INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-4,10.128.0.25' (ECDSA) to the list of known hosts.
2017/10/04 01:57:46 parsed 1 programs
2017/10/04 01:57:46 executed programs: 0
syzkaller login: [   34.144129] ==================================================================
[   34.151526] BUG: KASAN: use-after-free in __do_page_fault+0xc03/0xd60
[   34.158072] Read of size 8 at addr ffff8801cbfd3090 by task syz-executor7/3660
[   34.165395] 
[   34.166993] CPU: 1 PID: 3660 Comm: syz-executor7 Not tainted 4.14.0-rc3+ #23
[   34.174146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   34.183466] Call Trace:
[   34.186024]  dump_stack+0x194/0x257
[   34.189623]  ? arch_local_irq_restore+0x53/0x53
[   34.194264]  ? show_regs_print_info+0x65/0x65
[   34.198737]  ? __do_page_fault+0xc03/0xd60
[   34.202944]  print_address_description+0x73/0x250
[   34.207755]  ? __do_page_fault+0xc03/0xd60
[   34.211959]  kasan_report+0x25b/0x340
[   34.215734]  __asan_report_load8_noabort+0x14/0x20
[   34.220633]  __do_page_fault+0xc03/0xd60
[   34.224663]  ? exit_to_usermode_loop+0x198/0x310
[   34.229395]  ? mm_fault_error+0x2c0/0x2c0
[   34.233517]  ? lockdep_sys_exit+0x47/0xf0
[   34.237641]  do_page_fault+0xee/0x720
[   34.241415]  ? __do_page_fault+0xd60/0xd60
[   34.245625]  ? lockdep_sys_exit+0x47/0xf0
[   34.249748]  ? syscall_return_slowpath+0x2b3/0x510
[   34.254645]  ? finish_task_switch+0x1aa/0x740
[   34.259112]  ? lockdep_sys_exit+0x47/0xf0
[   34.263229]  ? retint_user+0x18/0x20
[   34.266918]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   34.271737]  page_fault+0x22/0x30
[   34.275157] RIP: 0023:0x8073f4f
[   34.278405] RSP: 002b:00000000f7f89bd0 EFLAGS: 00010202
[   34.283739] RAX: 00000000f7f89c8c RBX: 0000000000000400 RCX: 000000000000000e
[   34.290977] RDX: 00000000f7f8aa88 RSI: 0000000020012fe0 RDI: 00000000f7f89c8c
[   34.298214] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000
[   34.305453] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
[   34.312698] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   34.319954] 
[   34.321550] Allocated by task 3660:
[   34.325146]  save_stack_trace+0x16/0x20
[   34.329091]  save_stack+0x43/0xd0
[   34.332511]  kasan_kmalloc+0xad/0xe0
[   34.336197]  kasan_slab_alloc+0x12/0x20
[   34.340138]  kmem_cache_alloc+0x12e/0x760
[   34.344254]  mmap_region+0x7ee/0x15a0
[   34.348021]  do_mmap+0x6a1/0xd50
[   34.351356]  vm_mmap_pgoff+0x1de/0x280
[   34.355210]  SyS_mmap_pgoff+0x23b/0x5f0
[   34.359154]  do_fast_syscall_32+0x3f2/0xf05
[   34.363441]  entry_SYSENTER_compat+0x51/0x60
[   34.367814] 
[   34.369411] Freed by task 3667:
[   34.372656]  save_stack_trace+0x16/0x20
[   34.376597]  save_stack+0x43/0xd0
[   34.380016]  kasan_slab_free+0x71/0xc0
[   34.383869]  kmem_cache_free+0x77/0x280
[   34.387808]  remove_vma+0x162/0x1b0
[   34.391402]  do_munmap+0x82a/0xdf0
[   34.394908]  mmap_region+0x59e/0x15a0
[   34.398678]  do_mmap+0x6a1/0xd50
[   34.402014]  vm_mmap_pgoff+0x1de/0x280
[   34.405867]  SyS_mmap_pgoff+0x23b/0x5f0
[   34.409813]  do_fast_syscall_32+0x3f2/0xf05
[   34.414102]  entry_SYSENTER_compat+0x51/0x60
[   34.418475] 
[   34.420072] The buggy address belongs to the object at ffff8801cbfd3040
[   34.420072]  which belongs to the cache vm_area_struct of size 200
[   34.432954] The buggy address is located 80 bytes inside of
[   34.432954]  200-byte region [ffff8801cbfd3040, ffff8801cbfd3108)
[   34.444706] The buggy address belongs to the page:
[   34.449600] page:ffffea00072ff4c0 count:1 mapcount:0 mapping:ffff8801cbfd3040 index:0x0
[   34.457715] flags: 0x200000000000100(slab)
[   34.461919] raw: 0200000000000100 ffff8801cbfd3040 0000000000000000 000000010000000f
[   34.469766] raw: ffffea000730c7a0 ffffea00072ff7a0 ffff8801dae069c0 0000000000000000
[   34.477615] page dumped because: kasan: bad access detected
[   34.483298] 
[   34.484906] Memory state around the buggy address:
[   34.489818]  ffff8801cbfd2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.497148]  ffff8801cbfd3000: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   34.504478] >ffff8801cbfd3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.511808]                          ^
[   34.515665]  ffff8801cbfd3100: fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb
[   34.522995]  ffff8801cbfd3180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.530329] ==================================================================
[   34.537659] Disabling lock debugging due to kernel taint
[   34.543186] Kernel panic - not syncing: panic_on_warn set ...
[   34.543186] 
[   34.550531] CPU: 1 PID: 3660 Comm: syz-executor7 Tainted: G    B           4.14.0-rc3+ #23
[   34.558905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   34.568228] Call Trace:
[   34.570782]  dump_stack+0x194/0x257
[   34.574394]  ? arch_local_irq_restore+0x53/0x53
[   34.579043]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   34.583777]  ? __do_page_fault+0xb20/0xd60
[   34.587993]  panic+0x1e4/0x417
[   34.591164]  ? __warn+0x1d9/0x1d9
[   34.594591]  ? __do_page_fault+0xc03/0xd60
[   34.598796]  kasan_end_report+0x50/0x50
[   34.602745]  kasan_report+0x144/0x340
[   34.606525]  __asan_report_load8_noabort+0x14/0x20
[   34.611420]  __do_page_fault+0xc03/0xd60
[   34.615447]  ? exit_to_usermode_loop+0x198/0x310
[   34.620171]  ? mm_fault_error+0x2c0/0x2c0
[   34.624289]  ? lockdep_sys_exit+0x47/0xf0
[   34.628402]  do_page_fault+0xee/0x720
[   34.632169]  ? __do_page_fault+0xd60/0xd60
[   34.636373]  ? lockdep_sys_exit+0x47/0xf0
[   34.640484]  ? syscall_return_slowpath+0x2b3/0x510
[   34.645378]  ? finish_task_switch+0x1aa/0x740
[   34.649841]  ? lockdep_sys_exit+0x47/0xf0
[   34.653953]  ? retint_user+0x18/0x20
[   34.657633]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   34.662448]  page_fault+0x22/0x30
[   34.665869] RIP: 0023:0x8073f4f
[   34.669109] RSP: 002b:00000000f7f89bd0 EFLAGS: 00010202
[   34.674438] RAX: 00000000f7f89c8c RBX: 0000000000000400 RCX: 000000000000000e
[   34.681672] RDX: 00000000f7f8aa88 RSI: 0000000020012fe0 RDI: 00000000f7f89c8c
[   34.688904] RBP: 0000000008128000 R08: 0000000000000000 R09: 0000000000000000
[   34.696140] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
[   34.703376] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   34.711042] Dumping ftrace buffer:
[   34.714550]    (ftrace buffer empty)
[   34.718224] Kernel Offset: disabled
[   34.721814] Rebooting in 86400 seconds..