[....] Starting enhanced syslogd: rsyslogd[ 10.981556] audit: type=1400 audit(1515272734.667:4): avc: denied { syslog } for pid=3180 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1
[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Starting mcstransd:
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.15.200' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 20.332533] ==================================================================
[ 20.333693] BUG: KASAN: use-after-free in __lock_acquire+0x2eff/0x3640
[ 20.334573] Read of size 8 at addr ffff8801c9041738 by task syzkaller426750/3329
[ 20.335570]
[ 20.335802] CPU: 1 PID: 3329 Comm: syzkaller426750 Not tainted 4.9.75-g06fe41f #6
[ 20.336860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.338081] ffff8801caa978e0 ffffffff81d93049 ffffea0007241000 ffff8801c9041738
[ 20.339224] 0000000000000000 ffff8801c9041738 ffff8801c9041738 ffff8801caa97918
[ 20.340385] ffffffff8153ca53 ffff8801c9041738 0000000000000008 0000000000000000
[ 20.341533] Call Trace:
[ 20.341915] [<ffffffff81d93049>] dump_stack+0xc1/0x128
[ 20.342674] [<ffffffff8153ca53>] print_address_description+0x73/0x280
[ 20.343580] [<ffffffff8153cf75>] kasan_report+0x275/0x360
[ 20.344329] [<ffffffff8123db6f>] ? __lock_acquire+0x2eff/0x3640
[ 20.345138] [<ffffffff8153d0d4>] __asan_report_load8_noabort+0x14/0x20
[ 20.346054] [<ffffffff8123db6f>] __lock_acquire+0x2eff/0x3640
[ 20.346840] [<ffffffff8123b299>] ? __lock_acquire+0x629/0x3640
[ 20.347648] [<ffffffff8123ac70>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 20.348569] [<ffffffff8123ac70>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 20.349488] [<ffffffff8123ac70>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 20.350434] [<ffffffff8123a05f>] ? mark_held_locks+0xaf/0x100
[ 20.351242] [<ffffffff838a7203>] ? mutex_lock_nested+0x5e3/0x870
[ 20.352095] [<ffffffff8123ecee>] lock_acquire+0x12e/0x410
[ 20.354090] [<ffffffff81223254>] ? remove_wait_queue+0x14/0x40
[ 20.360113] [<ffffffff838b08ce>] _raw_spin_lock_irqsave+0x4e/0x70
[ 20.366398] [<ffffffff81223254>] ? remove_wait_queue+0x14/0x40
[ 20.372425] [<ffffffff81223254>] remove_wait_queue+0x14/0x40
[ 20.378276] [<ffffffff8164fa8f>] ep_unregister_pollwait.isra.6+0xaf/0x240
[ 20.385255] [<ffffffff8164fb0a>] ? ep_unregister_pollwait.isra.6+0x12a/0x240
[ 20.392504] [<ffffffff816508f0>] ? ep_free+0x1b0/0x1b0
[ 20.397836] [<ffffffff816507d6>] ep_free+0x96/0x1b0
[ 20.402914] [<ffffffff816508f0>] ? ep_free+0x1b0/0x1b0
[ 20.408244] [<ffffffff81650934>] ep_eventpoll_release+0x44/0x60
[ 20.414359] [<ffffffff81573eec>] __fput+0x28c/0x6e0
[ 20.419426] [<ffffffff815743c5>] ____fput+0x15/0x20
[ 20.424497] [<ffffffff81194675>] task_work_run+0x115/0x190
[ 20.430175] [<ffffffff8113b157>] do_exit+0x7e7/0x2a40
[ 20.435422] [<ffffffff81be9385>] ? selinux_file_ioctl+0x355/0x530
[ 20.441711] [<ffffffff8113a970>] ? release_task+0x1240/0x1240
[ 20.447655] [<ffffffff81652830>] ? SyS_epoll_create+0x190/0x190
[ 20.453769] [<ffffffff838b0a8a>] ? entry_SYSCALL_64_fastpath+0x5/0xe2
[ 20.460411] [<ffffffff81141868>] do_group_exit+0x108/0x320
[ 20.466091] [<ffffffff81141a9d>] SyS_exit_group+0x1d/0x20
[ 20.471682] [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
[ 20.478244]
[ 20.479846] Allocated by task 3329:
[ 20.483445] save_stack_trace+0x16/0x20
[ 20.487390] save_stack+0x43/0xd0
[ 20.490809] kasan_kmalloc+0xad/0xe0
[ 20.494495] kmem_cache_alloc_trace+0xfb/0x2a0
[ 20.499067] binder_get_thread+0x15d/0x750
[ 20.503288] binder_poll+0x4a/0x210
[ 20.506897] SyS_epoll_ctl+0x11d7/0x2190
[ 20.510940] entry_SYSCALL_64_fastpath+0x23/0xe2
[ 20.515662]
[ 20.517265] Freed by task 3329:
[ 20.520520] save_stack_trace+0x16/0x20
[ 20.524467] save_stack+0x43/0xd0
[ 20.527888] kasan_slab_free+0x72/0xc0
[ 20.531741] kfree+0x103/0x300
[ 20.534906] binder_thread_dec_tmpref+0x1cc/0x240
[ 20.539714] binder_thread_release+0x27d/0x540
[ 20.544269] binder_ioctl+0x9c0/0x11b0
[ 20.548122] do_vfs_ioctl+0x1aa/0x1140
[ 20.551975] SyS_ioctl+0x8f/0xc0
[ 20.555312] entry_SYSCALL_64_fastpath+0x23/0xe2
[ 20.560043]
[ 20.561641] The buggy address belongs to the object at ffff8801c9041680
[ 20.561641] which belongs to the cache kmalloc-512 of size 512
[ 20.574274] The buggy address is located 184 bytes inside of
[ 20.574274] 512-byte region [ffff8801c9041680, ffff8801c9041880)
[ 20.586116] The buggy address belongs to the page:
[ 20.591017] page:ffffea0007241000 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0
[ 20.601176] flags: 0x8000000000004080(slab|head)
[ 20.605894] page dumped because: kasan: bad access detected
[ 20.611571]
[ 20.613166] Memory state around the buggy address:
[ 20.618062] ffff8801c9041600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 20.625389] ffff8801c9041680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.632745] >ffff8801c9041700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.640080] ^
[ 20.645250] ffff8801c9041780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.652583] ffff8801c9041800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.659909] ==================================================================
[ 20.667234] Disabling lock debugging due to kernel taint
[ 20.672650] Kernel panic - not syncing: panic_on_warn set ...
[ 20.672650]
[ 20.679979] CPU: 1 PID: 3329 Comm: syzkaller426750 Tainted: G B 4.9.75-g06fe41f #6
[ 20.688783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.698120] ffff8801caa97838 ffffffff81d93049 ffffffff84195be7 ffff8801caa97910
[ 20.706075] 0000000000000000 ffff8801c9041738 ffff8801c9041738 ffff8801caa97900
[ 20.714051] ffffffff8142e281 0000000041b58ab3 ffffffff84189648 ffffffff8142e0c5
[ 20.722010] Call Trace:
[ 20.724570] [<ffffffff81d93049>] dump_stack+0xc1/0x128
[ 20.729906] [<ffffffff8142e281>] panic+0x1bc/0x3a8
[ 20.734889] [<ffffffff8142e0c5>] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7
[ 20.743087] [<ffffffff8112f8e0>] ? add_taint+0x40/0x50
[ 20.748415] [<ffffffff8153c9c0>] kasan_end_report+0x50/0x50
[ 20.754181] [<ffffffff8153ce67>] kasan_report+0x167/0x360
[ 20.759781] [<ffffffff8123db6f>] ? __lock_acquire+0x2eff/0x3640
[ 20.765892] [<ffffffff8153d0d4>] __asan_report_load8_noabort+0x14/0x20
[ 20.772612] [<ffffffff8123db6f>] __lock_acquire+0x2eff/0x3640
[ 20.778551] [<ffffffff8123b299>] ? __lock_acquire+0x629/0x3640
[ 20.784580] [<ffffffff8123ac70>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 20.791559] [<ffffffff8123ac70>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 20.798541] [<ffffffff8123ac70>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 20.805526] [<ffffffff8123a05f>] ? mark_held_locks+0xaf/0x100
[ 20.811467] [<ffffffff838a7203>] ? mutex_lock_nested+0x5e3/0x870
[ 20.817666] [<ffffffff8123ecee>] lock_acquire+0x12e/0x410
[ 20.823256] [<ffffffff81223254>] ? remove_wait_queue+0x14/0x40
[ 20.829280] [<ffffffff838b08ce>] _raw_spin_lock_irqsave+0x4e/0x70
[ 20.835581] [<ffffffff81223254>] ? remove_wait_queue+0x14/0x40
[ 20.841607] [<ffffffff81223254>] remove_wait_queue+0x14/0x40
[ 20.847462] [<ffffffff8164fa8f>] ep_unregister_pollwait.isra.6+0xaf/0x240
[ 20.854441] [<ffffffff8164fb0a>] ? ep_unregister_pollwait.isra.6+0x12a/0x240
[ 20.861680] [<ffffffff816508f0>] ? ep_free+0x1b0/0x1b0
[ 20.867022] [<ffffffff816507d6>] ep_free+0x96/0x1b0
[ 20.872090] [<ffffffff816508f0>] ? ep_free+0x1b0/0x1b0
[ 20.877419] [<ffffffff81650934>] ep_eventpoll_release+0x44/0x60
[ 20.883533] [<ffffffff81573eec>] __fput+0x28c/0x6e0
[ 20.888610] [<ffffffff815743c5>] ____fput+0x15/0x20
[ 20.893685] [<ffffffff81194675>] task_work_run+0x115/0x190
[ 20.899368] [<ffffffff8113b157>] do_exit+0x7e7/0x2a40
[ 20.904616] [<ffffffff81be9385>] ? selinux_file_ioctl+0x355/0x530
[ 20.910902] [<ffffffff8113a970>] ? release_task+0x1240/0x1240
[ 20.916849] [<ffffffff81652830>] ? SyS_epoll_create+0x190/0x190
[ 20.922965] [<ffffffff838b0a8a>] ? entry_SYSCALL_64_fastpath+0x5/0xe2
[ 20.929598] [<ffffffff81141868>] do_group_exit+0x108/0x320
[ 20.935275] [<ffffffff81141a9d>] SyS_exit_group+0x1d/0x20
[ 20.940867] [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
[ 20.947458] Dumping ftrace buffer:
[ 20.950968] (ftrace buffer empty)
[ 20.954644] Kernel Offset: disabled
[ 20.958236] Rebooting in 86400 seconds..