INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-8,10.128.15.202' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   44.352299] ==================================================================
[   44.359723] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   44.366706] Write of size 8 at addr ffff8801cca0b6c8 by task syzkaller342998/3040
[   44.374302] 
[   44.375911] CPU: 0 PID: 3040 Comm: syzkaller342998 Not tainted 4.13.0+ #69
[   44.382896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   44.392227] Call Trace:
[   44.394799]  dump_stack+0x194/0x257
[   44.398406]  ? arch_local_irq_restore+0x53/0x53
[   44.403056]  ? show_regs_print_info+0x65/0x65
[   44.407534]  ? __kernel_text_address+0xae/0xe0
[   44.412110]  ? __internal_add_timer+0x275/0x2d0
[   44.416761]  print_address_description+0x73/0x250
[   44.421579]  ? __internal_add_timer+0x275/0x2d0
[   44.426221]  kasan_report+0x24e/0x340
[   44.430005]  __asan_report_store8_noabort+0x17/0x20
[   44.435001]  __internal_add_timer+0x275/0x2d0
[   44.439479]  ? calc_wheel_index+0x200/0x200
[   44.443793]  mod_timer+0x622/0x15b0
[   44.447406]  ? mod_timer_pending+0x14e0/0x14e0
[   44.451973]  ? __lock_is_held+0xbc/0x140
[   44.456039]  ? __lock_is_held+0xbc/0x140
[   44.460081]  ? __lockdep_init_map+0xe4/0x650
[   44.464471]  ? lockdep_init_map+0x3d/0x70
[   44.468595]  ? rcu_read_lock_sched_held+0x108/0x120
[   44.473594]  ? init_timer_key+0x126/0x3b0
[   44.477719]  ? try_to_del_timer_sync+0x120/0x120
[   44.482455]  ? round_jiffies_up+0xce/0x100
[   44.486669]  ? __round_jiffies_up_relative+0x150/0x150
[   44.491925]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   44.496847]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   44.502375]  __tun_chr_ioctl+0x1b2c/0x3d70
[   44.506595]  ? tun_select_queue+0x580/0x580
[   44.510905]  ? lock_downgrade+0x990/0x990
[   44.515057]  ? check_same_owner+0x320/0x320
[   44.519357]  ? __handle_mm_fault+0x3840/0x3840
[   44.523912]  ? vmacache_find+0x61/0x270
[   44.527865]  ? tun_chr_compat_ioctl+0x30/0x30
[   44.532346]  tun_chr_ioctl+0x2a/0x40
[   44.536037]  ? tun_chr_ioctl+0x2a/0x40
[   44.539901]  do_vfs_ioctl+0x1b1/0x1530
[   44.543771]  ? ioctl_preallocate+0x2b0/0x2b0
[   44.548157]  ? selinux_capable+0x40/0x40
[   44.552200]  ? putname+0xf3/0x130
[   44.555631]  ? do_sys_open+0x320/0x6d0
[   44.559507]  ? security_file_ioctl+0x7d/0xb0
[   44.563893]  ? security_file_ioctl+0x89/0xb0
[   44.568283]  SyS_ioctl+0x8f/0xc0
[   44.571637]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.576377] RIP: 0033:0x443d69
[   44.579543] RSP: 002b:00007ffebb586c38 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   44.587230] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443d69
[   44.594475] RDX: 0000000020002000 RSI: 00000000400454ca RDI: 0000000000000004
[   44.601718] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   44.608961] R10: 0000000000000000 R11: 0000000000000202 R12: f96ed9fbd71ca7db
[   44.616204] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   44.623466] 
[   44.625075] Allocated by task 3040:
[   44.628678]  save_stack_trace+0x16/0x20
[   44.632623]  save_stack+0x43/0xd0
[   44.636052]  kasan_kmalloc+0xad/0xe0
[   44.639737]  __kmalloc_node+0x47/0x70
[   44.643511]  kvmalloc_node+0x64/0xd0
[   44.647203]  alloc_netdev_mqs+0x16e/0xed0
[   44.651340]  __tun_chr_ioctl+0x12be/0x3d70
[   44.655555]  tun_chr_ioctl+0x2a/0x40
[   44.659241]  do_vfs_ioctl+0x1b1/0x1530
[   44.663101]  SyS_ioctl+0x8f/0xc0
[   44.666440]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.671165] 
[   44.672766] Freed by task 3040:
[   44.676019]  save_stack_trace+0x16/0x20
[   44.679972]  save_stack+0x43/0xd0
[   44.683395]  kasan_slab_free+0x71/0xc0
[   44.687261]  kfree+0xca/0x250
[   44.690342]  kvfree+0x36/0x60
[   44.693424]  free_netdev+0x2cf/0x360
[   44.697117]  __tun_chr_ioctl+0x2d30/0x3d70
[   44.701333]  tun_chr_ioctl+0x2a/0x40
[   44.705021]  do_vfs_ioctl+0x1b1/0x1530
[   44.708891]  SyS_ioctl+0x8f/0xc0
[   44.712237]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.716970] 
[   44.718578] The buggy address belongs to the object at ffff8801cca082c0
[   44.718578]  which belongs to the cache kmalloc-16384 of size 16384
[   44.731554] The buggy address is located 13320 bytes inside of
[   44.731554]  16384-byte region [ffff8801cca082c0, ffff8801cca0c2c0)
[   44.743757] The buggy address belongs to the page:
[   44.748667] page:ffffea0007328200 count:1 mapcount:0 mapping:ffff8801cca082c0 index:0x0 compound_mapcount: 0
[   44.758613] flags: 0x200000000008100(slab|head)
[   44.763257] raw: 0200000000008100 ffff8801cca082c0 0000000000000000 0000000100000001
[   44.771115] raw: ffffea00074fbc20 ffffea000732ec20 ffff8801dac02200 0000000000000000
[   44.778966] page dumped because: kasan: bad access detected
[   44.784646] 
[   44.786246] Memory state around the buggy address:
[   44.791149]  ffff8801cca0b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.798490]  ffff8801cca0b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.805820] >ffff8801cca0b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.813151]                                               ^
[   44.818837]  ffff8801cca0b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.826166]  ffff8801cca0b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.833497] ==================================================================
[   44.840825] Disabling lock debugging due to kernel taint
[   44.846239] Kernel panic - not syncing: panic_on_warn set ...
[   44.846239] 
[   44.853586] CPU: 0 PID: 3040 Comm: syzkaller342998 Tainted: G    B           4.13.0+ #69
[   44.861783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   44.871117] Call Trace:
[   44.873676]  dump_stack+0x194/0x257
[   44.877275]  ? arch_local_irq_restore+0x53/0x53
[   44.881911]  ? vprintk_default+0x28/0x30
[   44.885941]  ? __internal_add_timer+0x250/0x2d0
[   44.890580]  panic+0x1e4/0x417
[   44.893740]  ? __warn+0x1d9/0x1d9
[   44.897174]  ? __internal_add_timer+0x275/0x2d0
[   44.901829]  kasan_end_report+0x50/0x50
[   44.905772]  kasan_report+0x137/0x340
[   44.909544]  __asan_report_store8_noabort+0x17/0x20
[   44.914537]  __internal_add_timer+0x275/0x2d0
[   44.919000]  ? calc_wheel_index+0x200/0x200
[   44.923299]  mod_timer+0x622/0x15b0
[   44.926901]  ? mod_timer_pending+0x14e0/0x14e0
[   44.931450]  ? __lock_is_held+0xbc/0x140
[   44.935485]  ? __lock_is_held+0xbc/0x140
[   44.939521]  ? __lockdep_init_map+0xe4/0x650
[   44.943905]  ? lockdep_init_map+0x3d/0x70
[   44.948022]  ? rcu_read_lock_sched_held+0x108/0x120
[   44.953011]  ? init_timer_key+0x126/0x3b0
[   44.957128]  ? try_to_del_timer_sync+0x120/0x120
[   44.961858]  ? round_jiffies_up+0xce/0x100
[   44.966060]  ? __round_jiffies_up_relative+0x150/0x150
[   44.971312]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   44.976211]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   44.981721]  __tun_chr_ioctl+0x1b2c/0x3d70
[   44.985933]  ? tun_select_queue+0x580/0x580
[   44.990230]  ? lock_downgrade+0x990/0x990
[   44.994358]  ? check_same_owner+0x320/0x320
[   44.998651]  ? __handle_mm_fault+0x3840/0x3840
[   45.003199]  ? vmacache_find+0x61/0x270
[   45.007145]  ? tun_chr_compat_ioctl+0x30/0x30
[   45.011955]  tun_chr_ioctl+0x2a/0x40
[   45.015633]  ? tun_chr_ioctl+0x2a/0x40
[   45.019498]  do_vfs_ioctl+0x1b1/0x1530
[   45.023355]  ? ioctl_preallocate+0x2b0/0x2b0
[   45.027734]  ? selinux_capable+0x40/0x40
[   45.031763]  ? putname+0xf3/0x130
[   45.035184]  ? do_sys_open+0x320/0x6d0
[   45.039047]  ? security_file_ioctl+0x7d/0xb0
[   45.043421]  ? security_file_ioctl+0x89/0xb0
[   45.047800]  SyS_ioctl+0x8f/0xc0
[   45.051137]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.055860] RIP: 0033:0x443d69
[   45.059018] RSP: 002b:00007ffebb586c38 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   45.066705] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443d69
[   45.073942] RDX: 0000000020002000 RSI: 00000000400454ca RDI: 0000000000000004
[   45.081180] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   45.088415] R10: 0000000000000000 R11: 0000000000000202 R12: f96ed9fbd71ca7db
[   45.095651] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   45.103158] Dumping ftrace buffer:
[   45.106672]    (ftrace buffer empty)
[   45.110351] Kernel Offset: disabled
[   45.113949] Rebooting in 86400 seconds..