INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-3,10.128.0.15' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   30.565332] ==================================================================
[   30.572776] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   30.579499] Write of size 8 at addr ffff8801cd88b740 by task syzkaller795240/2985
[   30.587084] 
[   30.588683] CPU: 1 PID: 2985 Comm: syzkaller795240 Not tainted 4.14.0-rc2+ #105
[   30.596095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   30.605418] Call Trace:
[   30.607977]  dump_stack+0x194/0x257
[   30.611577]  ? arch_local_irq_restore+0x53/0x53
[   30.616217]  ? show_regs_print_info+0x65/0x65
[   30.620684]  ? lock_timer_base+0x1a3/0x2b0
[   30.624891]  ? detach_if_pending+0x557/0x610
[   30.629274]  print_address_description+0x73/0x250
[   30.634087]  ? detach_if_pending+0x557/0x610
[   30.638467]  kasan_report+0x25b/0x340
[   30.642243]  __asan_report_store8_noabort+0x17/0x20
[   30.647242]  detach_if_pending+0x557/0x610
[   30.651450]  ? trace_raw_output_tick_stop+0x130/0x130
[   30.656612]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   30.661251]  ? lock_timer_base+0x1a3/0x2b0
[   30.665456]  ? lock_timer_base+0x1eb/0x2b0
[   30.669665]  ? __internal_add_timer+0x2d0/0x2d0
[   30.674305]  ? trace_hardirqs_on+0xd/0x10
[   30.678432]  try_to_del_timer_sync+0xa2/0x120
[   30.682897]  ? del_timer+0x130/0x130
[   30.686581]  ? del_timer_sync+0xeb/0x240
[   30.690619]  del_timer_sync+0x18a/0x240
[   30.694566]  tun_free_netdev+0x105/0x1b0
[   30.698596]  ? tun_xdp+0x410/0x410
[   30.702102]  ? cpumask_next+0x24/0x30
[   30.705876]  ? netdev_refcnt_read+0xed/0x150
[   30.710258]  ? tun_xdp+0x410/0x410
[   30.713768]  netdev_run_todo+0x870/0xca0
[   30.717799]  ? do_group_exit+0x149/0x400
[   30.721836]  ? register_netdev+0x30/0x30
[   30.725868]  ? lock_downgrade+0x990/0x990
[   30.729987]  ? trace_hardirqs_on+0xd/0x10
[   30.734123]  ? refcount_sub_and_test+0x115/0x1b0
[   30.738849]  ? refcount_inc+0x50/0x50
[   30.742619]  ? refcount_inc+0x50/0x50
[   30.746397]  ? sk_destruct+0x4c/0x80
[   30.750079]  ? __sk_free+0x5c/0x230
[   30.753676]  ? sk_free+0x2f/0x40
[   30.757011]  ? __tun_detach+0x176/0x1390
[   30.761053]  ? tun_attach+0xf90/0xf90
[   30.764832]  ? do_raw_spin_trylock+0x190/0x190
[   30.769389]  ? locks_remove_file+0x3fa/0x5a0
[   30.773772]  ? fcntl_setlk+0x10d0/0x10d0
[   30.777818]  ? __fsnotify_parent+0xb4/0x3a0
[   30.782112]  ? fsnotify+0x1af0/0x1af0
[   30.785890]  ? __tun_detach+0x1390/0x1390
[   30.790009]  rtnl_unlock+0xe/0x10
[   30.793430]  tun_chr_close+0x49/0x60
[   30.797114]  __fput+0x333/0x7f0
[   30.800369]  ? fput+0x140/0x140
[   30.803620]  ? check_same_owner+0x320/0x320
[   30.807910]  ? _raw_spin_unlock_irq+0x27/0x70
[   30.812380]  ____fput+0x15/0x20
[   30.815638]  task_work_run+0x199/0x270
[   30.819499]  ? task_work_cancel+0x210/0x210
[   30.823790]  ? _raw_spin_unlock+0x22/0x30
[   30.827910]  ? switch_task_namespaces+0x87/0xc0
[   30.832553]  do_exit+0x9d2/0x1af0
[   30.835981]  ? mm_update_next_owner+0x930/0x930
[   30.840620]  ? __pmd_alloc+0x4e0/0x4e0
[   30.844486]  ? find_held_lock+0x39/0x1d0
[   30.848527]  ? lock_downgrade+0x990/0x990
[   30.852668]  ? handle_mm_fault+0x410/0x8d0
[   30.856870]  ? down_read_trylock+0xdb/0x170
[   30.861174]  ? __handle_mm_fault+0x39c0/0x39c0
[   30.865727]  ? vmacache_find+0x5f/0x280
[   30.869680]  ? up_read+0x1a/0x40
[   30.873021]  ? __do_page_fault+0x35b/0xb60
[   30.877235]  ? do_vfs_ioctl+0x492/0x1530
[   30.881275]  ? do_page_fault+0xee/0x720
[   30.885221]  ? __do_page_fault+0xb60/0xb60
[   30.889426]  ? putname+0xf3/0x130
[   30.892854]  do_group_exit+0x149/0x400
[   30.896714]  ? lockdep_sys_exit+0x47/0xf0
[   30.900831]  ? SyS_exit+0x30/0x30
[   30.904255]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   30.909243]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   30.913971]  SyS_exit_group+0x1d/0x20
[   30.917741]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   30.922463] RIP: 0033:0x443ae8
[   30.925623] RSP: 002b:00007ffc3c9937f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   30.933305] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443ae8
[   30.940543] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   30.947782] RBP: 0000000000000086 R08: 00000000000000e7 R09: ffffffffffffffd4
[   30.955022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[   30.962261] R13: 00000000006d6180 R14: 0000000000000000 R15: 0000000000000000
[   30.969517] 
[   30.971113] Allocated by task 2985:
[   30.974708]  save_stack_trace+0x16/0x20
[   30.978652]  save_stack+0x43/0xd0
[   30.982072]  kasan_kmalloc+0xad/0xe0
[   30.985752]  __kmalloc_node+0x47/0x70
[   30.989519]  kvmalloc_node+0x64/0xd0
[   30.993203]  alloc_netdev_mqs+0x16e/0xed0
[   30.997318]  __tun_chr_ioctl+0x12be/0x3d20
[   31.001522]  tun_chr_ioctl+0x2a/0x40
[   31.005204]  do_vfs_ioctl+0x1b1/0x1530
[   31.009058]  SyS_ioctl+0x8f/0xc0
[   31.012392]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   31.017112] 
[   31.018709] Freed by task 2985:
[   31.021965]  save_stack_trace+0x16/0x20
[   31.025907]  save_stack+0x43/0xd0
[   31.029328]  kasan_slab_free+0x71/0xc0
[   31.033183]  kfree+0xca/0x250
[   31.036258]  kvfree+0x36/0x60
[   31.039332]  free_netdev+0x2cf/0x360
[   31.043024]  __tun_chr_ioctl+0x2cf6/0x3d20
[   31.047228]  tun_chr_ioctl+0x2a/0x40
[   31.050910]  do_vfs_ioctl+0x1b1/0x1530
[   31.054764]  SyS_ioctl+0x8f/0xc0
[   31.058100]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   31.062821] 
[   31.064421] The buggy address belongs to the object at ffff8801cd888340
[   31.064421]  which belongs to the cache kmalloc-16384 of size 16384
[   31.077393] The buggy address is located 13312 bytes inside of
[   31.077393]  16384-byte region [ffff8801cd888340, ffff8801cd88c340)
[   31.089580] The buggy address belongs to the page:
[   31.094478] page:ffffea0007362200 count:1 mapcount:0 mapping:ffff8801cd888340 index:0x0 compound_mapcount: 0
[   31.104421] flags: 0x200000000008100(slab|head)
[   31.109060] raw: 0200000000008100 ffff8801cd888340 0000000000000000 0000000100000001
[   31.116908] raw: ffffea0007376820 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   31.124752] page dumped because: kasan: bad access detected
[   31.130426] 
[   31.132021] Memory state around the buggy address:
[   31.136916]  ffff8801cd88b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   31.144244]  ffff8801cd88b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   31.151570] >ffff8801cd88b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   31.158895]                                            ^
[   31.164313]  ffff8801cd88b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   31.171641]  ffff8801cd88b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   31.178967] ==================================================================
[   31.186294] Disabling lock debugging due to kernel taint
[   31.191708] Kernel panic - not syncing: panic_on_warn set ...
[   31.191708] 
[   31.199044] CPU: 1 PID: 2985 Comm: syzkaller795240 Tainted: G    B           4.14.0-rc2+ #105
[   31.207677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   31.216995] Call Trace:
[   31.219550]  dump_stack+0x194/0x257
[   31.223142]  ? arch_local_irq_restore+0x53/0x53
[   31.227776]  ? vprintk_default+0x28/0x30
[   31.231813]  ? detach_if_pending+0x540/0x610
[   31.236190]  panic+0x1e4/0x417
[   31.239347]  ? __warn+0x1d9/0x1d9
[   31.242774]  ? detach_if_pending+0x557/0x610
[   31.247144]  kasan_end_report+0x50/0x50
[   31.251083]  kasan_report+0x144/0x340
[   31.254850]  __asan_report_store8_noabort+0x17/0x20
[   31.259828]  detach_if_pending+0x557/0x610
[   31.264028]  ? trace_raw_output_tick_stop+0x130/0x130
[   31.269182]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   31.273815]  ? lock_timer_base+0x1a3/0x2b0
[   31.278014]  ? lock_timer_base+0x1eb/0x2b0
[   31.282215]  ? __internal_add_timer+0x2d0/0x2d0
[   31.286851]  ? trace_hardirqs_on+0xd/0x10
[   31.290967]  try_to_del_timer_sync+0xa2/0x120
[   31.295427]  ? del_timer+0x130/0x130
[   31.299105]  ? del_timer_sync+0xeb/0x240
[   31.303131]  del_timer_sync+0x18a/0x240
[   31.307069]  tun_free_netdev+0x105/0x1b0
[   31.311092]  ? tun_xdp+0x410/0x410
[   31.314595]  ? cpumask_next+0x24/0x30
[   31.318363]  ? netdev_refcnt_read+0xed/0x150
[   31.322736]  ? tun_xdp+0x410/0x410
[   31.326241]  netdev_run_todo+0x870/0xca0
[   31.330266]  ? do_group_exit+0x149/0x400
[   31.334293]  ? register_netdev+0x30/0x30
[   31.338318]  ? lock_downgrade+0x990/0x990
[   31.342439]  ? trace_hardirqs_on+0xd/0x10
[   31.346561]  ? refcount_sub_and_test+0x115/0x1b0
[   31.351280]  ? refcount_inc+0x50/0x50
[   31.355045]  ? refcount_inc+0x50/0x50
[   31.358815]  ? sk_destruct+0x4c/0x80
[   31.362491]  ? __sk_free+0x5c/0x230
[   31.366081]  ? sk_free+0x2f/0x40
[   31.369411]  ? __tun_detach+0x176/0x1390
[   31.373442]  ? tun_attach+0xf90/0xf90
[   31.377209]  ? do_raw_spin_trylock+0x190/0x190
[   31.381758]  ? locks_remove_file+0x3fa/0x5a0
[   31.386131]  ? fcntl_setlk+0x10d0/0x10d0
[   31.390592]  ? __fsnotify_parent+0xb4/0x3a0
[   31.394896]  ? fsnotify+0x1af0/0x1af0
[   31.398664]  ? __tun_detach+0x1390/0x1390
[   31.402775]  rtnl_unlock+0xe/0x10
[   31.406190]  tun_chr_close+0x49/0x60
[   31.409866]  __fput+0x333/0x7f0
[   31.413112]  ? fput+0x140/0x140
[   31.416357]  ? check_same_owner+0x320/0x320
[   31.420642]  ? _raw_spin_unlock_irq+0x27/0x70
[   31.425104]  ____fput+0x15/0x20
[   31.428351]  task_work_run+0x199/0x270
[   31.432206]  ? task_work_cancel+0x210/0x210
[   31.436493]  ? _raw_spin_unlock+0x22/0x30
[   31.440606]  ? switch_task_namespaces+0x87/0xc0
[   31.445241]  do_exit+0x9d2/0x1af0
[   31.448662]  ? mm_update_next_owner+0x930/0x930
[   31.453295]  ? __pmd_alloc+0x4e0/0x4e0
[   31.457164]  ? find_held_lock+0x39/0x1d0
[   31.461201]  ? lock_downgrade+0x990/0x990
[   31.465324]  ? handle_mm_fault+0x410/0x8d0
[   31.469522]  ? down_read_trylock+0xdb/0x170
[   31.473808]  ? __handle_mm_fault+0x39c0/0x39c0
[   31.478356]  ? vmacache_find+0x5f/0x280
[   31.482302]  ? up_read+0x1a/0x40
[   31.485635]  ? __do_page_fault+0x35b/0xb60
[   31.489832]  ? do_vfs_ioctl+0x492/0x1530
[   31.493865]  ? do_page_fault+0xee/0x720
[   31.497804]  ? __do_page_fault+0xb60/0xb60
[   31.502002]  ? putname+0xf3/0x130
[   31.505423]  do_group_exit+0x149/0x400
[   31.509274]  ? lockdep_sys_exit+0x47/0xf0
[   31.513385]  ? SyS_exit+0x30/0x30
[   31.516804]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   31.521786]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   31.526506]  SyS_exit_group+0x1d/0x20
[   31.530272]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   31.534990] RIP: 0033:0x443ae8
[   31.538142] RSP: 002b:00007ffc3c9937f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   31.545813] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443ae8
[   31.553047] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   31.560282] RBP: 0000000000000086 R08: 00000000000000e7 R09: ffffffffffffffd4