INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-4,10.128.15.209' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   48.283312] ==================================================================
[   48.290753] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   48.297762] Write of size 8 at addr ffff8801cc46b6c8 by task syzkaller884634/3041
[   48.305394] 
[   48.307009] CPU: 1 PID: 3041 Comm: syzkaller884634 Not tainted 4.13.0+ #70
[   48.314005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.323361] Call Trace:
[   48.325941]  dump_stack+0x194/0x257
[   48.329574]  ? arch_local_irq_restore+0x53/0x53
[   48.334243]  ? show_regs_print_info+0x65/0x65
[   48.338765]  ? __kernel_text_address+0xae/0xe0
[   48.343754]  ? __internal_add_timer+0x275/0x2d0
[   48.348452]  print_address_description+0x73/0x250
[   48.353290]  ? __internal_add_timer+0x275/0x2d0
[   48.357996]  kasan_report+0x24e/0x340
[   48.361797]  __asan_report_store8_noabort+0x17/0x20
[   48.366841]  __internal_add_timer+0x275/0x2d0
[   48.371334]  ? calc_wheel_index+0x200/0x200
[   48.375837]  mod_timer+0x622/0x15b0
[   48.379497]  ? mod_timer_pending+0x14e0/0x14e0
[   48.384106]  ? __lock_is_held+0xbc/0x140
[   48.388195]  ? __lock_is_held+0xbc/0x140
[   48.392267]  ? __lockdep_init_map+0xe4/0x650
[   48.396687]  ? lockdep_init_map+0x3d/0x70
[   48.400845]  ? rcu_read_lock_sched_held+0x108/0x120
[   48.405898]  ? init_timer_key+0x126/0x3b0
[   48.410052]  ? try_to_del_timer_sync+0x120/0x120
[   48.414822]  ? round_jiffies_up+0xce/0x100
[   48.419053]  ? __round_jiffies_up_relative+0x150/0x150
[   48.424394]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   48.429324]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   48.434911]  __tun_chr_ioctl+0x1b2c/0x3d70
[   48.439156]  ? tun_select_queue+0x580/0x580
[   48.443982]  ? lock_downgrade+0x990/0x990
[   48.448157]  ? check_same_owner+0x320/0x320
[   48.452477]  ? __handle_mm_fault+0x3840/0x3840
[   48.457062]  ? vmacache_find+0x61/0x270
[   48.461127]  ? tun_chr_compat_ioctl+0x30/0x30
[   48.465667]  tun_chr_ioctl+0x2a/0x40
[   48.469412]  ? tun_chr_ioctl+0x2a/0x40
[   48.473296]  do_vfs_ioctl+0x1b1/0x1530
[   48.477196]  ? ioctl_preallocate+0x2b0/0x2b0
[   48.481605]  ? selinux_capable+0x40/0x40
[   48.485665]  ? putname+0xf3/0x130
[   48.489173]  ? do_sys_open+0x320/0x6d0
[   48.493123]  ? security_file_ioctl+0x7d/0xb0
[   48.497527]  ? security_file_ioctl+0x89/0xb0
[   48.501977]  SyS_ioctl+0x8f/0xc0
[   48.505391]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.510176] RIP: 0033:0x443db9
[   48.513364] RSP: 002b:00007fff43f5a4d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   48.521118] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   48.528424] RDX: 0000000020c12000 RSI: 00000000400454ca RDI: 0000000000000004
[   48.535881] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   48.543700] R10: 0000000000000000 R11: 0000000000000206 R12: 254ddb1cc9599d7e
[   48.550968] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   48.558299] 
[   48.559921] Allocated by task 3041:
[   48.563539]  save_stack_trace+0x16/0x20
[   48.567564]  save_stack+0x43/0xd0
[   48.571011]  kasan_kmalloc+0xad/0xe0
[   48.574764]  __kmalloc_node+0x47/0x70
[   48.578571]  kvmalloc_node+0x64/0xd0
[   48.582290]  alloc_netdev_mqs+0x16e/0xed0
[   48.586440]  __tun_chr_ioctl+0x12be/0x3d70
[   48.590713]  tun_chr_ioctl+0x2a/0x40
[   48.594452]  do_vfs_ioctl+0x1b1/0x1530
[   48.598368]  SyS_ioctl+0x8f/0xc0
[   48.601729]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.606508] 
[   48.608129] Freed by task 3041:
[   48.611416]  save_stack_trace+0x16/0x20
[   48.615431]  save_stack+0x43/0xd0
[   48.618889]  kasan_slab_free+0x71/0xc0
[   48.622782]  kfree+0xca/0x250
[   48.625932]  kvfree+0x36/0x60
[   48.629042]  free_netdev+0x2cf/0x360
[   48.632904]  __tun_chr_ioctl+0x2d30/0x3d70
[   48.637209]  tun_chr_ioctl+0x2a/0x40
[   48.640954]  do_vfs_ioctl+0x1b1/0x1530
[   48.644894]  SyS_ioctl+0x8f/0xc0
[   48.648308]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.653133] 
[   48.654763] The buggy address belongs to the object at ffff8801cc4682c0
[   48.654763]  which belongs to the cache kmalloc-16384 of size 16384
[   48.667812] The buggy address is located 13320 bytes inside of
[   48.667812]  16384-byte region [ffff8801cc4682c0, ffff8801cc46c2c0)
[   48.680089] The buggy address belongs to the page:
[   48.685022] page:ffffea0007311a00 count:1 mapcount:0 mapping:ffff8801cc4682c0 index:0x0 compound_mapcount: 0
[   48.694995] flags: 0x200000000008100(slab|head)
[   48.699654] raw: 0200000000008100 ffff8801cc4682c0 0000000000000000 0000000100000001
[   48.707565] raw: ffffea00074f8a20 ffffea0007313220 ffff8801dac02200 0000000000000000
[   48.715487] page dumped because: kasan: bad access detected
[   48.721192] 
[   48.722806] Memory state around the buggy address:
[   48.727763]  ffff8801cc46b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.735119]  ffff8801cc46b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.743161] >ffff8801cc46b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.750519]                                               ^
[   48.756282]  ffff8801cc46b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.763638]  ffff8801cc46b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.770991] ==================================================================
[   48.778346] Disabling lock debugging due to kernel taint
[   48.783789] Kernel panic - not syncing: panic_on_warn set ...
[   48.783789] 
[   48.791187] CPU: 1 PID: 3041 Comm: syzkaller884634 Tainted: G    B           4.13.0+ #70
[   48.799404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.808748] Call Trace:
[   48.811334]  dump_stack+0x194/0x257
[   48.814951]  ? arch_local_irq_restore+0x53/0x53
[   48.819695]  ? vprintk_default+0x28/0x30
[   48.823833]  ? __internal_add_timer+0x1a0/0x2d0
[   48.828501]  panic+0x1e4/0x417
[   48.831740]  ? __warn+0x1d9/0x1d9
[   48.835197]  ? __internal_add_timer+0x275/0x2d0
[   48.839895]  kasan_end_report+0x50/0x50
[   48.844428]  kasan_report+0x137/0x340
[   48.848391]  __asan_report_store8_noabort+0x17/0x20
[   48.853414]  __internal_add_timer+0x275/0x2d0
[   48.857909]  ? calc_wheel_index+0x200/0x200
[   48.862318]  mod_timer+0x622/0x15b0
[   48.865937]  ? mod_timer_pending+0x14e0/0x14e0
[   48.870654]  ? __lock_is_held+0xbc/0x140
[   48.874721]  ? __lock_is_held+0xbc/0x140
[   48.878779]  ? __lockdep_init_map+0xe4/0x650
[   48.883185]  ? lockdep_init_map+0x3d/0x70
[   48.887332]  ? rcu_read_lock_sched_held+0x108/0x120
[   48.892335]  ? init_timer_key+0x126/0x3b0
[   48.896576]  ? try_to_del_timer_sync+0x120/0x120
[   48.901321]  ? round_jiffies_up+0xce/0x100
[   48.905591]  ? __round_jiffies_up_relative+0x150/0x150
[   48.910866]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   48.915783]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   48.921348]  __tun_chr_ioctl+0x1b2c/0x3d70
[   48.925619]  ? tun_select_queue+0x580/0x580
[   48.929934]  ? lock_downgrade+0x990/0x990
[   48.934102]  ? check_same_owner+0x320/0x320
[   48.938421]  ? __handle_mm_fault+0x3840/0x3840
[   48.943619]  ? vmacache_find+0x61/0x270
[   48.947596]  ? tun_chr_compat_ioctl+0x30/0x30
[   48.952148]  tun_chr_ioctl+0x2a/0x40
[   48.955846]  ? tun_chr_ioctl+0x2a/0x40
[   48.959730]  do_vfs_ioctl+0x1b1/0x1530
[   48.963611]  ? ioctl_preallocate+0x2b0/0x2b0
[   48.968008]  ? selinux_capable+0x40/0x40
[   48.972090]  ? putname+0xf3/0x130
[   48.975572]  ? do_sys_open+0x320/0x6d0
[   48.979452]  ? security_file_ioctl+0x7d/0xb0
[   48.983892]  ? security_file_ioctl+0x89/0xb0
[   48.988291]  SyS_ioctl+0x8f/0xc0
[   48.991652]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.996389] RIP: 0033:0x443db9
[   48.999559] RSP: 002b:00007fff43f5a4d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   49.007288] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   49.014588] RDX: 0000000020c12000 RSI: 00000000400454ca RDI: 0000000000000004
[   49.021850] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   49.029154] R10: 0000000000000000 R11: 0000000000000206 R12: 254ddb1cc9599d7e
[   49.036441] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   49.044741] Dumping ftrace buffer:
[   49.048314]    (ftrace buffer empty)
[   49.052009] Kernel Offset: disabled
[   49.055677] Rebooting in 86400 seconds..