INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-mmots-kasan-gce-8,10.128.0.4' (ECDSA) to the list of known hosts. 2017/10/18 08:47:35 parsed 1 programs 2017/10/18 08:47:35 executed programs: 0 syzkaller login: [ 57.982060] ================================================================== [ 57.989505] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0 [ 57.996489] Write of size 8 at addr ffff8801cde736c8 by task syz-executor0/3008 [ 58.003904] [ 58.005507] CPU: 0 PID: 3008 Comm: syz-executor0 Not tainted 4.14.0-rc4-mm1+ #16 [ 58.013008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.022337] Call Trace: [ 58.024902] dump_stack+0x194/0x257 [ 58.028503] ? arch_local_irq_restore+0x53/0x53 [ 58.033146] ? show_regs_print_info+0x65/0x65 [ 58.037618] ? __kernel_text_address+0xd/0x40 [ 58.042086] ? __internal_add_timer+0x275/0x2d0 [ 58.046731] print_address_description+0x73/0x250 [ 58.051552] ? __internal_add_timer+0x275/0x2d0 [ 58.056196] kasan_report+0x25b/0x340 [ 58.059974] __asan_report_store8_noabort+0x17/0x20 [ 58.064962] __internal_add_timer+0x275/0x2d0 [ 58.069432] ? calc_wheel_index+0x200/0x200 [ 58.073735] mod_timer+0x622/0x15b0 [ 58.077344] ? mod_timer_pending+0x14e0/0x14e0 [ 58.081899] ? __lock_is_held+0xbc/0x140 [ 58.085963] ? __lock_is_held+0xbc/0x140 [ 58.090003] ? __lockdep_init_map+0xe4/0x650 [ 58.094385] ? lockdep_init_map+0x3d/0x70 [ 58.098505] ? rcu_read_lock_sched_held+0x108/0x120 [ 58.103494] ? init_timer_key+0x126/0x3b0 [ 58.107616] ? try_to_del_timer_sync+0x120/0x120 [ 58.112345] ? round_jiffies_up+0xce/0x100 [ 58.116550] ? __round_jiffies_up_relative+0x150/0x150 [ 58.121799] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 58.126705] ? selinux_tun_dev_alloc_security+0x124/0x170 [ 58.132229] __tun_chr_ioctl+0x1beb/0x3e40 [ 58.136467] ? tun_chr_read_iter+0x1e0/0x1e0 [ 58.140856] ? lock_release+0xd70/0xd70 [ 58.144812] ? __lock_is_held+0xbc/0x140 [ 58.148884] ? check_same_owner+0x320/0x320 [ 58.153184] ? fget_raw+0x20/0x20 [ 58.156614] ? tun_chr_compat_ioctl+0x30/0x30 [ 58.161086] tun_chr_ioctl+0x2a/0x40 [ 58.164773] ? tun_chr_ioctl+0x2a/0x40 [ 58.168640] do_vfs_ioctl+0x1b1/0x1530 [ 58.172507] ? ioctl_preallocate+0x2b0/0x2b0 [ 58.176896] ? selinux_capable+0x40/0x40 [ 58.180945] ? SyS_futex+0x269/0x390 [ 58.184633] ? SyS_setsockopt+0x20b/0x360 [ 58.188766] ? security_file_ioctl+0x89/0xb0 [ 58.193151] SyS_ioctl+0x8f/0xc0 [ 58.196498] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 58.201223] RIP: 0033:0x452779 [ 58.204384] RSP: 002b:00007facf486cbe8 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 [ 58.212069] RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452779 [ 58.219310] RDX: 0000000020533000 RSI: 00000000400454ca RDI: 0000000000000005 [ 58.226562] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000 [ 58.233807] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f78b0 [ 58.241052] R13: 00000000ffffffff R14: 0000000000758078 R15: 0000000000000000 [ 58.248316] [ 58.249921] Allocated by task 2992: [ 58.253530] save_stack+0x43/0xd0 [ 58.256960] kasan_kmalloc+0xad/0xe0 [ 58.260646] __kmalloc_node+0x47/0x70 [ 58.264419] kvmalloc_node+0x64/0xd0 [ 58.268105] alloc_netdev_mqs+0x16d/0xed0 [ 58.272224] __tun_chr_ioctl+0x1386/0x3e40 [ 58.276429] tun_chr_ioctl+0x2a/0x40 [ 58.280116] do_vfs_ioctl+0x1b1/0x1530 [ 58.283974] SyS_ioctl+0x8f/0xc0 [ 58.287315] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 58.292039] [ 58.293639] Freed by task 2992: [ 58.296888] save_stack+0x43/0xd0 [ 58.300310] kasan_slab_free+0x71/0xc0 [ 58.304166] kfree+0xca/0x250 [ 58.307243] kvfree+0x36/0x60 [ 58.310320] free_netdev+0x2cf/0x360 [ 58.314004] __tun_chr_ioctl+0x2df6/0x3e40 [ 58.318209] tun_chr_ioctl+0x2a/0x40 [ 58.321895] do_vfs_ioctl+0x1b1/0x1530 [ 58.325753] SyS_ioctl+0x8f/0xc0 [ 58.329089] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 58.333814] [ 58.335413] The buggy address belongs to the object at ffff8801cde702c0 [ 58.335413] which belongs to the cache kmalloc-16384 of size 16384 [ 58.348393] The buggy address is located 13320 bytes inside of [ 58.348393] 16384-byte region [ffff8801cde702c0, ffff8801cde742c0) [ 58.360585] The buggy address belongs to the page: [ 58.365488] page:ffffea0007379c00 count:1 mapcount:0 mapping:ffff8801cde702c0 index:0x0 compound_mapcount: 0 [ 58.375436] flags: 0x200000000008100(slab|head) [ 58.380078] raw: 0200000000008100 ffff8801cde702c0 0000000000000000 0000000100000001 [ 58.387931] raw: ffffea000738d020 ffffea0007369020 ffff8801dac02200 0000000000000000 [ 58.395785] page dumped because: kasan: bad access detected [ 58.401464] [ 58.403061] Memory state around the buggy address: [ 58.407962] ffff8801cde73580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.415289] ffff8801cde73600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.422617] >ffff8801cde73680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.429944] ^ [ 58.435621] ffff8801cde73700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.442951] ffff8801cde73780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.450284] ================================================================== [ 58.457609] Disabling lock debugging due to kernel taint [ 58.463024] Kernel panic - not syncing: panic_on_warn set ... [ 58.463024] [ 58.470356] CPU: 0 PID: 3008 Comm: syz-executor0 Tainted: G B 4.14.0-rc4-mm1+ #16 [ 58.479155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.488471] Call Trace: [ 58.491030] dump_stack+0x194/0x257 [ 58.494625] ? arch_local_irq_restore+0x53/0x53 [ 58.499260] ? vprintk_default+0x28/0x30 [ 58.503290] ? __internal_add_timer+0x1f0/0x2d0 [ 58.507927] panic+0x1e4/0x41c [ 58.511086] ? refcount_error_report+0x214/0x214 [ 58.515813] ? __internal_add_timer+0x275/0x2d0 [ 58.520447] kasan_end_report+0x50/0x50 [ 58.524384] kasan_report+0x144/0x340 [ 58.528153] __asan_report_store8_noabort+0x17/0x20 [ 58.533135] __internal_add_timer+0x275/0x2d0 [ 58.537597] ? calc_wheel_index+0x200/0x200 [ 58.541889] mod_timer+0x622/0x15b0 [ 58.545487] ? mod_timer_pending+0x14e0/0x14e0 [ 58.550035] ? __lock_is_held+0xbc/0x140 [ 58.554069] ? __lock_is_held+0xbc/0x140 [ 58.558095] ? __lockdep_init_map+0xe4/0x650 [ 58.562469] ? lockdep_init_map+0x3d/0x70 [ 58.566586] ? rcu_read_lock_sched_held+0x108/0x120 [ 58.571564] ? init_timer_key+0x126/0x3b0 [ 58.575678] ? try_to_del_timer_sync+0x120/0x120 [ 58.580427] ? round_jiffies_up+0xce/0x100 [ 58.584632] ? __round_jiffies_up_relative+0x150/0x150 [ 58.589877] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 58.594775] ? selinux_tun_dev_alloc_security+0x124/0x170 [ 58.600281] __tun_chr_ioctl+0x1beb/0x3e40 [ 58.604487] ? tun_chr_read_iter+0x1e0/0x1e0 [ 58.608863] ? lock_release+0xd70/0xd70 [ 58.612801] ? __lock_is_held+0xbc/0x140 [ 58.616839] ? check_same_owner+0x320/0x320 [ 58.621128] ? fget_raw+0x20/0x20 [ 58.624545] ? tun_chr_compat_ioctl+0x30/0x30 [ 58.629012] tun_chr_ioctl+0x2a/0x40 [ 58.632691] ? tun_chr_ioctl+0x2a/0x40 [ 58.636549] do_vfs_ioctl+0x1b1/0x1530 [ 58.640402] ? ioctl_preallocate+0x2b0/0x2b0 [ 58.644777] ? selinux_capable+0x40/0x40 [ 58.648807] ? SyS_futex+0x269/0x390 [ 58.652484] ? SyS_setsockopt+0x20b/0x360 [ 58.656607] ? security_file_ioctl+0x89/0xb0 [ 58.660984] SyS_ioctl+0x8f/0xc0 [ 58.664320] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 58.669041] RIP: 0033:0x452779 [ 58.672194] RSP: 002b:00007facf486cbe8 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 [ 58.679864] RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452779 [ 58.687096] RDX: 0000000020533000 RSI: 00000000400454ca RDI: 0000000000000005 [ 58.694330] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000 [ 58.701565] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f78b0 [ 58.708797] R13: 00000000ffffffff R14: 0000000000758078 R15: 0000000000000000