INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-9,10.128.15.201' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   34.583739] ==================================================================
[   34.584931] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   34.586288] Write of size 8 at addr ffff8801d1c1b640 by task syzkaller639264/3015
[   34.587334] 
[   34.587567] CPU: 0 PID: 3015 Comm: syzkaller639264 Not tainted 4.13.0+ #66
[   34.588840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   34.590220] Call Trace:
[   34.590581]  dump_stack+0x194/0x257
[   34.591072]  ? arch_local_irq_restore+0x53/0x53
[   34.591775]  ? show_regs_print_info+0x65/0x65
[   34.592393]  ? __kernel_text_address+0xae/0xe0
[   34.593003]  ? __internal_add_timer+0x275/0x2d0
[   34.593674]  print_address_description+0x73/0x250
[   34.594537]  ? __internal_add_timer+0x275/0x2d0
[   34.595255]  kasan_report+0x24e/0x340
[   34.595843]  __asan_report_store8_noabort+0x17/0x20
[   34.596657]  __internal_add_timer+0x275/0x2d0
[   34.597261]  ? calc_wheel_index+0x200/0x200
[   34.597897]  mod_timer+0x622/0x15b0
[   34.598406]  ? mod_timer_pending+0x14e0/0x14e0
[   34.599072]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   34.599880]  ? trace_hardirqs_on+0xd/0x10
[   34.600551]  ? _crng_backtrack_protect+0xd9/0x130
[   34.601282]  ? __lock_is_held+0xb6/0x140
[   34.601894]  ? lockdep_init_map+0xe4/0x650
[   34.602519]  ? init_timer_key+0x126/0x3b0
[   34.603245]  ? try_to_del_timer_sync+0x120/0x120
[   34.603989]  ? round_jiffies_up+0xce/0x100
[   34.608192]  ? __round_jiffies_up_relative+0x150/0x150
[   34.613437]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   34.618347]  __tun_chr_ioctl+0x1b20/0x3d60
[   34.622548]  ? unwind_dump+0x4/0x4c0
[   34.626237]  ? tun_select_queue+0x580/0x580
[   34.630527]  ? check_noncircular+0x20/0x20
[   34.634728]  ? save_stack+0xa3/0xd0
[   34.638330]  ? __handle_mm_fault+0x577/0x3860
[   34.642803]  ? check_noncircular+0x20/0x20
[   34.647007]  ? check_noncircular+0x20/0x20
[   34.651206]  ? __pmd_alloc+0x4e0/0x4e0
[   34.655076]  ? check_same_owner+0x320/0x320
[   34.659365]  ? handle_mm_fault+0x23e/0x860
[   34.663586]  ? tun_chr_compat_ioctl+0x30/0x30
[   34.668045]  tun_chr_ioctl+0x2a/0x40
[   34.671723]  ? tun_chr_ioctl+0x2a/0x40
[   34.675581]  do_vfs_ioctl+0x1b1/0x1520
[   34.679440]  ? ioctl_preallocate+0x2b0/0x2b0
[   34.683820]  ? selinux_capable+0x40/0x40
[   34.687852]  ? __handle_mm_fault+0x3860/0x3860
[   34.692428]  ? security_file_ioctl+0x7d/0xb0
[   34.696801]  ? security_file_ioctl+0x89/0xb0
[   34.701180]  SyS_ioctl+0x8f/0xc0
[   34.704526]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   34.709246] RIP: 0033:0x443d79
[   34.712400] RSP: 002b:00007ffc8b001f98 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   34.720073] RAX: ffffffffffffffda RBX: f1ce4a65c3b97a7a RCX: 0000000000443d79
[   34.727309] RDX: 0000000020927fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   34.734551] RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
[   34.741786] R10: 0000000000000000 R11: 0000000000000202 R12: d7c29eea7c696697
[   34.749041] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   34.756292] 
[   34.757886] Allocated by task 3015:
[   34.761480]  save_stack_trace+0x16/0x20
[   34.765418]  save_stack+0x43/0xd0
[   34.768836]  kasan_kmalloc+0xad/0xe0
[   34.772516]  __kmalloc_node+0x47/0x70
[   34.776283]  kvmalloc_node+0x64/0xd0
[   34.779976]  alloc_netdev_mqs+0x16e/0xed0
[   34.784532]  __tun_chr_ioctl+0x12b2/0x3d60
[   34.788733]  tun_chr_ioctl+0x2a/0x40
[   34.792413]  do_vfs_ioctl+0x1b1/0x1520
[   34.796264]  SyS_ioctl+0x8f/0xc0
[   34.799609]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   34.804342] 
[   34.805932] Freed by task 3015:
[   34.809183]  save_stack_trace+0x16/0x20
[   34.813122]  save_stack+0x43/0xd0
[   34.816541]  kasan_slab_free+0x71/0xc0
[   34.820394]  kfree+0xca/0x250
[   34.823463]  kvfree+0x36/0x60
[   34.826561]  free_netdev+0x2cf/0x360
[   34.830249]  __tun_chr_ioctl+0x2d24/0x3d60
[   34.834461]  tun_chr_ioctl+0x2a/0x40
[   34.838138]  do_vfs_ioctl+0x1b1/0x1520
[   34.841988]  SyS_ioctl+0x8f/0xc0
[   34.845319]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   34.850035] 
[   34.851628] The buggy address belongs to the object at ffff8801d1c18300
[   34.851628]  which belongs to the cache kmalloc-16384 of size 16384
[   34.864593] The buggy address is located 13120 bytes inside of
[   34.864593]  16384-byte region [ffff8801d1c18300, ffff8801d1c1c300)
[   34.876783] The buggy address belongs to the page:
[   34.881677] page:ffffea0007470600 count:1 mapcount:0 mapping:ffff8801d1c18300 index:0x0 compound_mapcount: 0
[   34.891611] flags: 0x200000000008100(slab|head)
[   34.896249] raw: 0200000000008100 ffff8801d1c18300 0000000000000000 0000000100000001
[   34.904094] raw: ffffea000762aa20 ffffea0007445420 ffff8801dac02200 0000000000000000
[   34.911937] page dumped because: kasan: bad access detected
[   34.917609] 
[   34.919201] Memory state around the buggy address:
[   34.924106]  ffff8801d1c1b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.931430]  ffff8801d1c1b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.938760] >ffff8801d1c1b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.946096]                                            ^
[   34.951508]  ffff8801d1c1b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.958831]  ffff8801d1c1b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.966153] ==================================================================
[   34.973474] Disabling lock debugging due to kernel taint
[   34.978887] Kernel panic - not syncing: panic_on_warn set ...
[   34.978887] 
[   34.986214] CPU: 0 PID: 3015 Comm: syzkaller639264 Tainted: G    B           4.13.0+ #66
[   34.994403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   35.003718] Call Trace:
[   35.006311]  dump_stack+0x194/0x257
[   35.009904]  ? arch_local_irq_restore+0x53/0x53
[   35.014536]  ? kasan_end_report+0x32/0x50
[   35.018648]  ? lock_downgrade+0x990/0x990
[   35.022759]  ? __internal_add_timer+0x210/0x2d0
[   35.027395]  panic+0x1e4/0x417
[   35.030553]  ? __warn+0x1d9/0x1d9
[   35.033976]  ? __internal_add_timer+0x275/0x2d0
[   35.038609]  kasan_end_report+0x50/0x50
[   35.042562]  kasan_report+0x137/0x340
[   35.046332]  __asan_report_store8_noabort+0x17/0x20
[   35.051314]  __internal_add_timer+0x275/0x2d0
[   35.055775]  ? calc_wheel_index+0x200/0x200
[   35.060065]  mod_timer+0x622/0x15b0
[   35.063663]  ? mod_timer_pending+0x14e0/0x14e0
[   35.068210]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   35.073191]  ? trace_hardirqs_on+0xd/0x10
[   35.077303]  ? _crng_backtrack_protect+0xd9/0x130
[   35.082131]  ? __lock_is_held+0xb6/0x140
[   35.086171]  ? lockdep_init_map+0xe4/0x650
[   35.090385]  ? init_timer_key+0x126/0x3b0
[   35.094497]  ? try_to_del_timer_sync+0x120/0x120
[   35.099218]  ? round_jiffies_up+0xce/0x100
[   35.103432]  ? __round_jiffies_up_relative+0x150/0x150
[   35.108689]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   35.113590]  __tun_chr_ioctl+0x1b20/0x3d60
[   35.117793]  ? unwind_dump+0x4/0x4c0
[   35.121481]  ? tun_select_queue+0x580/0x580
[   35.125768]  ? check_noncircular+0x20/0x20
[   35.129989]  ? save_stack+0xa3/0xd0
[   35.133581]  ? __handle_mm_fault+0x577/0x3860
[   35.138037]  ? check_noncircular+0x20/0x20
[   35.142236]  ? check_noncircular+0x20/0x20
[   35.146433]  ? __pmd_alloc+0x4e0/0x4e0
[   35.150294]  ? check_same_owner+0x320/0x320
[   35.154577]  ? handle_mm_fault+0x23e/0x860
[   35.158776]  ? tun_chr_compat_ioctl+0x30/0x30
[   35.163234]  tun_chr_ioctl+0x2a/0x40
[   35.166919]  ? tun_chr_ioctl+0x2a/0x40
[   35.170790]  do_vfs_ioctl+0x1b1/0x1520
[   35.174643]  ? ioctl_preallocate+0x2b0/0x2b0
[   35.179021]  ? selinux_capable+0x40/0x40
[   35.183050]  ? __handle_mm_fault+0x3860/0x3860
[   35.187603]  ? security_file_ioctl+0x7d/0xb0
[   35.191973]  ? security_file_ioctl+0x89/0xb0
[   35.196357]  SyS_ioctl+0x8f/0xc0
[   35.199690]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   35.204409] RIP: 0033:0x443d79
[   35.207564] RSP: 002b:00007ffc8b001f98 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   35.215238] RAX: ffffffffffffffda RBX: f1ce4a65c3b97a7a RCX: 0000000000443d79
[   35.222487] RDX: 0000000020927fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   35.229719] RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
[   35.236953] R10: 0000000000000000 R11: 0000000000000202 R12: d7c29eea7c696697
[   35.244197] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000