INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-6,10.128.0.9' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   83.896583] ==================================================================
[   83.904014] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   83.911006] Write of size 8 at addr ffff8801cc7ab6c8 by task syzkaller117030/3039
[   83.918600] 
[   83.920200] CPU: 1 PID: 3039 Comm: syzkaller117030 Not tainted 4.13.0+ #70
[   83.927179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   83.936502] Call Trace:
[   83.939060]  dump_stack+0x194/0x257
[   83.942667]  ? arch_local_irq_restore+0x53/0x53
[   83.947307]  ? show_regs_print_info+0x65/0x65
[   83.951790]  ? __internal_add_timer+0x275/0x2d0
[   83.956457]  print_address_description+0x73/0x250
[   83.961274]  ? __internal_add_timer+0x275/0x2d0
[   83.965928]  kasan_report+0x24e/0x340
[   83.969704]  __asan_report_store8_noabort+0x17/0x20
[   83.974687]  __internal_add_timer+0x275/0x2d0
[   83.979159]  ? calc_wheel_index+0x200/0x200
[   83.983460]  mod_timer+0x622/0x15b0
[   83.987064]  ? mod_timer_pending+0x14e0/0x14e0
[   83.991620]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   83.996606]  ? trace_hardirqs_on+0xd/0x10
[   84.000726]  ? _crng_backtrack_protect+0xd9/0x130
[   84.005545]  ? __lock_is_held+0xbc/0x140
[   84.009579]  ? __lockdep_init_map+0xe4/0x650
[   84.013958]  ? lockdep_init_map+0x3d/0x70
[   84.018084]  ? rcu_read_lock_sched_held+0x108/0x120
[   84.023077]  ? init_timer_key+0x126/0x3b0
[   84.027198]  ? try_to_del_timer_sync+0x120/0x120
[   84.031933]  ? round_jiffies_up+0xce/0x100
[   84.036136]  ? __round_jiffies_up_relative+0x150/0x150
[   84.041382]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   84.046403]  __tun_chr_ioctl+0x1b2c/0x3d70
[   84.050618]  ? tun_select_queue+0x580/0x580
[   84.054918]  ? lock_downgrade+0x990/0x990
[   84.059065]  ? check_same_owner+0x320/0x320
[   84.063369]  ? __handle_mm_fault+0x3840/0x3840
[   84.067922]  ? vmacache_find+0x61/0x270
[   84.071880]  ? tun_chr_compat_ioctl+0x30/0x30
[   84.076351]  tun_chr_ioctl+0x2a/0x40
[   84.080056]  ? tun_chr_ioctl+0x2a/0x40
[   84.083912]  do_vfs_ioctl+0x1b1/0x1530
[   84.087772]  ? ioctl_preallocate+0x2b0/0x2b0
[   84.092159]  ? selinux_capable+0x40/0x40
[   84.096194]  ? putname+0xf3/0x130
[   84.099618]  ? do_sys_open+0x320/0x6d0
[   84.103496]  ? security_file_ioctl+0x7d/0xb0
[   84.107878]  ? security_file_ioctl+0x89/0xb0
[   84.112259]  SyS_ioctl+0x8f/0xc0
[   84.115615]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   84.120337] RIP: 0033:0x443db9
[   84.123511] RSP: 002b:00007fff83d682f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   84.131186] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   84.138427] RDX: 0000000020f14fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   84.145666] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   84.152905] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000401aa0
[   84.160145] R13: 0000000000401b30 R14: 0000000000000000 R15: 0000000000000000
[   84.167402] 
[   84.168999] Allocated by task 3039:
[   84.172595]  save_stack_trace+0x16/0x20
[   84.176556]  save_stack+0x43/0xd0
[   84.179981]  kasan_kmalloc+0xad/0xe0
[   84.183668]  __kmalloc_node+0x47/0x70
[   84.187461]  kvmalloc_node+0x64/0xd0
[   84.191147]  alloc_netdev_mqs+0x16e/0xed0
[   84.195265]  __tun_chr_ioctl+0x12be/0x3d70
[   84.199469]  tun_chr_ioctl+0x2a/0x40
[   84.203150]  do_vfs_ioctl+0x1b1/0x1530
[   84.207004]  SyS_ioctl+0x8f/0xc0
[   84.210351]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   84.215072] 
[   84.216666] Freed by task 3039:
[   84.219914]  save_stack_trace+0x16/0x20
[   84.223858]  save_stack+0x43/0xd0
[   84.227294]  kasan_slab_free+0x71/0xc0
[   84.231148]  kfree+0xca/0x250
[   84.234221]  kvfree+0x36/0x60
[   84.237297]  free_netdev+0x2cf/0x360
[   84.241002]  __tun_chr_ioctl+0x2d30/0x3d70
[   84.245202]  tun_chr_ioctl+0x2a/0x40
[   84.248881]  do_vfs_ioctl+0x1b1/0x1530
[   84.252731]  SyS_ioctl+0x8f/0xc0
[   84.256062]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   84.260779] 
[   84.262377] The buggy address belongs to the object at ffff8801cc7a82c0
[   84.262377]  which belongs to the cache kmalloc-16384 of size 16384
[   84.275355] The buggy address is located 13320 bytes inside of
[   84.275355]  16384-byte region [ffff8801cc7a82c0, ffff8801cc7ac2c0)
[   84.287542] The buggy address belongs to the page:
[   84.292442] page:ffffea000731ea00 count:1 mapcount:0 mapping:ffff8801cc7a82c0 index:0x0 compound_mapcount: 0
[   84.302386] flags: 0x200000000008100(slab|head)
[   84.307038] raw: 0200000000008100 ffff8801cc7a82c0 0000000000000000 0000000100000001
[   84.314885] raw: ffffea00074f2220 ffffea000731e420 ffff8801dac02200 0000000000000000
[   84.322733] page dumped because: kasan: bad access detected
[   84.328409] 
[   84.330019] Memory state around the buggy address:
[   84.334922]  ffff8801cc7ab580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   84.342293]  ffff8801cc7ab600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   84.349618] >ffff8801cc7ab680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   84.356947]                                               ^
[   84.362624]  ffff8801cc7ab700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   84.369949]  ffff8801cc7ab780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   84.377271] ==================================================================
[   84.384598] Disabling lock debugging due to kernel taint
[   84.390009] Kernel panic - not syncing: panic_on_warn set ...
[   84.390009] 
[   84.397390] CPU: 1 PID: 3039 Comm: syzkaller117030 Tainted: G    B           4.13.0+ #70
[   84.405591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   84.414906] Call Trace:
[   84.417459]  dump_stack+0x194/0x257
[   84.421066]  ? arch_local_irq_restore+0x53/0x53
[   84.425709]  ? vprintk_default+0x28/0x30
[   84.429743]  ? __internal_add_timer+0x1a0/0x2d0
[   84.434381]  panic+0x1e4/0x417
[   84.437537]  ? __warn+0x1d9/0x1d9
[   84.440958]  ? __internal_add_timer+0x275/0x2d0
[   84.445589]  kasan_end_report+0x50/0x50
[   84.449565]  kasan_report+0x137/0x340
[   84.453332]  __asan_report_store8_noabort+0x17/0x20
[   84.458310]  __internal_add_timer+0x275/0x2d0
[   84.462765]  ? calc_wheel_index+0x200/0x200
[   84.467054]  mod_timer+0x622/0x15b0
[   84.470648]  ? mod_timer_pending+0x14e0/0x14e0
[   84.475191]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   84.480178]  ? trace_hardirqs_on+0xd/0x10
[   84.484333]  ? _crng_backtrack_protect+0xd9/0x130
[   84.489141]  ? __lock_is_held+0xbc/0x140
[   84.493165]  ? __lockdep_init_map+0xe4/0x650
[   84.497559]  ? lockdep_init_map+0x3d/0x70
[   84.501672]  ? rcu_read_lock_sched_held+0x108/0x120
[   84.506654]  ? init_timer_key+0x126/0x3b0
[   84.510785]  ? try_to_del_timer_sync+0x120/0x120
[   84.515505]  ? round_jiffies_up+0xce/0x100
[   84.519704]  ? __round_jiffies_up_relative+0x150/0x150
[   84.524966]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   84.529884]  __tun_chr_ioctl+0x1b2c/0x3d70
[   84.534090]  ? tun_select_queue+0x580/0x580
[   84.538383]  ? lock_downgrade+0x990/0x990
[   84.542506]  ? check_same_owner+0x320/0x320
[   84.546807]  ? __handle_mm_fault+0x3840/0x3840
[   84.551350]  ? vmacache_find+0x61/0x270
[   84.555287]  ? tun_chr_compat_ioctl+0x30/0x30
[   84.559751]  tun_chr_ioctl+0x2a/0x40
[   84.563427]  ? tun_chr_ioctl+0x2a/0x40
[   84.567277]  do_vfs_ioctl+0x1b1/0x1530
[   84.571128]  ? ioctl_preallocate+0x2b0/0x2b0
[   84.575504]  ? selinux_capable+0x40/0x40
[   84.579531]  ? putname+0xf3/0x130
[   84.582944]  ? do_sys_open+0x320/0x6d0
[   84.586794]  ? security_file_ioctl+0x7d/0xb0
[   84.591161]  ? security_file_ioctl+0x89/0xb0
[   84.595562]  SyS_ioctl+0x8f/0xc0
[   84.598893]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   84.603607] RIP: 0033:0x443db9
[   84.606772] RSP: 002b:00007fff83d682f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   84.614445] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   84.621677] RDX: 0000000020f14fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   84.628909] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   84.636203] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000401aa0
[   84.643460] R13: 0000000000401b30 R14: 0000000000000000 R15: 0000000000000000
[   84.651054] Dumping ftrace buffer:
[   84.654561]    (ftrace buffer empty)
[   84.658247] Kernel Offset: disabled
[   84.661838] Rebooting in 86400 seconds..