INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-4,10.128.0.43' (ECDSA) to the list of known hosts.
2017/09/30 03:17:03 parsed 1 programs
2017/09/30 03:17:03 executed programs: 0
syzkaller login: [   34.648886] ==================================================================
[   34.650003] BUG: KASAN: use-after-free in __lock_acquire+0x407b/0x4620
[   34.650918] Read of size 8 at addr ffff8801cdf067a8 by task syz-executor1/3091
[   34.651913] 
[   34.652144] CPU: 0 PID: 3091 Comm: syz-executor1 Not tainted 4.14.0-rc2-next-20170929+ #32
[   34.653256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   34.654501] Call Trace:
[   34.654859]  dump_stack+0x194/0x257
[   34.655352]  ? arch_local_irq_restore+0x53/0x53
[   34.655972]  ? show_regs_print_info+0x65/0x65
[   34.656571]  ? __kernel_text_address+0xd/0x40
[   34.657170]  ? __lock_acquire+0x407b/0x4620
[   34.657764]  print_address_description+0x73/0x250
[   34.658406]  ? __lock_acquire+0x407b/0x4620
[   34.659029]  kasan_report+0x25b/0x340
[   34.659539]  __asan_report_load8_noabort+0x14/0x20
[   34.660190]  __lock_acquire+0x407b/0x4620
[   34.660744]  ? unwind_dump+0x4c0/0x4c0
[   34.661261]  ? __unwind_start+0x169/0x330
[   34.661830]  ? __kernel_text_address+0xd/0x40
[   34.662427]  ? unwind_get_return_address+0x61/0xa0
[   34.663084]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   34.663810]  ? unwind_get_return_address+0x61/0xa0
[   34.664465]  ? __save_stack_trace+0x61/0xd0
[   34.665042]  ? get_signal+0x73f/0x16d0
[   34.665561]  ? save_stack_trace+0x16/0x20
[   34.666113]  ? __lock_acquire+0x20fd/0x4620
[   34.666691]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   34.667380]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   34.668096]  ? save_stack_trace+0x16/0x20
[   34.668665]  ? __lock_acquire+0x20fd/0x4620
[   34.670694]  ? osq_unlock+0x350/0x350
[   34.674457]  ? perf_trace_lock+0xf1/0x860
[   34.678567]  ? check_noncircular+0x20/0x20
[   34.682765]  ? check_noncircular+0x20/0x20
[   34.686964]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   34.692117]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   34.697272]  ? __lock_is_held+0xbc/0x140
[   34.701296]  ? perf_trace_lock+0xf1/0x860
[   34.705408]  ? find_held_lock+0x39/0x1d0
[   34.709434]  ? lock_downgrade+0x990/0x990
[   34.713545]  ? check_noncircular+0x20/0x20
[   34.717741]  lock_acquire+0x1d5/0x580
[   34.721506]  ? exit_pi_state_list+0x369/0x7a0
[   34.725966]  ? lock_release+0xd70/0xd70
[   34.729903]  ? do_raw_spin_trylock+0x190/0x190
[   34.734448]  ? find_held_lock+0x39/0x1d0
[   34.738479]  _raw_spin_lock_irq+0x5e/0x80
[   34.742588]  ? exit_pi_state_list+0x369/0x7a0
[   34.747046]  exit_pi_state_list+0x369/0x7a0
[   34.751334]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[   34.757355]  ? lock_release+0xd70/0xd70
[   34.761295]  ? trace_event_raw_event_sched_switch+0x770/0x770
[   34.767142]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[   34.772215]  ? __might_sleep+0x95/0x190
[   34.776155]  ? __might_fault+0x188/0x1d0
[   34.780179]  ? do_raw_spin_trylock+0x190/0x190
[   34.784728]  mm_release+0x46d/0x590
[   34.788327]  ? do_raw_spin_trylock+0x190/0x190
[   34.792875]  ? mm_access+0x140/0x140
[   34.796551]  ? _raw_spin_unlock_irq+0x27/0x70
[   34.801011]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   34.805990]  ? trace_hardirqs_on+0xd/0x10
[   34.810100]  ? _raw_spin_unlock_irq+0x27/0x70
[   34.814557]  ? acct_collect+0x637/0x800
[   34.818495]  do_exit+0x481/0x1b00
[   34.821911]  ? mm_update_next_owner+0x930/0x930
[   34.826545]  ? trace_event_raw_event_sched_switch+0x770/0x770
[   34.832394]  ? rcu_note_context_switch+0x710/0x710
[   34.837285]  ? futex_wait_setup+0x14a/0x3d0
[   34.841572]  ? __might_sleep+0x95/0x190
[   34.845509]  ? _cond_resched+0x14/0x30
[   34.849359]  ? perf_trace_lock+0xf1/0x860
[   34.853472]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[   34.858798]  ? check_noncircular+0x20/0x20
[   34.862996]  ? futex_wait_setup+0x22e/0x3d0
[   34.867285]  ? futex_wake+0x680/0x680
[   34.871050]  ? find_held_lock+0x39/0x1d0
[   34.875077]  ? lock_downgrade+0x990/0x990
[   34.879197]  ? recalc_sigpending_tsk+0x117/0x150
[   34.883917]  ? recalc_sigpending+0x103/0x160
[   34.888288]  ? recalc_sigpending_tsk+0x150/0x150
[   34.893005]  ? get_signal+0x2b2/0x16d0
[   34.896858]  do_group_exit+0x149/0x400
[   34.900711]  ? __lock_is_held+0xbc/0x140
[   34.904734]  ? SyS_exit+0x30/0x30
[   34.908167]  ? _raw_spin_unlock_irq+0x27/0x70
[   34.912626]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   34.917606]  get_signal+0x73f/0x16d0
[   34.921288]  ? ptrace_notify+0x130/0x130
[   34.925315]  ? vma_wants_writenotify+0x3b0/0x3b0
[   34.930035]  ? perf_trace_lock+0xf1/0x860
[   34.934148]  ? exit_robust_list+0x240/0x240
[   34.938433]  ? lock_downgrade+0x990/0x990
[   34.942543]  ? SyS_brk+0x6f0/0x6f0
[   34.946049]  do_signal+0x94/0x1ee0
[   34.949555]  ? arch_get_unmapped_area+0x750/0x750
[   34.954361]  ? lock_acquire+0x1d5/0x580
[   34.958298]  ? find_held_lock+0x39/0x1d0
[   34.962321]  ? setup_sigcontext+0x7d0/0x7d0
[   34.966606]  ? lock_downgrade+0x990/0x990
[   34.970718]  ? down_write+0x120/0x120
[   34.974481]  ? lock_release+0xd70/0xd70
[   34.978417]  ? trace_event_raw_event_sched_switch+0x770/0x770
[   34.984265]  ? vm_mmap_pgoff+0x1fc/0x280
[   34.988291]  ? exit_to_usermode_loop+0x8c/0x310
[   34.992925]  exit_to_usermode_loop+0x214/0x310
[   34.997470]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   35.002968]  ? kasan_check_write+0x14/0x20
[   35.007168]  syscall_return_slowpath+0x42f/0x510
[   35.011898]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   35.016877]  ? entry_SYSCALL_64_fastpath+0x91/0xbe
[   35.021770]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   35.026747]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   35.031468]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   35.036187] RIP: 0033:0x4520a9
[   35.039341] RSP: 002b:00007f86abc60cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   35.047012] RAX: 0000000000000000 RBX: 0000000000718188 RCX: 00000000004520a9
[   35.054247] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718188
[   35.061479] RBP: 0000000000718160 R08: 0000000000000000 R09: 0000000000000000
[   35.068713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   35.075946] R13: 00007ffe13039f3f R14: 00007f86abc619c0 R15: 0000000000000015
[   35.083186] 
[   35.084777] Allocated by task 3111:
[   35.088376]  save_stack_trace+0x16/0x20
[   35.092312]  save_stack+0x43/0xd0
[   35.095726]  kasan_kmalloc+0xad/0xe0
[   35.099404]  kmem_cache_alloc_trace+0x136/0x750
[   35.104034]  refill_pi_state_cache.part.6+0xa5/0x2f0
[   35.109097]  futex_requeue+0x1887/0x2370
[   35.113118]  do_futex+0x7f5/0x20d0
[   35.116619]  SyS_futex+0x260/0x390
[   35.120123]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   35.124839] 
[   35.126430] Freed by task 3083:
[   35.129671]  save_stack_trace+0x16/0x20
[   35.133606]  save_stack+0x43/0xd0
[   35.137022]  kasan_slab_free+0x71/0xc0
[   35.140875]  kfree+0xca/0x250
[   35.143943]  put_pi_state+0x3f4/0x560
[   35.147706]  unqueue_me_pi+0x4a/0xc0
[   35.151382]  futex_wait_requeue_pi.constprop.19+0xc7f/0x1300
[   35.157148]  do_futex+0x825/0x20d0
[   35.160656]  SyS_futex+0x260/0x390
[   35.164159]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   35.168878] 
[   35.170470] The buggy address belongs to the object at ffff8801cdf06780
[   35.170470]  which belongs to the cache kmalloc-256 of size 256
[   35.183086] The buggy address is located 40 bytes inside of
[   35.183086]  256-byte region [ffff8801cdf06780, ffff8801cdf06880)
[   35.194835] The buggy address belongs to the page:
[   35.199725] page:ffffea000737c180 count:1 mapcount:0 mapping:ffff8801cdf06000 index:0x0
[   35.207827] flags: 0x200000000000100(slab)
[   35.212025] raw: 0200000000000100 ffff8801cdf06000 0000000000000000 000000010000000c
[   35.219867] raw: ffffea000737e8a0 ffffea0007355020 ffff8801dac007c0 0000000000000000
[   35.227709] page dumped because: kasan: bad access detected
[   35.233377] 
[   35.234968] Memory state around the buggy address:
[   35.239857]  ffff8801cdf06680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   35.247182]  ffff8801cdf06700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   35.254506] >ffff8801cdf06780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   35.261827]                                   ^
[   35.266457]  ffff8801cdf06800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   35.273787]  ffff8801cdf06880: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   35.281107] ==================================================================
[   35.288428] Disabling lock debugging due to kernel taint
[   35.293839] Kernel panic - not syncing: panic_on_warn set ...
[   35.293839] 
[   35.301166] CPU: 0 PID: 3091 Comm: syz-executor1 Tainted: G    B           4.14.0-rc2-next-20170929+ #32
[   35.310742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   35.320067] Call Trace:
[   35.322621]  dump_stack+0x194/0x257
[   35.326211]  ? arch_local_irq_restore+0x53/0x53
[   35.330844]  ? vprintk_default+0x28/0x30
[   35.334869]  ? __lock_acquire+0x4000/0x4620
[   35.339158]  panic+0x1e4/0x41c
[   35.342314]  ? refcount_error_report+0x214/0x214
[   35.347035]  ? __lock_acquire+0x407b/0x4620
[   35.351319]  kasan_end_report+0x50/0x50
[   35.355261]  kasan_report+0x144/0x340
[   35.359026]  __asan_report_load8_noabort+0x14/0x20
[   35.363918]  __lock_acquire+0x407b/0x4620
[   35.368028]  ? unwind_dump+0x4c0/0x4c0
[   35.371877]  ? __unwind_start+0x169/0x330
[   35.375988]  ? __kernel_text_address+0xd/0x40
[   35.380448]  ? unwind_get_return_address+0x61/0xa0
[   35.385343]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   35.390494]  ? unwind_get_return_address+0x61/0xa0
[   35.395386]  ? __save_stack_trace+0x61/0xd0
[   35.399672]  ? get_signal+0x73f/0x16d0
[   35.403531]  ? save_stack_trace+0x16/0x20
[   35.407648]  ? __lock_acquire+0x20fd/0x4620
[   35.411939]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   35.417094]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   35.422249]  ? save_stack_trace+0x16/0x20
[   35.426359]  ? __lock_acquire+0x20fd/0x4620
[   35.430643]  ? osq_unlock+0x350/0x350
[   35.434406]  ? perf_trace_lock+0xf1/0x860
[   35.438516]  ? check_noncircular+0x20/0x20
[   35.442714]  ? check_noncircular+0x20/0x20
[   35.446912]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   35.452067]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   35.457222]  ? __lock_is_held+0xbc/0x140
[   35.461248]  ? perf_trace_lock+0xf1/0x860
[   35.465362]  ? find_held_lock+0x39/0x1d0
[   35.469390]  ? lock_downgrade+0x990/0x990
[   35.473501]  ? check_noncircular+0x20/0x20
[   35.477704]  lock_acquire+0x1d5/0x580
[   35.481474]  ? exit_pi_state_list+0x369/0x7a0
[   35.485934]  ? lock_release+0xd70/0xd70
[   35.489871]  ? do_raw_spin_trylock+0x190/0x190
[   35.494425]  ? find_held_lock+0x39/0x1d0
[   35.498455]  _raw_spin_lock_irq+0x5e/0x80
[   35.502566]  ? exit_pi_state_list+0x369/0x7a0
[   35.507025]  exit_pi_state_list+0x369/0x7a0
[   35.511311]  ? futex_wait_requeue_pi.constprop.19+0x1300/0x1300
[   35.517333]  ? lock_release+0xd70/0xd70
[   35.521281]  ? trace_event_raw_event_sched_switch+0x770/0x770
[   35.527132]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[   35.532201]  ? __might_sleep+0x95/0x190
[   35.536145]  ? __might_fault+0x188/0x1d0
[   35.540172]  ? do_raw_spin_trylock+0x190/0x190
[   35.544721]  mm_release+0x46d/0x590
[   35.548309]  ? do_raw_spin_trylock+0x190/0x190
[   35.552852]  ? mm_access+0x140/0x140
[   35.556530]  ? _raw_spin_unlock_irq+0x27/0x70
[   35.560988]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   35.565968]  ? trace_hardirqs_on+0xd/0x10
[   35.570078]  ? _raw_spin_unlock_irq+0x27/0x70
[   35.574537]  ? acct_collect+0x637/0x800
[   35.578476]  do_exit+0x481/0x1b00
[   35.581892]  ? mm_update_next_owner+0x930/0x930
[   35.586524]  ? trace_event_raw_event_sched_switch+0x770/0x770
[   35.592372]  ? rcu_note_context_switch+0x710/0x710
[   35.597262]  ? futex_wait_setup+0x14a/0x3d0
[   35.601547]  ? __might_sleep+0x95/0x190
[   35.605485]  ? _cond_resched+0x14/0x30
[   35.609336]  ? perf_trace_lock+0xf1/0x860
[   35.613447]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[   35.618773]  ? check_noncircular+0x20/0x20
[   35.622971]  ? futex_wait_setup+0x22e/0x3d0
[   35.627257]  ? futex_wake+0x680/0x680
[   35.631023]  ? find_held_lock+0x39/0x1d0
[   35.635049]  ? lock_downgrade+0x990/0x990
[   35.639164]  ? recalc_sigpending_tsk+0x117/0x150
[   35.643883]  ? recalc_sigpending+0x103/0x160
[   35.648254]  ? recalc_sigpending_tsk+0x150/0x150