[....] Starting enhanced syslogd: rsyslogd[ 13.286499] audit: type=1400 audit(1517190460.122:4): avc: denied { syslog } for pid=3171 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1
[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Starting mcstransd:
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.0.58' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [ 44.084353] ==================================================================
[ 44.091746] BUG: KASAN: use-after-free in __lock_acquire+0x2eff/0x3640
[ 44.098386] Read of size 8 at addr ffff8801cd160338 by task syzkaller025117/3343
[ 44.105911]
[ 44.107515] CPU: 0 PID: 3343 Comm: syzkaller025117 Not tainted 4.9.78-g68d447c #23
[ 44.115193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 44.124534] ffff8801c821f8e0 ffffffff81d943a9 ffffea0007345800 ffff8801cd160338
[ 44.132512] 0000000000000000 ffff8801cd160338 ffff8801cd160338 ffff8801c821f918
[ 44.140657] ffffffff8153dc23 ffff8801cd160338 0000000000000008 0000000000000000
[ 44.148630] Call Trace:
[ 44.151193] [<ffffffff81d943a9>] dump_stack+0xc1/0x128
[ 44.156544] [<ffffffff8153dc23>] print_address_description+0x73/0x280
[ 44.163184] [<ffffffff8153e145>] kasan_report+0x275/0x360
[ 44.168794] [<ffffffff8123ed1f>] ? __lock_acquire+0x2eff/0x3640
[ 44.174913] [<ffffffff8153e2a4>] __asan_report_load8_noabort+0x14/0x20
[ 44.181660] [<ffffffff8123ed1f>] __lock_acquire+0x2eff/0x3640
[ 44.187614] [<ffffffff8123c449>] ? __lock_acquire+0x629/0x3640
[ 44.193685] [<ffffffff8123be20>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 44.200673] [<ffffffff8123be20>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 44.207680] [<ffffffff8123be20>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 44.214695] [<ffffffff8123b20f>] ? mark_held_locks+0xaf/0x100
[ 44.220643] [<ffffffff838a93c3>] ? mutex_lock_nested+0x5e3/0x870
[ 44.226849] [<ffffffff8123fe9e>] lock_acquire+0x12e/0x410
[ 44.232454] [<ffffffff81224404>] ? remove_wait_queue+0x14/0x40
[ 44.238488] [<ffffffff838b2a8e>] _raw_spin_lock_irqsave+0x4e/0x70
[ 44.244781] [<ffffffff81224404>] ? remove_wait_queue+0x14/0x40
[ 44.250822] [<ffffffff81224404>] remove_wait_queue+0x14/0x40
[ 44.256686] [<ffffffff81650cbf>] ep_unregister_pollwait.isra.6+0xaf/0x240
[ 44.263693] [<ffffffff81650d3a>] ? ep_unregister_pollwait.isra.6+0x12a/0x240
[ 44.270947] [<ffffffff81651b20>] ? ep_free+0x1b0/0x1b0
[ 44.276282] [<ffffffff81651a06>] ep_free+0x96/0x1b0
[ 44.281358] [<ffffffff81651b20>] ? ep_free+0x1b0/0x1b0
[ 44.286696] [<ffffffff81651b64>] ep_eventpoll_release+0x44/0x60
[ 44.292816] [<ffffffff815750bc>] __fput+0x28c/0x6e0
[ 44.297891] [<ffffffff81575595>] ____fput+0x15/0x20
[ 44.302970] [<ffffffff811957c5>] task_work_run+0x115/0x190
[ 44.308656] [<ffffffff8113c267>] do_exit+0x7e7/0x2a40
[ 44.313914] [<ffffffff81bea645>] ? selinux_file_ioctl+0x355/0x530
[ 44.320206] [<ffffffff8113ba80>] ? release_task+0x1240/0x1240
[ 44.326170] [<ffffffff81653a60>] ? SyS_epoll_create+0x190/0x190
[ 44.332291] [<ffffffff838b2c4a>] ? entry_SYSCALL_64_fastpath+0x5/0xe8
[ 44.338936] [<ffffffff81142978>] do_group_exit+0x108/0x320
[ 44.344622] [<ffffffff81142bad>] SyS_exit_group+0x1d/0x20
[ 44.350217] [<ffffffff838b2c6e>] entry_SYSCALL_64_fastpath+0x29/0xe8
[ 44.356768]
[ 44.358378] Allocated by task 3343:
[ 44.361978] save_stack_trace+0x16/0x20
[ 44.365927] save_stack+0x43/0xd0
[ 44.369348] kasan_kmalloc+0xad/0xe0
[ 44.373033] kmem_cache_alloc_trace+0xfb/0x2a0
[ 44.377589] binder_get_thread+0x15d/0x750
[ 44.381793] binder_poll+0x4a/0x210
[ 44.385392] SyS_epoll_ctl+0x11d7/0x2190
[ 44.389436] entry_SYSCALL_64_fastpath+0x29/0xe8
[ 44.394168]
[ 44.395764] Freed by task 3343:
[ 44.399014] save_stack_trace+0x16/0x20
[ 44.402960] save_stack+0x43/0xd0
[ 44.406382] kasan_slab_free+0x72/0xc0
[ 44.410240] kfree+0x103/0x300
[ 44.413405] binder_thread_dec_tmpref+0x1cc/0x240
[ 44.418227] binder_thread_release+0x27d/0x540
[ 44.422790] binder_ioctl+0x9c0/0x11b0
[ 44.426736] do_vfs_ioctl+0x1aa/0x1140
[ 44.430600] SyS_ioctl+0x8f/0xc0
[ 44.433939] entry_SYSCALL_64_fastpath+0x29/0xe8
[ 44.438680]
[ 44.440277] The buggy address belongs to the object at ffff8801cd160280
[ 44.440277] which belongs to the cache kmalloc-512 of size 512
[ 44.452904] The buggy address is located 184 bytes inside of
[ 44.452904] 512-byte region [ffff8801cd160280, ffff8801cd160480)
[ 44.464834] The buggy address belongs to the page:
[ 44.469737] page:ffffea0007345800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0
[ 44.479918] flags: 0x8000000000004080(slab|head)
[ 44.484642] page dumped because: kasan: bad access detected
[ 44.490321]
[ 44.491921] Memory state around the buggy address:
[ 44.496833] ffff8801cd160200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 44.504163] ffff8801cd160280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.511505] >ffff8801cd160300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.518836] ^
[ 44.523999] ffff8801cd160380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.531326] ffff8801cd160400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.538659] ==================================================================
[ 44.546073] Disabling lock debugging due to kernel taint
[ 44.551491] Kernel panic - not syncing: panic_on_warn set ...
[ 44.551491]
[ 44.558838] CPU: 0 PID: 3343 Comm: syzkaller025117 Tainted: G B 4.9.78-g68d447c #23
[ 44.567731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 44.577059] ffff8801c821f838 ffffffff81d943a9 ffffffff841971bf ffff8801c821f910
[ 44.585051] 0000000000000000 ffff8801cd160338 ffff8801cd160338 ffff8801c821f900
[ 44.593023] ffffffff8142f451 0000000041b58ab3 ffffffff8418ac30 ffffffff8142f295
[ 44.600994] Call Trace:
[ 44.603560] [<ffffffff81d943a9>] dump_stack+0xc1/0x128
[ 44.608896] [<ffffffff8142f451>] panic+0x1bc/0x3a8
[ 44.613904] [<ffffffff8142f295>] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7
[ 44.622122] [<ffffffff811309f0>] ? add_taint+0x40/0x50
[ 44.627477] [<ffffffff8153db90>] kasan_end_report+0x50/0x50
[ 44.633259] [<ffffffff8153e037>] kasan_report+0x167/0x360
[ 44.638857] [<ffffffff8123ed1f>] ? __lock_acquire+0x2eff/0x3640
[ 44.644988] [<ffffffff8153e2a4>] __asan_report_load8_noabort+0x14/0x20
[ 44.651715] [<ffffffff8123ed1f>] __lock_acquire+0x2eff/0x3640
[ 44.657663] [<ffffffff8123c449>] ? __lock_acquire+0x629/0x3640
[ 44.663692] [<ffffffff8123be20>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 44.670678] [<ffffffff8123be20>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 44.677662] [<ffffffff8123be20>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 44.684649] [<ffffffff8123b20f>] ? mark_held_locks+0xaf/0x100
[ 44.690597] [<ffffffff838a93c3>] ? mutex_lock_nested+0x5e3/0x870
[ 44.696801] [<ffffffff8123fe9e>] lock_acquire+0x12e/0x410
[ 44.702404] [<ffffffff81224404>] ? remove_wait_queue+0x14/0x40
[ 44.708452] [<ffffffff838b2a8e>] _raw_spin_lock_irqsave+0x4e/0x70
[ 44.714743] [<ffffffff81224404>] ? remove_wait_queue+0x14/0x40
[ 44.720771] [<ffffffff81224404>] remove_wait_queue+0x14/0x40
[ 44.726642] [<ffffffff81650cbf>] ep_unregister_pollwait.isra.6+0xaf/0x240
[ 44.733627] [<ffffffff81650d3a>] ? ep_unregister_pollwait.isra.6+0x12a/0x240
[ 44.740868] [<ffffffff81651b20>] ? ep_free+0x1b0/0x1b0
[ 44.746209] [<ffffffff81651a06>] ep_free+0x96/0x1b0
[ 44.751283] [<ffffffff81651b20>] ? ep_free+0x1b0/0x1b0
[ 44.756619] [<ffffffff81651b64>] ep_eventpoll_release+0x44/0x60
[ 44.762760] [<ffffffff815750bc>] __fput+0x28c/0x6e0
[ 44.767843] [<ffffffff81575595>] ____fput+0x15/0x20
[ 44.772920] [<ffffffff811957c5>] task_work_run+0x115/0x190
[ 44.778624] [<ffffffff8113c267>] do_exit+0x7e7/0x2a40
[ 44.783876] [<ffffffff81bea645>] ? selinux_file_ioctl+0x355/0x530
[ 44.790164] [<ffffffff8113ba80>] ? release_task+0x1240/0x1240
[ 44.796107] [<ffffffff81653a60>] ? SyS_epoll_create+0x190/0x190
[ 44.802227] [<ffffffff838b2c4a>] ? entry_SYSCALL_64_fastpath+0x5/0xe8
[ 44.808867] [<ffffffff81142978>] do_group_exit+0x108/0x320
[ 44.814562] [<ffffffff81142bad>] SyS_exit_group+0x1d/0x20
[ 44.820166] [<ffffffff838b2c6e>] entry_SYSCALL_64_fastpath+0x29/0xe8
[ 44.827140] Dumping ftrace buffer:
[ 44.830665] (ftrace buffer empty)
[ 44.834346] Kernel Offset: disabled
[ 44.837945] Rebooting in 86400 seconds..