INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-4,10.128.15.196' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   30.317461] ==================================================================
[   30.324908] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   30.331638] Write of size 8 at addr ffff8801ce1d3780 by task syzkaller971859/2981
[   30.339245] 
[   30.340865] CPU: 0 PID: 2981 Comm: syzkaller971859 Not tainted 4.13.0-mm1+ #7
[   30.348121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   30.357455] Call Trace:
[   30.360022]  dump_stack+0x194/0x257
[   30.363661]  ? arch_local_irq_restore+0x53/0x53
[   30.368307]  ? show_regs_print_info+0x65/0x65
[   30.372780]  ? lock_timer_base+0x1a3/0x2b0
[   30.376992]  ? detach_if_pending+0x557/0x610
[   30.381388]  print_address_description+0x73/0x250
[   30.386218]  ? detach_if_pending+0x557/0x610
[   30.390607]  kasan_report+0x24e/0x340
[   30.394389]  __asan_report_store8_noabort+0x17/0x20
[   30.399388]  detach_if_pending+0x557/0x610
[   30.403606]  ? trace_raw_output_tick_stop+0x130/0x130
[   30.408774]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   30.413413]  ? lock_timer_base+0x1a3/0x2b0
[   30.417624]  ? lock_timer_base+0x1eb/0x2b0
[   30.421839]  ? __internal_add_timer+0x2d0/0x2d0
[   30.426496]  ? trace_hardirqs_on+0xd/0x10
[   30.430639]  try_to_del_timer_sync+0xa2/0x120
[   30.435109]  ? del_timer+0x130/0x130
[   30.438799]  ? del_timer_sync+0xeb/0x240
[   30.442850]  del_timer_sync+0x18a/0x240
[   30.446803]  tun_free_netdev+0x105/0x1b0
[   30.450838]  ? tun_xdp+0x410/0x410
[   30.454360]  ? cpumask_next+0x24/0x30
[   30.458142]  ? netdev_refcnt_read+0xed/0x150
[   30.462540]  ? tun_xdp+0x410/0x410
[   30.466059]  netdev_run_todo+0x870/0xca0
[   30.470093]  ? do_group_exit+0x149/0x400
[   30.474135]  ? register_netdev+0x30/0x30
[   30.478188]  ? mark_held_locks+0xb2/0x100
[   30.482321]  ? lock_downgrade+0x990/0x990
[   30.486458]  ? retint_kernel+0x10/0x10
[   30.490335]  ? __tun_detach+0xbf3/0x1390
[   30.494386]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   30.499410]  ? retint_kernel+0x10/0x10
[   30.503286]  ? refcount_sub_and_test+0x115/0x1b0
[   30.508023]  ? refcount_inc+0x50/0x50
[   30.511798]  ? refcount_inc+0x50/0x50
[   30.515578]  ? sk_destruct+0x4c/0x80
[   30.519272]  ? __sk_free+0x5c/0x230
[   30.522879]  ? sk_free+0x2f/0x40
[   30.526226]  ? __tun_detach+0x176/0x1390
[   30.530296]  ? tun_attach+0xf90/0xf90
[   30.534274]  ? locks_remove_file+0x3fa/0x5a0
[   30.538669]  ? fcntl_setlk+0x10d0/0x10d0
[   30.542705]  ? __fsnotify_parent+0xb4/0x3a0
[   30.547005]  ? fsnotify+0x1af0/0x1af0
[   30.550784]  ? __tun_detach+0x1390/0x1390
[   30.554905]  ? __tun_detach+0x1390/0x1390
[   30.559029]  rtnl_unlock+0xe/0x10
[   30.562454]  tun_chr_close+0x49/0x60
[   30.566143]  __fput+0x333/0x7f0
[   30.569413]  ? fput+0x140/0x140
[   30.572675]  ? check_same_owner+0x320/0x320
[   30.576978]  ____fput+0x15/0x20
[   30.580234]  task_work_run+0x199/0x270
[   30.584096]  ? task_work_cancel+0x210/0x210
[   30.588394]  ? free_nsproxy+0x185/0x1f0
[   30.592352]  ? switch_task_namespaces+0xa2/0xc0
[   30.597001]  do_exit+0xa52/0x1b40
[   30.600431]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   30.605431]  ? trace_hardirqs_on+0xd/0x10
[   30.609563]  ? kvfree+0x3b/0x60
[   30.612822]  ? mm_update_next_owner+0x930/0x930
[   30.617473]  ? rtnl_unlock+0xe/0x10
[   30.621081]  ? __tun_chr_ioctl+0x27a/0x3d20
[   30.625401]  ? tun_chr_read_iter+0x1e0/0x1e0
[   30.629803]  ? lock_downgrade+0x990/0x990
[   30.633956]  ? check_same_owner+0x320/0x320
[   30.638258]  ? __handle_mm_fault+0x39c0/0x39c0
[   30.643082]  ? vmacache_find+0x61/0x270
[   30.647039]  ? tun_chr_compat_ioctl+0x30/0x30
[   30.651515]  ? tun_chr_ioctl+0x2a/0x40
[   30.655391]  ? tun_chr_ioctl+0x2a/0x40
[   30.659269]  ? do_vfs_ioctl+0x492/0x1530
[   30.663332]  ? ioctl_preallocate+0x2b0/0x2b0
[   30.667727]  ? selinux_capable+0x40/0x40
[   30.671765]  ? putname+0xf3/0x130
[   30.675213]  do_group_exit+0x149/0x400
[   30.679082]  ? SyS_exit+0x30/0x30
[   30.682513]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   30.687514]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   30.692255]  SyS_exit_group+0x1d/0x20
[   30.696030]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   30.700756] RIP: 0033:0x4452e9
[   30.703917] RSP: 002b:00007ffc64dbd318 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
[   30.711601] RAX: ffffffffffffffda RBX: 00007ffc64dbd350 RCX: 00000000004452e9
[   30.718848] RDX: 00000000004452e9 RSI: 00000000201a9fd8 RDI: 0000000000000001
[   30.726094] RBP: 0000000000000082 R08: 0000000000000000 R09: 00007ffc64dbd350
[   30.733342] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000402690
[   30.740593] R13: 0000000000402720 R14: 0000000000000000 R15: 0000000000000000
[   30.747875] 
[   30.749486] Allocated by task 2981:
[   30.753097]  save_stack_trace+0x16/0x20
[   30.757047]  save_stack+0x43/0xd0
[   30.760476]  kasan_kmalloc+0xad/0xe0
[   30.764168]  __kmalloc_node+0x47/0x70
[   30.767950]  kvmalloc_node+0x64/0xd0
[   30.771641]  alloc_netdev_mqs+0x16e/0xed0
[   30.775770]  __tun_chr_ioctl+0x12be/0x3d20
[   30.779984]  tun_chr_ioctl+0x2a/0x40
[   30.783678]  do_vfs_ioctl+0x1b1/0x1530
[   30.787549]  SyS_ioctl+0x8f/0xc0
[   30.790898]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   30.795625] 
[   30.797236] Freed by task 2981:
[   30.800495]  save_stack_trace+0x16/0x20
[   30.804441]  save_stack+0x43/0xd0
[   30.807864]  kasan_slab_free+0x71/0xc0
[   30.811734]  kfree+0xca/0x250
[   30.814811]  kvfree+0x36/0x60
[   30.817890]  free_netdev+0x2cf/0x360
[   30.821575]  __tun_chr_ioctl+0x2cf6/0x3d20
[   30.825785]  tun_chr_ioctl+0x2a/0x40
[   30.829479]  do_vfs_ioctl+0x1b1/0x1530
[   30.833356]  SyS_ioctl+0x8f/0xc0
[   30.836703]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   30.841430] 
[   30.843041] The buggy address belongs to the object at ffff8801ce1d0380
[   30.843041]  which belongs to the cache kmalloc-16384 of size 16384
[   30.856022] The buggy address is located 13312 bytes inside of
[   30.856022]  16384-byte region [ffff8801ce1d0380, ffff8801ce1d4380)
[   30.868226] The buggy address belongs to the page:
[   30.873137] page:ffffea0007387400 count:1 mapcount:0 mapping:ffff8801ce1d0380 index:0x0 compound_mapcount: 0
[   30.883087] flags: 0x200000000008100(slab|head)
[   30.887729] raw: 0200000000008100 ffff8801ce1d0380 0000000000000000 0000000100000001
[   30.895581] raw: ffffea0007386420 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   30.903434] page dumped because: kasan: bad access detected
[   30.909113] 
[   30.910714] Memory state around the buggy address:
[   30.915614]  ffff8801ce1d3680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.922944]  ffff8801ce1d3700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.930281] >ffff8801ce1d3780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.937964]                    ^
[   30.941308]  ffff8801ce1d3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.948648]  ffff8801ce1d3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.955980] ==================================================================
[   30.963315] Disabling lock debugging due to kernel taint
[   30.968740] Kernel panic - not syncing: panic_on_warn set ...
[   30.968740] 
[   30.976072] CPU: 0 PID: 2981 Comm: syzkaller971859 Tainted: G    B           4.13.0-mm1+ #7
[   30.984526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   30.993854] Call Trace:
[   30.996433]  dump_stack+0x194/0x257
[   31.000031]  ? arch_local_irq_restore+0x53/0x53
[   31.004667]  ? vprintk_default+0x28/0x30
[   31.008697]  ? detach_if_pending+0x550/0x610
[   31.013074]  panic+0x1e4/0x417
[   31.016235]  ? __warn+0x1d9/0x1d9
[   31.019664]  ? detach_if_pending+0x557/0x610
[   31.024042]  kasan_end_report+0x50/0x50
[   31.027987]  kasan_report+0x137/0x340
[   31.031761]  __asan_report_store8_noabort+0x17/0x20
[   31.036766]  detach_if_pending+0x557/0x610
[   31.040974]  ? trace_raw_output_tick_stop+0x130/0x130
[   31.046141]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   31.050782]  ? lock_timer_base+0x1a3/0x2b0
[   31.054985]  ? lock_timer_base+0x1eb/0x2b0
[   31.059195]  ? __internal_add_timer+0x2d0/0x2d0
[   31.063843]  ? trace_hardirqs_on+0xd/0x10
[   31.067969]  try_to_del_timer_sync+0xa2/0x120
[   31.072442]  ? del_timer+0x130/0x130
[   31.076131]  ? del_timer_sync+0xeb/0x240
[   31.080167]  del_timer_sync+0x18a/0x240
[   31.084116]  tun_free_netdev+0x105/0x1b0
[   31.088145]  ? tun_xdp+0x410/0x410
[   31.091653]  ? cpumask_next+0x24/0x30
[   31.095427]  ? netdev_refcnt_read+0xed/0x150
[   31.099810]  ? tun_xdp+0x410/0x410
[   31.103321]  netdev_run_todo+0x870/0xca0
[   31.107358]  ? do_group_exit+0x149/0x400
[   31.111400]  ? register_netdev+0x30/0x30
[   31.115439]  ? mark_held_locks+0xb2/0x100
[   31.119560]  ? lock_downgrade+0x990/0x990
[   31.123681]  ? retint_kernel+0x10/0x10
[   31.127536]  ? __tun_detach+0xbf3/0x1390
[   31.131577]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   31.136571]  ? retint_kernel+0x10/0x10
[   31.140429]  ? refcount_sub_and_test+0x115/0x1b0
[   31.145160]  ? refcount_inc+0x50/0x50
[   31.148935]  ? refcount_inc+0x50/0x50
[   31.152706]  ? sk_destruct+0x4c/0x80
[   31.156399]  ? __sk_free+0x5c/0x230
[   31.159993]  ? sk_free+0x2f/0x40
[   31.163335]  ? __tun_detach+0x176/0x1390
[   31.167385]  ? tun_attach+0xf90/0xf90
[   31.171173]  ? locks_remove_file+0x3fa/0x5a0
[   31.175560]  ? fcntl_setlk+0x10d0/0x10d0
[   31.179597]  ? __fsnotify_parent+0xb4/0x3a0
[   31.183889]  ? fsnotify+0x1af0/0x1af0
[   31.187660]  ? __tun_detach+0x1390/0x1390
[   31.191776]  ? __tun_detach+0x1390/0x1390
[   31.196263]  rtnl_unlock+0xe/0x10
[   31.199691]  tun_chr_close+0x49/0x60
[   31.203378]  __fput+0x333/0x7f0
[   31.206635]  ? fput+0x140/0x140
[   31.209883]  ? check_same_owner+0x320/0x320
[   31.214183]  ____fput+0x15/0x20
[   31.217439]  task_work_run+0x199/0x270
[   31.221308]  ? task_work_cancel+0x210/0x210
[   31.225605]  ? free_nsproxy+0x185/0x1f0
[   31.229552]  ? switch_task_namespaces+0xa2/0xc0
[   31.234194]  do_exit+0xa52/0x1b40
[   31.237617]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   31.242604]  ? trace_hardirqs_on+0xd/0x10
[   31.246722]  ? kvfree+0x3b/0x60
[   31.249972]  ? mm_update_next_owner+0x930/0x930
[   31.254610]  ? rtnl_unlock+0xe/0x10
[   31.258209]  ? __tun_chr_ioctl+0x27a/0x3d20
[   31.262508]  ? tun_chr_read_iter+0x1e0/0x1e0
[   31.266889]  ? lock_downgrade+0x990/0x990
[   31.271018]  ? check_same_owner+0x320/0x320
[   31.275309]  ? __handle_mm_fault+0x39c0/0x39c0
[   31.279863]  ? vmacache_find+0x61/0x270
[   31.283807]  ? tun_chr_compat_ioctl+0x30/0x30
[   31.288270]  ? tun_chr_ioctl+0x2a/0x40
[   31.292128]  ? tun_chr_ioctl+0x2a/0x40
[   31.295988]  ? do_vfs_ioctl+0x492/0x1530
[   31.300020]  ? ioctl_preallocate+0x2b0/0x2b0
[   31.304397]  ? selinux_capable+0x40/0x40
[   31.308684]  ? putname+0xf3/0x130
[   31.312116]  do_group_exit+0x149/0x400
[   31.315978]  ? SyS_exit+0x30/0x30