[....] Starting enhanced syslogd: rsyslogd[ 10.906289] audit: type=1400 audit(1515007887.265:4): avc: denied { syslog } for pid=3170 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1
[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Starting mcstransd:
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.15.227' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 23.051892] ==================================================================
[ 23.053011] BUG: KASAN: use-after-free in __lock_acquire+0x2eff/0x3640
[ 23.054005] Read of size 8 at addr ffff8801c9ecb238 by task syzkaller183450/3326
[ 23.055007]
[ 23.055239] CPU: 0 PID: 3326 Comm: syzkaller183450 Not tainted 4.9.74-g4406671 #3
[ 23.056256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 23.057485] ffff8801c88578e0 ffffffff81d91d19 ffffea000727b280 ffff8801c9ecb238
[ 23.058652] 0000000000000000 ffff8801c9ecb238 ffff8801c9ecb238 ffff8801c8857918
[ 23.059808] ffffffff8153b503 ffff8801c9ecb238 0000000000000008 0000000000000000
[ 23.060949] Call Trace:
[ 23.061323] [<ffffffff81d91d19>] dump_stack+0xc1/0x128
[ 23.062050] [<ffffffff8153b503>] print_address_description+0x73/0x280
[ 23.063056] [<ffffffff8153ba25>] kasan_report+0x275/0x360
[ 23.063798] [<ffffffff8123ca4f>] ? __lock_acquire+0x2eff/0x3640
[ 23.064619] [<ffffffff8153bb84>] __asan_report_load8_noabort+0x14/0x20
[ 23.065507] [<ffffffff8123ca4f>] __lock_acquire+0x2eff/0x3640
[ 23.066292] [<ffffffff8123a179>] ? __lock_acquire+0x629/0x3640
[ 23.067102] [<ffffffff81239b50>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 23.068043] [<ffffffff81239b50>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 23.068973] [<ffffffff81239b50>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 23.069933] [<ffffffff81238f3f>] ? mark_held_locks+0xaf/0x100
[ 23.070721] [<ffffffff838a6203>] ? mutex_lock_nested+0x5e3/0x870
[ 23.071550] [<ffffffff8123dbce>] lock_acquire+0x12e/0x410
[ 23.074287] [<ffffffff81222134>] ? remove_wait_queue+0x14/0x40
[ 23.080309] [<ffffffff838af8ce>] _raw_spin_lock_irqsave+0x4e/0x70
[ 23.086597] [<ffffffff81222134>] ? remove_wait_queue+0x14/0x40
[ 23.092630] [<ffffffff81222134>] remove_wait_queue+0x14/0x40
[ 23.098489] [<ffffffff8164e53f>] ep_unregister_pollwait.isra.6+0xaf/0x240
[ 23.105478] [<ffffffff8164e5ba>] ? ep_unregister_pollwait.isra.6+0x12a/0x240
[ 23.112719] [<ffffffff8164f3a0>] ? ep_free+0x1b0/0x1b0
[ 23.118049] [<ffffffff8164f286>] ep_free+0x96/0x1b0
[ 23.123125] [<ffffffff8164f3a0>] ? ep_free+0x1b0/0x1b0
[ 23.128459] [<ffffffff8164f3e4>] ep_eventpoll_release+0x44/0x60
[ 23.134575] [<ffffffff8157299c>] __fput+0x28c/0x6e0
[ 23.139641] [<ffffffff81572e75>] ____fput+0x15/0x20
[ 23.144710] [<ffffffff81193555>] task_work_run+0x115/0x190
[ 23.150388] [<ffffffff8113a037>] do_exit+0x7e7/0x2a40
[ 23.156305] [<ffffffff81be7e35>] ? selinux_file_ioctl+0x355/0x530
[ 23.162598] [<ffffffff81139850>] ? release_task+0x1240/0x1240
[ 23.168536] [<ffffffff816512e0>] ? SyS_epoll_create+0x190/0x190
[ 23.174646] [<ffffffff838afa67>] ? entry_SYSCALL_64_fastpath+0x5/0xc6
[ 23.181277] [<ffffffff81140748>] do_group_exit+0x108/0x320
[ 23.187070] [<ffffffff8114097d>] SyS_exit_group+0x1d/0x20
[ 23.192659] [<ffffffff838afa85>] entry_SYSCALL_64_fastpath+0x23/0xc6
[ 23.199207]
[ 23.200808] Allocated by task 3326:
[ 23.204402] save_stack_trace+0x16/0x20
[ 23.208342] save_stack+0x43/0xd0
[ 23.211756] kasan_kmalloc+0xad/0xe0
[ 23.215433] kmem_cache_alloc_trace+0xfb/0x2a0
[ 23.219980] binder_get_thread+0x15d/0x750
[ 23.224178] binder_poll+0x4a/0x210
[ 23.227768] SyS_epoll_ctl+0x11d7/0x2190
[ 23.231810] entry_SYSCALL_64_fastpath+0x23/0xc6
[ 23.236527]
[ 23.238120] Freed by task 3326:
[ 23.241371] save_stack_trace+0x16/0x20
[ 23.245310] save_stack+0x43/0xd0
[ 23.248735] kasan_slab_free+0x72/0xc0
[ 23.252584] kfree+0x103/0x300
[ 23.255742] binder_thread_dec_tmpref+0x1cc/0x240
[ 23.260558] binder_thread_release+0x27d/0x540
[ 23.265104] binder_ioctl+0x9c0/0x11b0
[ 23.268957] do_vfs_ioctl+0x1aa/0x1140
[ 23.272805] SyS_ioctl+0x8f/0xc0
[ 23.276137] entry_SYSCALL_64_fastpath+0x23/0xc6
[ 23.280858]
[ 23.282453] The buggy address belongs to the object at ffff8801c9ecb180
[ 23.282453] which belongs to the cache kmalloc-512 of size 512
[ 23.295074] The buggy address is located 184 bytes inside of
[ 23.295074] 512-byte region [ffff8801c9ecb180, ffff8801c9ecb380)
[ 23.306916] The buggy address belongs to the page:
[ 23.311810] page:ffffea000727b280 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0
[ 23.321969] flags: 0x8000000000004080(slab|head)
[ 23.326689] page dumped because: kasan: bad access detected
[ 23.332366]
[ 23.333957] Memory state around the buggy address:
[ 23.338850] ffff8801c9ecb100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 23.346174] ffff8801c9ecb180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.353495] >ffff8801c9ecb200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.360822] ^
[ 23.365978] ffff8801c9ecb280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.373310] ffff8801c9ecb300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.380639] ==================================================================
[ 23.387969] Disabling lock debugging due to kernel taint
[ 23.393470] Kernel panic - not syncing: panic_on_warn set ...
[ 23.393470]
[ 23.400799] CPU: 0 PID: 3326 Comm: syzkaller183450 Tainted: G B 4.9.74-g4406671 #3
[ 23.409605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 23.418936] ffff8801c8857838 ffffffff81d91d19 ffffffff8419562f ffff8801c8857910
[ 23.426885] 0000000000000000 ffff8801c9ecb238 ffff8801c9ecb238 ffff8801c8857900
[ 23.434847] ffffffff8142d161 0000000041b58ab3 ffffffff84189070 ffffffff8142cfa5
[ 23.442796] Call Trace:
[ 23.445352] [<ffffffff81d91d19>] dump_stack+0xc1/0x128
[ 23.450777] [<ffffffff8142d161>] panic+0x1bc/0x3a8
[ 23.455760] [<ffffffff8142cfa5>] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7
[ 23.463957] [<ffffffff8112e7c0>] ? add_taint+0x40/0x50
[ 23.469291] [<ffffffff8153b470>] kasan_end_report+0x50/0x50
[ 23.475057] [<ffffffff8153b917>] kasan_report+0x167/0x360
[ 23.480650] [<ffffffff8123ca4f>] ? __lock_acquire+0x2eff/0x3640
[ 23.486761] [<ffffffff8153bb84>] __asan_report_load8_noabort+0x14/0x20
[ 23.493486] [<ffffffff8123ca4f>] __lock_acquire+0x2eff/0x3640
[ 23.499422] [<ffffffff8123a179>] ? __lock_acquire+0x629/0x3640
[ 23.505457] [<ffffffff81239b50>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 23.512435] [<ffffffff81239b50>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 23.519415] [<ffffffff81239b50>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 23.526398] [<ffffffff81238f3f>] ? mark_held_locks+0xaf/0x100
[ 23.532334] [<ffffffff838a6203>] ? mutex_lock_nested+0x5e3/0x870
[ 23.538537] [<ffffffff8123dbce>] lock_acquire+0x12e/0x410
[ 23.544128] [<ffffffff81222134>] ? remove_wait_queue+0x14/0x40
[ 23.550163] [<ffffffff838af8ce>] _raw_spin_lock_irqsave+0x4e/0x70
[ 23.556445] [<ffffffff81222134>] ? remove_wait_queue+0x14/0x40
[ 23.562468] [<ffffffff81222134>] remove_wait_queue+0x14/0x40
[ 23.568318] [<ffffffff8164e53f>] ep_unregister_pollwait.isra.6+0xaf/0x240
[ 23.575295] [<ffffffff8164e5ba>] ? ep_unregister_pollwait.isra.6+0x12a/0x240
[ 23.582542] [<ffffffff8164f3a0>] ? ep_free+0x1b0/0x1b0
[ 23.587870] [<ffffffff8164f286>] ep_free+0x96/0x1b0
[ 23.592937] [<ffffffff8164f3a0>] ? ep_free+0x1b0/0x1b0
[ 23.598266] [<ffffffff8164f3e4>] ep_eventpoll_release+0x44/0x60
[ 23.604377] [<ffffffff8157299c>] __fput+0x28c/0x6e0
[ 23.609461] [<ffffffff81572e75>] ____fput+0x15/0x20
[ 23.614533] [<ffffffff81193555>] task_work_run+0x115/0x190
[ 23.620219] [<ffffffff8113a037>] do_exit+0x7e7/0x2a40
[ 23.625467] [<ffffffff81be7e35>] ? selinux_file_ioctl+0x355/0x530
[ 23.631758] [<ffffffff81139850>] ? release_task+0x1240/0x1240
[ 23.637695] [<ffffffff816512e0>] ? SyS_epoll_create+0x190/0x190
[ 23.643808] [<ffffffff838afa67>] ? entry_SYSCALL_64_fastpath+0x5/0xc6
[ 23.650439] [<ffffffff81140748>] do_group_exit+0x108/0x320
[ 23.656115] [<ffffffff8114097d>] SyS_exit_group+0x1d/0x20
[ 23.661703] [<ffffffff838afa85>] entry_SYSCALL_64_fastpath+0x23/0xc6
[ 23.668632] Dumping ftrace buffer:
[ 23.672139] (ftrace buffer empty)
[ 23.675822] Kernel Offset: disabled
[ 23.679412] Rebooting in 86400 seconds..