806]  ? __lock_acquire+0x20fd/0x4620
[   36.814104]  ? compat_start_thread+0x80/0x80
[   36.818488]  ? find_held_lock+0x39/0x1d0
[   36.822518]  ? lock_downgrade+0x990/0x990
[   36.826635]  ? check_noncircular+0x20/0x20
[   36.830843]  lock_acquire+0x1d5/0x580
[   36.834610]  ? exit_pi_state_list+0x369/0x7a0
[   36.839074]  ? lock_release+0xd70/0xd70
[   36.843020]  ? do_raw_spin_trylock+0x190/0x190
[   36.847572]  ? find_held_lock+0x39/0x1d0
[   36.851605]  _raw_spin_lock_irq+0x5e/0x80
[   36.855718]  ? exit_pi_state_list+0x369/0x7a0
[   36.860178]  exit_pi_state_list+0x369/0x7a0
[   36.864468]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[   36.870503]  ? lock_release+0xd70/0xd70
[   36.874449]  ? check_same_owner+0x320/0x320
[   36.878741]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[   36.883820]  ? __might_sleep+0x95/0x190
[   36.887771]  ? __might_fault+0x188/0x1d0
[   36.891810]  ? do_raw_spin_trylock+0x190/0x190
[   36.896366]  mm_release+0x46d/0x590
[   36.899962]  ? do_raw_spin_trylock+0x190/0x190
[   36.904511]  ? mm_access+0x140/0x140
[   36.908201]  ? _raw_spin_unlock_irq+0x27/0x70
[   36.912677]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   36.917665]  ? trace_hardirqs_on+0xd/0x10
[   36.921785]  ? _raw_spin_unlock_irq+0x27/0x70
[   36.926247]  ? acct_collect+0x637/0x800
[   36.930199]  do_exit+0x481/0x1af0
[   36.933630]  ? do_raw_spin_trylock+0x190/0x190
[   36.938185]  ? mm_update_next_owner+0x930/0x930
[   36.942824]  ? futex_wake+0x680/0x680
[   36.946603]  ? memset+0x31/0x40
[   36.949856]  ? hrtimer_cancel+0x2e/0x40
[   36.953802]  ? futex_wait_requeue_pi.constprop.19+0x8a8/0x1300
[   36.959744]  ? lock_downgrade+0x990/0x990
[   36.963860]  ? check_noncircular+0x20/0x20
[   36.968064]  ? __lock_is_held+0xbc/0x140
[   36.972099]  ? find_held_lock+0x39/0x1d0
[   36.976132]  ? lock_downgrade+0x990/0x990
[   36.980247]  ? recalc_sigpending_tsk+0x117/0x150
[   36.984970]  ? recalc_sigpending+0x103/0x160
[   36.989344]  ? recalc_sigpending_tsk+0x150/0x150
[   36.994065]  ? get_signal+0x2b2/0x16d0
[   36.997921]  do_group_exit+0x149/0x400
[   37.001789]  ? __lock_is_held+0xbc/0x140
[   37.005815]  ? SyS_exit+0x30/0x30
[   37.009242]  ? _raw_spin_unlock_irq+0x27/0x70
[   37.013710]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   37.018698]  get_signal+0x73f/0x16d0
[   37.022392]  ? ptrace_notify+0x130/0x130
[   37.026431]  ? __schedule+0x8f3/0x2080
[   37.030301]  ? __sched_text_start+0x8/0x8
[   37.034424]  ? userfaultfd_unmap_complete+0x327/0x510
[   37.039598]  do_signal+0x94/0x1ee0
[   37.043112]  ? do_mmap+0x34f/0xd50
[   37.046629]  ? up_write+0x6b/0x120
[   37.050152]  ? setup_sigcontext+0x7d0/0x7d0
[   37.054449]  ? security_mmap_file+0x143/0x180
[   37.058928]  ? schedule+0xf5/0x430
[   37.062446]  ? vm_mmap_pgoff+0x13b/0x280
[   37.066486]  ? __schedule+0x2080/0x2080
[   37.070433]  ? vma_is_stack_for_current+0xa0/0xa0
[   37.075248]  ? find_held_lock+0x39/0x1d0
[   37.079286]  ? __compat_get_timespec+0xd9/0x120
[   37.083936]  ? exit_to_usermode_loop+0x8c/0x310
[   37.088580]  exit_to_usermode_loop+0x214/0x310
[   37.093134]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   37.098649]  ? lock_acquire+0x1d5/0x580
[   37.102597]  ? do_fast_syscall_32+0x158/0xf05
[   37.107071]  do_fast_syscall_32+0x83e/0xf05
[   37.111371]  ? compat_start_thread+0x80/0x80
[   37.115751]  ? do_int80_syscall_32+0x940/0x940
[   37.120306]  ? lockdep_sys_exit+0x47/0xf0
[   37.124421]  ? syscall_return_slowpath+0x2b3/0x510
[   37.129326]  ? finish_task_switch+0x1aa/0x740
[   37.133802]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   37.138794]  ? sysret32_from_system_call+0x5/0x3b
[   37.143605]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   37.148416]  entry_SYSENTER_compat+0x51/0x60
[   37.152788] RIP: 0023:0xf7fdfc79
[   37.156117] RSP: 002b:00000000f7fdb05c EFLAGS: 00000296 ORIG_RAX: 00000000000000f0
[   37.163799] RAX: 0000000000000000 RBX: 000000002000cffc RCX: 000000000000000b
[   37.171053] RDX: 0000000000000004 RSI: 0000000020564000 RDI: 0000000020048000
[   37.178309] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   37.185574] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   37.192829] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   37.200084] 
[   37.201690] Allocated by task 4257:
[   37.205302]  save_stack_trace+0x16/0x20
[   37.209262]  save_stack+0x43/0xd0
[   37.212693]  kasan_kmalloc+0xad/0xe0
[   37.216376]  kmem_cache_alloc_trace+0x136/0x750
[   37.221016]  refill_pi_state_cache.part.6+0xa5/0x2f0
[   37.226097]  futex_requeue+0x1887/0x2370
[   37.230133]  do_futex+0x7f5/0x20d0
[   37.233656]  compat_SyS_futex+0x27f/0x380
[   37.237788]  do_fast_syscall_32+0x3f2/0xf05
[   37.242092]  entry_SYSENTER_compat+0x51/0x60
[   37.246476] 
[   37.248103] Freed by task 4246:
[   37.251360]  save_stack_trace+0x16/0x20
[   37.255303]  save_stack+0x43/0xd0
[   37.258720]  kasan_slab_free+0x71/0xc0
[   37.262582]  kfree+0xca/0x250
[   37.265671]  put_pi_state+0x3f4/0x560
[   37.269446]  unqueue_me_pi+0x4a/0xc0
[   37.273129]  futex_wait_requeue_pi.constprop.19+0xc7f/0x1300
[   37.278891]  do_futex+0x825/0x20d0
[   37.282407]  compat_SyS_futex+0x27f/0x380
[   37.286539]  do_fast_syscall_32+0x3f2/0xf05
[   37.290835]  entry_SYSENTER_compat+0x51/0x60
[   37.295214] 
[   37.296810] The buggy address belongs to the object at ffff8801ca6ed140
[   37.296810]  which belongs to the cache kmalloc-256 of size 256
[   37.309438] The buggy address is located 40 bytes inside of
[   37.309438]  256-byte region [ffff8801ca6ed140, ffff8801ca6ed240)
[   37.321197] The buggy address belongs to the page:
[   37.326094] page:ffffea000729bb40 count:1 mapcount:0 mapping:ffff8801ca6ed000 index:0x0
[   37.334203] flags: 0x200000000000100(slab)
[   37.338403] raw: 0200000000000100 ffff8801ca6ed000 0000000000000000 000000010000000c
[   37.346248] raw: ffffea000729ee20 ffffea0007287120 ffff8801dac007c0 0000000000000000
[   37.354089] page dumped because: kasan: bad access detected
[   37.359761] 
[   37.361352] Memory state around the buggy address:
[   37.366244]  ffff8801ca6ed000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   37.373575]  ffff8801ca6ed080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   37.380898] >ffff8801ca6ed100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   37.388219]                                                           ^
[   37.394937]  ffff8801ca6ed180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   37.402258]  ffff8801ca6ed200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   37.409577] ==================================================================
[   37.416897] Disabling lock debugging due to kernel taint
[   37.422309] Kernel panic - not syncing: panic_on_warn set ...
[   37.422309] 
[   37.429634] CPU: 0 PID: 4232 Comm: syz-executor4 Tainted: G    B           4.14.0-rc3+ #24
[   37.437999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   37.447326] Call Trace:
[   37.449882]  dump_stack+0x194/0x257
[   37.453475]  ? arch_local_irq_restore+0x53/0x53
[   37.458113]  ? vprintk_default+0x28/0x30
[   37.462140]  ? __lock_acquire+0x3ff0/0x4620
[   37.466430]  panic+0x1e4/0x417
[   37.469589]  ? __warn+0x1d9/0x1d9
[   37.473016]  ? __lock_acquire+0x407b/0x4620
[   37.477308]  kasan_end_report+0x50/0x50
[   37.481244]  kasan_report+0x144/0x340
[   37.485015]  __asan_report_load8_noabort+0x14/0x20
[   37.489918]  __lock_acquire+0x407b/0x4620
[   37.494033]  ? unwind_dump+0x4c0/0x4c0
[   37.497908]  ? __kernel_text_address+0xd/0x40
[   37.502366]  ? unwind_get_return_address+0x61/0xa0
[   37.507262]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   37.512417]  ? __save_stack_trace+0x61/0xd0
[   37.516703]  ? get_signal+0x73f/0x16d0
[   37.520554]  ? save_stack_trace+0x16/0x20
[   37.524684]  ? __lock_acquire+0x20fd/0x4620
[   37.528971]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   37.534128]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   37.539286]  ? save_stack_trace+0x16/0x20
[   37.543396]  ? __lock_acquire+0x20fd/0x4620
[   37.547680]  ? osq_unlock+0x350/0x350
[   37.551443]  ? save_stack_trace+0x16/0x20
[   37.555556]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   37.560710]  ? check_noncircular+0x20/0x20
[   37.564917]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   37.570074]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   37.575230]  ? save_stack_trace+0x16/0x20
[   37.579342]  ? __lock_acquire+0x20fd/0x4620
[   37.583629]  ? compat_start_thread+0x80/0x80
[   37.588003]  ? find_held_lock+0x39/0x1d0
[   37.592041]  ? lock_downgrade+0x990/0x990
[   37.596151]  ? check_noncircular+0x20/0x20
[   37.600351]  lock_acquire+0x1d5/0x580
[   37.604119]  ? exit_pi_state_list+0x369/0x7a0
[   37.608580]  ? lock_release+0xd70/0xd70
[   37.612520]  ? do_raw_spin_trylock+0x190/0x190
[   37.617067]  ? find_held_lock+0x39/0x1d0
[   37.621100]  _raw_spin_lock_irq+0x5e/0x80
[   37.625212]  ? exit_pi_state_list+0x369/0x7a0
[   37.629672]  exit_pi_state_list+0x369/0x7a0
[   37.633963]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[   37.639987]  ? lock_release+0xd70/0xd70
[   37.643927]  ? check_same_owner+0x320/0x320
[   37.648214]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[   37.653282]  ? __might_sleep+0x95/0x190
[   37.657221]  ? __might_fault+0x188/0x1d0
[   37.661248]  ? do_raw_spin_trylock+0x190/0x190
[   37.665804]  mm_release+0x46d/0x590
[   37.669397]  ? do_raw_spin_trylock+0x190/0x190
[   37.673945]  ? mm_access+0x140/0x140
[   37.677621]  ? _raw_spin_unlock_irq+0x27/0x70
[   37.682082]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   37.687062]  ? trace_hardirqs_on+0xd/0x10
[   37.691173]  ? _raw_spin_unlock_irq+0x27/0x70
[   37.695632]  ? acct_collect+0x637/0x800
[   37.699569]  do_exit+0x481/0x1af0
[   37.702998]  ? do_raw_spin_trylock+0x190/0x190
[   37.707556]  ? mm_update_next_owner+0x930/0x930
[   37.712191]  ? futex_wake+0x680/0x680
[   37.715961]  ? memset+0x31/0x40
[   37.719208]  ? hrtimer_cancel+0x2e/0x40
[   37.723147]  ? futex_wait_requeue_pi.constprop.19+0x8a8/0x1300
[   37.729172]  ? lock_downgrade+0x990/0x990
[   37.733285]  ? check_noncircular+0x20/0x20
[   37.737484]  ? __lock_is_held+0xbc/0x140
[   37.741513]  ? find_held_lock+0x39/0x1d0
[   37.745539]  ? lock_downgrade+0x990/0x990
[   37.749651]  ? recalc_sigpending_tsk+0x117/0x150
[   37.754371]  ? recalc_sigpending+0x103/0x160
[   37.758742]  ? recalc_sigpending_tsk+0x150/0x150
[   37.763461]  ? get_signal+0x2b2/0x16d0
[   37.767314]  do_group_exit+0x149/0x400
[   37.771167]  ? __lock_is_held+0xbc/0x140
[   37.775190]  ? SyS_exit+0x30/0x30
[   37.778609]  ? _raw_spin_unlock_irq+0x27/0x70
[   37.783069]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   37.788050]  get_signal+0x73f/0x16d0