INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-3,10.128.15.192' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   45.574542] ==================================================================
[   45.581953] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   45.588936] Write of size 8 at addr ffff8801cf2ab688 by task syzkaller139212/2985
[   45.596522] 
[   45.598122] CPU: 1 PID: 2985 Comm: syzkaller139212 Not tainted 4.14.0-rc4-next-20171009+ #33
[   45.606666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.615988] Call Trace:
[   45.618546]  dump_stack+0x194/0x257
[   45.622148]  ? arch_local_irq_restore+0x53/0x53
[   45.626786]  ? show_regs_print_info+0x65/0x65
[   45.631258]  ? __internal_add_timer+0x275/0x2d0
[   45.635901]  print_address_description+0x73/0x250
[   45.640717]  ? __internal_add_timer+0x275/0x2d0
[   45.645356]  kasan_report+0x25b/0x340
[   45.649130]  __asan_report_store8_noabort+0x17/0x20
[   45.654119]  __internal_add_timer+0x275/0x2d0
[   45.658587]  ? calc_wheel_index+0x200/0x200
[   45.662889]  mod_timer+0x622/0x15b0
[   45.666497]  ? mod_timer_pending+0x14e0/0x14e0
[   45.671048]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   45.676035]  ? trace_hardirqs_on+0xd/0x10
[   45.680158]  ? _crng_backtrack_protect+0xd9/0x130
[   45.684978]  ? __lock_is_held+0xbc/0x140
[   45.689027]  ? __lockdep_init_map+0xe4/0x650
[   45.693415]  ? lockdep_init_map+0x3d/0x70
[   45.697540]  ? rcu_read_lock_sched_held+0x108/0x120
[   45.702526]  ? init_timer_key+0x126/0x3b0
[   45.706647]  ? try_to_del_timer_sync+0x120/0x120
[   45.711376]  ? round_jiffies_up+0xce/0x100
[   45.715581]  ? __round_jiffies_up_relative+0x150/0x150
[   45.720828]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   45.725739]  __tun_chr_ioctl+0x1beb/0x3e40
[   45.729963]  ? tun_chr_read_iter+0x1e0/0x1e0
[   45.734341]  ? lock_downgrade+0x990/0x990
[   45.738481]  ? handle_mm_fault+0x410/0x8d0
[   45.742687]  ? __do_page_fault+0x31e/0xd60
[   45.746904]  ? check_same_owner+0x320/0x320
[   45.751193]  ? up_read+0x1a/0x40
[   45.754528]  ? __do_page_fault+0x3d6/0xd60
[   45.758739]  ? tun_chr_compat_ioctl+0x30/0x30
[   45.763204]  tun_chr_ioctl+0x2a/0x40
[   45.766885]  ? tun_chr_ioctl+0x2a/0x40
[   45.770747]  do_vfs_ioctl+0x1b1/0x1530
[   45.774609]  ? ioctl_preallocate+0x2b0/0x2b0
[   45.778993]  ? selinux_capable+0x40/0x40
[   45.783028]  ? putname+0xf3/0x130
[   45.786456]  ? do_sys_open+0x320/0x6d0
[   45.790326]  ? security_file_ioctl+0x89/0xb0
[   45.794710]  SyS_ioctl+0x8f/0xc0
[   45.798055]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.802778] RIP: 0033:0x443d59
[   45.805943] RSP: 002b:00007fff8d2fc3f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   45.813623] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443d59
[   45.820864] RDX: 0000000020927fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   45.828105] RBP: 0000000000000082 R08: 0000ffff00000000 R09: 0000000000000000
[   45.835344] R10: 000000000000f8ff R11: 0000000000000202 R12: 0000000000401a40
[   45.842585] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   45.849843] 
[   45.851439] Allocated by task 2985:
[   45.855036]  save_stack+0x43/0xd0
[   45.858459]  kasan_kmalloc+0xad/0xe0
[   45.862143]  __kmalloc_node+0x47/0x70
[   45.865917]  kvmalloc_node+0x64/0xd0
[   45.870138]  alloc_netdev_mqs+0x16d/0xed0
[   45.874260]  __tun_chr_ioctl+0x1386/0x3e40
[   45.878461]  tun_chr_ioctl+0x2a/0x40
[   45.882144]  do_vfs_ioctl+0x1b1/0x1530
[   45.886002]  SyS_ioctl+0x8f/0xc0
[   45.889336]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.894058] 
[   45.895655] Freed by task 2985:
[   45.898905]  save_stack+0x43/0xd0
[   45.902325]  kasan_slab_free+0x71/0xc0
[   45.906181]  kfree+0xca/0x250
[   45.909256]  kvfree+0x36/0x60
[   45.912330]  free_netdev+0x2cf/0x360
[   45.916015]  __tun_chr_ioctl+0x2df6/0x3e40
[   45.920217]  tun_chr_ioctl+0x2a/0x40
[   45.923899]  do_vfs_ioctl+0x1b1/0x1530
[   45.927756]  SyS_ioctl+0x8f/0xc0
[   45.931090]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.935814] 
[   45.937414] The buggy address belongs to the object at ffff8801cf2a8280
[   45.937414]  which belongs to the cache kmalloc-16384 of size 16384
[   45.950386] The buggy address is located 13320 bytes inside of
[   45.950386]  16384-byte region [ffff8801cf2a8280, ffff8801cf2ac280)
[   45.962574] The buggy address belongs to the page:
[   45.967473] page:ffffea00073caa00 count:1 mapcount:0 mapping:ffff8801cf2a8280 index:0x0 compound_mapcount: 0
[   45.977419] flags: 0x200000000008100(slab|head)
[   45.982057] raw: 0200000000008100 ffff8801cf2a8280 0000000000000000 0000000100000001
[   45.989906] raw: ffffea0007545420 ffffea0007387a20 ffff8801dac02200 0000000000000000
[   45.997751] page dumped because: kasan: bad access detected
[   46.003427] 
[   46.005022] Memory state around the buggy address:
[   46.009921]  ffff8801cf2ab580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.017251]  ffff8801cf2ab600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.024577] >ffff8801cf2ab680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.031905]                       ^
[   46.035499]  ffff8801cf2ab700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.042824]  ffff8801cf2ab780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.050152] ==================================================================
[   46.057477] Disabling lock debugging due to kernel taint
[   46.062889] Kernel panic - not syncing: panic_on_warn set ...
[   46.062889] 
[   46.070216] CPU: 1 PID: 2985 Comm: syzkaller139212 Tainted: G    B            4.14.0-rc4-next-20171009+ #33
[   46.080053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.089370] Call Trace:
[   46.091924]  dump_stack+0x194/0x257
[   46.095516]  ? arch_local_irq_restore+0x53/0x53
[   46.100148]  ? vprintk_default+0x28/0x30
[   46.104177]  ? __internal_add_timer+0x220/0x2d0
[   46.108810]  panic+0x1e4/0x41c
[   46.111967]  ? refcount_error_report+0x214/0x214
[   46.116691]  ? __internal_add_timer+0x275/0x2d0
[   46.121322]  kasan_end_report+0x50/0x50
[   46.125259]  kasan_report+0x144/0x340
[   46.129025]  __asan_report_store8_noabort+0x17/0x20
[   46.134005]  __internal_add_timer+0x275/0x2d0
[   46.138463]  ? calc_wheel_index+0x200/0x200
[   46.142756]  mod_timer+0x622/0x15b0
[   46.146352]  ? mod_timer_pending+0x14e0/0x14e0
[   46.150898]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   46.155878]  ? trace_hardirqs_on+0xd/0x10
[   46.159993]  ? _crng_backtrack_protect+0xd9/0x130
[   46.164802]  ? __lock_is_held+0xbc/0x140
[   46.168827]  ? __lockdep_init_map+0xe4/0x650
[   46.173200]  ? lockdep_init_map+0x3d/0x70
[   46.177312]  ? rcu_read_lock_sched_held+0x108/0x120
[   46.182292]  ? init_timer_key+0x126/0x3b0
[   46.186406]  ? try_to_del_timer_sync+0x120/0x120
[   46.191126]  ? round_jiffies_up+0xce/0x100
[   46.195326]  ? __round_jiffies_up_relative+0x150/0x150
[   46.200565]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   46.205462]  __tun_chr_ioctl+0x1beb/0x3e40
[   46.209665]  ? tun_chr_read_iter+0x1e0/0x1e0
[   46.214035]  ? lock_downgrade+0x990/0x990
[   46.218160]  ? handle_mm_fault+0x410/0x8d0
[   46.222358]  ? __do_page_fault+0x31e/0xd60
[   46.226562]  ? check_same_owner+0x320/0x320
[   46.230848]  ? up_read+0x1a/0x40
[   46.234177]  ? __do_page_fault+0x3d6/0xd60
[   46.238377]  ? tun_chr_compat_ioctl+0x30/0x30
[   46.242835]  tun_chr_ioctl+0x2a/0x40
[   46.246511]  ? tun_chr_ioctl+0x2a/0x40
[   46.250363]  do_vfs_ioctl+0x1b1/0x1530
[   46.254217]  ? ioctl_preallocate+0x2b0/0x2b0
[   46.258591]  ? selinux_capable+0x40/0x40
[   46.262616]  ? putname+0xf3/0x130
[   46.266040]  ? do_sys_open+0x320/0x6d0
[   46.269900]  ? security_file_ioctl+0x89/0xb0
[   46.274272]  SyS_ioctl+0x8f/0xc0
[   46.277606]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   46.282324] RIP: 0033:0x443d59
[   46.285480] RSP: 002b:00007fff8d2fc3f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   46.293149] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443d59
[   46.300382] RDX: 0000000020927fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   46.307616] RBP: 0000000000000082 R08: 0000ffff00000000 R09: 0000000000000000
[   46.314850] R10: 000000000000f8ff R11: 0000000000000202 R12: 0000000000401a40
[   46.322086] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   46.329366] Dumping ftrace buffer:
[   46.332873]    (ftrace buffer empty)
[   46.336546] Kernel Offset: disabled
[   46.340138] Rebooting in 86400 seconds..