[....] Starting enhanced syslogd: rsyslogd[ 10.270566] audit: type=1400 audit(1514385207.478:4): avc: denied { syslog } for pid=3169 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.32' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 19.995877] ================================================================== [ 19.996967] BUG: KASAN: use-after-free in __lock_acquire+0x2eff/0x3640 [ 19.997844] Read of size 8 at addr ffff8801cca77c38 by task syzkaller158791/3322 [ 19.998939] [ 19.999171] CPU: 0 PID: 3322 Comm: syzkaller158791 Not tainted 4.9.72-gcb7518e #114 [ 20.000200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.001436] ffff8801c8b8f8e0 ffffffff81d922b9 ffffea0007329d80 ffff8801cca77c38 [ 20.002580] 0000000000000000 ffff8801cca77c38 ffff8801cca77c38 ffff8801c8b8f918 [ 20.003705] ffffffff8153bab3 ffff8801cca77c38 0000000000000008 0000000000000000 [ 20.004861] Call Trace: [ 20.005216] [] dump_stack+0xc1/0x128 [ 20.005926] [] print_address_description+0x73/0x280 [ 20.006819] [] kasan_report+0x275/0x360 [ 20.007561] [] ? __lock_acquire+0x2eff/0x3640 [ 20.008369] [] __asan_report_load8_noabort+0x14/0x20 [ 20.009255] [] __lock_acquire+0x2eff/0x3640 [ 20.010042] [] ? __lock_acquire+0x629/0x3640 [ 20.010841] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 20.011761] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 20.012681] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 20.013676] [] ? mark_held_locks+0xaf/0x100 [ 20.014464] [] ? mutex_lock_nested+0x5e3/0x870 [ 20.015296] [] lock_acquire+0x12e/0x410 [ 20.016078] [] ? remove_wait_queue+0x14/0x40 [ 20.022100] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 20.028382] [] ? remove_wait_queue+0x14/0x40 [ 20.034402] [] remove_wait_queue+0x14/0x40 [ 20.040254] [] ep_unregister_pollwait.isra.6+0xaf/0x240 [ 20.047234] [] ? ep_unregister_pollwait.isra.6+0x12a/0x240 [ 20.054471] [] ? ep_free+0x1b0/0x1b0 [ 20.059798] [] ep_free+0x96/0x1b0 [ 20.064865] [] ? ep_free+0x1b0/0x1b0 [ 20.070191] [] ep_eventpoll_release+0x44/0x60 [ 20.076300] [] __fput+0x28c/0x6e0 [ 20.081366] [] ____fput+0x15/0x20 [ 20.086432] [] task_work_run+0x115/0x190 [ 20.092106] [] do_exit+0x7e7/0x2a40 [ 20.097345] [] ? selinux_file_ioctl+0x355/0x530 [ 20.103626] [] ? release_task+0x1240/0x1240 [ 20.109561] [] ? SyS_epoll_create+0x190/0x190 [ 20.115671] [] ? entry_SYSCALL_64_fastpath+0x5/0xc6 [ 20.122300] [] do_group_exit+0x108/0x320 [ 20.127973] [] SyS_exit_group+0x1d/0x20 [ 20.133562] [] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 20.140100] [ 20.141693] Allocated by task 3322: [ 20.145284] save_stack_trace+0x16/0x20 [ 20.149222] save_stack+0x43/0xd0 [ 20.152639] kasan_kmalloc+0xad/0xe0 [ 20.156314] kmem_cache_alloc_trace+0xfb/0x2a0 [ 20.160861] binder_get_thread+0x15d/0x750 [ 20.165059] binder_poll+0x4a/0x210 [ 20.168650] SyS_epoll_ctl+0x11d7/0x2190 [ 20.172676] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 20.177391] [ 20.178982] Freed by task 3322: [ 20.182225] save_stack_trace+0x16/0x20 [ 20.186161] save_stack+0x43/0xd0 [ 20.189577] kasan_slab_free+0x72/0xc0 [ 20.193427] kfree+0x103/0x300 [ 20.196583] binder_thread_dec_tmpref+0x1cc/0x240 [ 20.201388] binder_thread_release+0x27d/0x540 [ 20.205932] binder_ioctl+0x9c0/0x11b0 [ 20.209780] do_vfs_ioctl+0x1aa/0x1140 [ 20.213633] SyS_ioctl+0x8f/0xc0 [ 20.216961] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 20.221675] [ 20.223271] The buggy address belongs to the object at ffff8801cca77b80 [ 20.223271] which belongs to the cache kmalloc-512 of size 512 [ 20.235889] The buggy address is located 184 bytes inside of [ 20.235889] 512-byte region [ffff8801cca77b80, ffff8801cca77d80) [ 20.247725] The buggy address belongs to the page: [ 20.252627] page:ffffea0007329d80 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 20.262779] flags: 0x8000000000004080(slab|head) [ 20.267494] page dumped because: kasan: bad access detected [ 20.273163] [ 20.274754] Memory state around the buggy address: [ 20.279646] ffff8801cca77b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.286970] ffff8801cca77b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.294292] >ffff8801cca77c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.301613] ^ [ 20.306766] ffff8801cca77c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.314090] ffff8801cca77d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.321412] ================================================================== [ 20.328751] Disabling lock debugging due to kernel taint [ 20.334172] Kernel panic - not syncing: panic_on_warn set ... [ 20.334172] [ 20.341500] CPU: 0 PID: 3322 Comm: syzkaller158791 Tainted: G B 4.9.72-gcb7518e #114 [ 20.350472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.359803] ffff8801c8b8f838 ffffffff81d922b9 ffffffff841955bf ffff8801c8b8f910 [ 20.367763] 0000000000000000 ffff8801cca77c38 ffff8801cca77c38 ffff8801c8b8f900 [ 20.375716] ffffffff8142d741 0000000041b58ab3 ffffffff84189000 ffffffff8142d585 [ 20.383662] Call Trace: [ 20.386216] [] dump_stack+0xc1/0x128 [ 20.391548] [] panic+0x1bc/0x3a8 [ 20.396531] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 20.404724] [] ? add_taint+0x40/0x50 [ 20.410052] [] kasan_end_report+0x50/0x50 [ 20.415817] [] kasan_report+0x167/0x360 [ 20.421414] [] ? __lock_acquire+0x2eff/0x3640 [ 20.427523] [] __asan_report_load8_noabort+0x14/0x20 [ 20.434242] [] __lock_acquire+0x2eff/0x3640 [ 20.440175] [] ? __lock_acquire+0x629/0x3640 [ 20.446197] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 20.453175] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 20.460152] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 20.467128] [] ? mark_held_locks+0xaf/0x100 [ 20.473065] [] ? mutex_lock_nested+0x5e3/0x870 [ 20.479259] [] lock_acquire+0x12e/0x410 [ 20.484849] [] ? remove_wait_queue+0x14/0x40 [ 20.490871] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 20.497154] [] ? remove_wait_queue+0x14/0x40 [ 20.503175] [] remove_wait_queue+0x14/0x40 [ 20.509024] [] ep_unregister_pollwait.isra.6+0xaf/0x240 [ 20.516001] [] ? ep_unregister_pollwait.isra.6+0x12a/0x240 [ 20.523238] [] ? ep_free+0x1b0/0x1b0 [ 20.528562] [] ep_free+0x96/0x1b0 [ 20.533630] [] ? ep_free+0x1b0/0x1b0 [ 20.538957] [] ep_eventpoll_release+0x44/0x60 [ 20.545070] [] __fput+0x28c/0x6e0 [ 20.550135] [] ____fput+0x15/0x20 [ 20.555203] [] task_work_run+0x115/0x190 [ 20.560877] [] do_exit+0x7e7/0x2a40 [ 20.566120] [] ? selinux_file_ioctl+0x355/0x530 [ 20.572402] [] ? release_task+0x1240/0x1240 [ 20.578422] [] ? SyS_epoll_create+0x190/0x190 [ 20.584532] [] ? entry_SYSCALL_64_fastpath+0x5/0xc6 [ 20.591163] [] do_group_exit+0x108/0x320 [ 20.596837] [] SyS_exit_group+0x1d/0x20 [ 20.602423] [] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 20.609325] Dumping ftrace buffer: [ 20.612835] (ftrace buffer empty) [ 20.616511] Kernel Offset: disabled [ 20.620100] Rebooting in 86400 seconds..