INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-9,10.128.0.18' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   32.262593] ==================================================================
[   32.270007] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   32.276996] Write of size 8 at addr ffff8801cc97b6c8 by task syzkaller929267/3037
[   32.284587] 
[   32.286191] CPU: 0 PID: 3037 Comm: syzkaller929267 Not tainted 4.13.0+ #69
[   32.293172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   32.302502] Call Trace:
[   32.305070]  dump_stack+0x194/0x257
[   32.308672]  ? arch_local_irq_restore+0x53/0x53
[   32.313318]  ? show_regs_print_info+0x65/0x65
[   32.317793]  ? __kernel_text_address+0xae/0xe0
[   32.322351]  ? __internal_add_timer+0x275/0x2d0
[   32.327002]  print_address_description+0x73/0x250
[   32.331825]  ? __internal_add_timer+0x275/0x2d0
[   32.336473]  kasan_report+0x24e/0x340
[   32.340256]  __asan_report_store8_noabort+0x17/0x20
[   32.345252]  __internal_add_timer+0x275/0x2d0
[   32.349726]  ? calc_wheel_index+0x200/0x200
[   32.354036]  mod_timer+0x622/0x15b0
[   32.357645]  ? mod_timer_pending+0x14e0/0x14e0
[   32.362199]  ? __lock_is_held+0xbc/0x140
[   32.366247]  ? __lock_is_held+0xbc/0x140
[   32.370285]  ? __lockdep_init_map+0xe4/0x650
[   32.374678]  ? lockdep_init_map+0x3d/0x70
[   32.378801]  ? rcu_read_lock_sched_held+0x108/0x120
[   32.383803]  ? init_timer_key+0x126/0x3b0
[   32.387941]  ? try_to_del_timer_sync+0x120/0x120
[   32.392692]  ? round_jiffies_up+0xce/0x100
[   32.396907]  ? __round_jiffies_up_relative+0x150/0x150
[   32.402162]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   32.407086]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   32.412638]  __tun_chr_ioctl+0x1b2c/0x3d70
[   32.416860]  ? tun_select_queue+0x580/0x580
[   32.421168]  ? lock_downgrade+0x990/0x990
[   32.425321]  ? check_same_owner+0x320/0x320
[   32.429619]  ? __handle_mm_fault+0x3840/0x3840
[   32.434172]  ? vmacache_find+0x61/0x270
[   32.438121]  ? tun_chr_compat_ioctl+0x30/0x30
[   32.442587]  tun_chr_ioctl+0x2a/0x40
[   32.446276]  ? tun_chr_ioctl+0x2a/0x40
[   32.450148]  do_vfs_ioctl+0x1b1/0x1530
[   32.454022]  ? ioctl_preallocate+0x2b0/0x2b0
[   32.458421]  ? selinux_capable+0x40/0x40
[   32.462466]  ? putname+0xf3/0x130
[   32.465894]  ? do_sys_open+0x320/0x6d0
[   32.469759]  ? security_file_ioctl+0x7d/0xb0
[   32.474134]  ? security_file_ioctl+0x89/0xb0
[   32.478517]  SyS_ioctl+0x8f/0xc0
[   32.481868]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   32.486594] RIP: 0033:0x443d69
[   32.489753] RSP: 002b:00007ffc004ee148 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   32.497464] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443d69
[   32.504707] RDX: 0000000020fbb000 RSI: 00000000400454ca RDI: 0000000000000004
[   32.511952] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   32.519195] R10: 0000000000000000 R11: 0000000000000206 R12: 30593f3574d491be
[   32.526454] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   32.533721] 
[   32.535327] Allocated by task 3037:
[   32.538932]  save_stack_trace+0x16/0x20
[   32.542884]  save_stack+0x43/0xd0
[   32.546321]  kasan_kmalloc+0xad/0xe0
[   32.550015]  __kmalloc_node+0x47/0x70
[   32.553795]  kvmalloc_node+0x64/0xd0
[   32.557490]  alloc_netdev_mqs+0x16e/0xed0
[   32.561618]  __tun_chr_ioctl+0x12be/0x3d70
[   32.565828]  tun_chr_ioctl+0x2a/0x40
[   32.569517]  do_vfs_ioctl+0x1b1/0x1530
[   32.573374]  SyS_ioctl+0x8f/0xc0
[   32.576715]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   32.581450] 
[   32.583047] Freed by task 3037:
[   32.586297]  save_stack_trace+0x16/0x20
[   32.590245]  save_stack+0x43/0xd0
[   32.593665]  kasan_slab_free+0x71/0xc0
[   32.597522]  kfree+0xca/0x250
[   32.600598]  kvfree+0x36/0x60
[   32.603674]  free_netdev+0x2cf/0x360
[   32.607367]  __tun_chr_ioctl+0x2d30/0x3d70
[   32.611581]  tun_chr_ioctl+0x2a/0x40
[   32.615266]  do_vfs_ioctl+0x1b1/0x1530
[   32.619122]  SyS_ioctl+0x8f/0xc0
[   32.622457]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   32.627176] 
[   32.628775] The buggy address belongs to the object at ffff8801cc9782c0
[   32.628775]  which belongs to the cache kmalloc-16384 of size 16384
[   32.641748] The buggy address is located 13320 bytes inside of
[   32.641748]  16384-byte region [ffff8801cc9782c0, ffff8801cc97c2c0)
[   32.653946] The buggy address belongs to the page:
[   32.658845] page:ffffea0007325e00 count:1 mapcount:0 mapping:ffff8801cc9782c0 index:0x0 compound_mapcount: 0
[   32.668814] flags: 0x200000000008100(slab|head)
[   32.673458] raw: 0200000000008100 ffff8801cc9782c0 0000000000000000 0000000100000001
[   32.681313] raw: ffffea00072a1020 ffffea0007356620 ffff8801dac02200 0000000000000000
[   32.689163] page dumped because: kasan: bad access detected
[   32.694836] 
[   32.696430] Memory state around the buggy address:
[   32.701331]  ffff8801cc97b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   32.708660]  ffff8801cc97b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   32.715992] >ffff8801cc97b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   32.723319]                                               ^
[   32.728995]  ffff8801cc97b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   32.736330]  ffff8801cc97b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   32.743661] ==================================================================
[   32.750989] Disabling lock debugging due to kernel taint
[   32.756402] Kernel panic - not syncing: panic_on_warn set ...
[   32.756402] 
[   32.763730] CPU: 0 PID: 3037 Comm: syzkaller929267 Tainted: G    B           4.13.0+ #69
[   32.771920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   32.781239] Call Trace:
[   32.783799]  dump_stack+0x194/0x257
[   32.787397]  ? arch_local_irq_restore+0x53/0x53
[   32.792031]  ? vprintk_default+0x28/0x30
[   32.796057]  ? __internal_add_timer+0x250/0x2d0
[   32.800709]  panic+0x1e4/0x417
[   32.803866]  ? __warn+0x1d9/0x1d9
[   32.807291]  ? __internal_add_timer+0x275/0x2d0
[   32.811928]  kasan_end_report+0x50/0x50
[   32.815865]  kasan_report+0x137/0x340
[   32.819635]  __asan_report_store8_noabort+0x17/0x20
[   32.824617]  __internal_add_timer+0x275/0x2d0
[   32.829079]  ? calc_wheel_index+0x200/0x200
[   32.833371]  mod_timer+0x622/0x15b0
[   32.836968]  ? mod_timer_pending+0x14e0/0x14e0
[   32.841515]  ? __lock_is_held+0xbc/0x140
[   32.845578]  ? __lock_is_held+0xbc/0x140
[   32.849609]  ? __lockdep_init_map+0xe4/0x650
[   32.854002]  ? lockdep_init_map+0x3d/0x70
[   32.858117]  ? rcu_read_lock_sched_held+0x108/0x120
[   32.863097]  ? init_timer_key+0x126/0x3b0
[   32.867213]  ? try_to_del_timer_sync+0x120/0x120
[   32.871933]  ? round_jiffies_up+0xce/0x100
[   32.876135]  ? __round_jiffies_up_relative+0x150/0x150
[   32.881414]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   32.886326]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   32.891838]  __tun_chr_ioctl+0x1b2c/0x3d70
[   32.896062]  ? tun_select_queue+0x580/0x580
[   32.900369]  ? lock_downgrade+0x990/0x990
[   32.904524]  ? check_same_owner+0x320/0x320
[   32.908834]  ? __handle_mm_fault+0x3840/0x3840
[   32.913383]  ? vmacache_find+0x61/0x270
[   32.917328]  ? tun_chr_compat_ioctl+0x30/0x30
[   32.921788]  tun_chr_ioctl+0x2a/0x40
[   32.925467]  ? tun_chr_ioctl+0x2a/0x40
[   32.929335]  do_vfs_ioctl+0x1b1/0x1530
[   32.933217]  ? ioctl_preallocate+0x2b0/0x2b0
[   32.937592]  ? selinux_capable+0x40/0x40
[   32.941619]  ? putname+0xf3/0x130
[   32.945063]  ? do_sys_open+0x320/0x6d0
[   32.948924]  ? security_file_ioctl+0x7d/0xb0
[   32.953297]  ? security_file_ioctl+0x89/0xb0
[   32.957684]  SyS_ioctl+0x8f/0xc0
[   32.961019]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   32.965736] RIP: 0033:0x443d69
[   32.968888] RSP: 002b:00007ffc004ee148 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   32.976572] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443d69
[   32.983807] RDX: 0000000020fbb000 RSI: 00000000400454ca RDI: 0000000000000004
[   32.991041] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   32.998272] R10: 0000000000000000 R11: 0000000000000206 R12: 30593f3574d491be
[   33.005510] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   33.013036] Dumping ftrace buffer:
[   33.016550]    (ftrace buffer empty)
[   33.020224] Kernel Offset: disabled
[   33.023817] Rebooting in 86400 seconds..