INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-next-kasan-gce-8,10.128.0.25' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 42.798169] ================================================================== [ 42.805630] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0 [ 42.812629] Write of size 8 at addr ffff8801ce9536c8 by task syzkaller137130/2983 [ 42.820295] [ 42.821913] CPU: 0 PID: 2983 Comm: syzkaller137130 Not tainted 4.13.0-next-20170905+ #15 [ 42.830169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.839513] Call Trace: [ 42.842088] dump_stack+0x194/0x257 [ 42.845703] ? arch_local_irq_restore+0x53/0x53 [ 42.850358] ? show_regs_print_info+0x65/0x65 [ 42.854846] ? __internal_add_timer+0x275/0x2d0 [ 42.859507] print_address_description+0x73/0x250 [ 42.864342] ? __internal_add_timer+0x275/0x2d0 [ 42.869001] kasan_report+0x24e/0x340 [ 42.872793] __asan_report_store8_noabort+0x17/0x20 [ 42.877791] __internal_add_timer+0x275/0x2d0 [ 42.882294] ? calc_wheel_index+0x200/0x200 [ 42.886627] mod_timer+0x622/0x15b0 [ 42.890271] ? mod_timer_pending+0x14e0/0x14e0 [ 42.894858] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 42.899861] ? trace_hardirqs_on+0xd/0x10 [ 42.904010] ? _crng_backtrack_protect+0xd9/0x130 [ 42.908843] ? __lock_is_held+0xbc/0x140 [ 42.912894] ? __lockdep_init_map+0xe4/0x650 [ 42.917349] ? lockdep_init_map+0x3d/0x70 [ 42.921484] ? rcu_read_lock_sched_held+0x108/0x120 [ 42.926525] ? init_timer_key+0x126/0x3b0 [ 42.930662] ? try_to_del_timer_sync+0x120/0x120 [ 42.935404] ? round_jiffies_up+0xce/0x100 [ 42.939745] ? __round_jiffies_up_relative+0x150/0x150 [ 42.945008] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 42.949932] __tun_chr_ioctl+0x1b23/0x3d20 [ 42.954150] ? unwind_get_return_address+0x84/0xa0 [ 42.959073] ? tun_chr_read_iter+0x1e0/0x1e0 [ 42.963470] ? putname+0xee/0x130 [ 42.966908] ? save_stack+0xa3/0xd0 [ 42.970528] ? save_stack_trace+0x16/0x20 [ 42.974658] ? save_stack+0x43/0xd0 [ 42.978287] ? kasan_slab_free+0x71/0xc0 [ 42.982334] ? kmem_cache_free+0x77/0x280 [ 42.986505] ? putname+0xee/0x130 [ 42.989953] ? __lock_is_held+0xbc/0x140 [ 42.994138] ? check_same_owner+0x320/0x320 [ 42.998454] ? tun_chr_compat_ioctl+0x30/0x30 [ 43.002932] tun_chr_ioctl+0x2a/0x40 [ 43.006626] ? tun_chr_ioctl+0x2a/0x40 [ 43.010497] do_vfs_ioctl+0x1b1/0x1530 [ 43.014377] ? ioctl_preallocate+0x2b0/0x2b0 [ 43.018772] ? selinux_capable+0x40/0x40 [ 43.022818] ? putname+0xf3/0x130 [ 43.026282] ? do_sys_open+0x320/0x6d0 [ 43.030165] ? security_file_ioctl+0x7d/0xb0 [ 43.034556] ? security_file_ioctl+0x89/0xb0 [ 43.038953] SyS_ioctl+0x8f/0xc0 [ 43.042313] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 43.047055] RIP: 0033:0x443db9 [ 43.050227] RSP: 002b:00007ffd75bc8bc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [ 43.057945] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9 [ 43.065200] RDX: 0000000020000fd8 RSI: 00000000400454ca RDI: 0000000000000004 [ 43.072571] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000 [ 43.079825] R10: 0000000000000000 R11: 0000000000000202 R12: a1d15a479d91caa6 [ 43.087078] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000 [ 43.094351] [ 43.095962] Allocated by task 2983: [ 43.099573] save_stack_trace+0x16/0x20 [ 43.103532] save_stack+0x43/0xd0 [ 43.106967] kasan_kmalloc+0xad/0xe0 [ 43.110662] __kmalloc_node+0x47/0x70 [ 43.114444] kvmalloc_node+0x64/0xd0 [ 43.118143] alloc_netdev_mqs+0x16e/0xed0 [ 43.122292] __tun_chr_ioctl+0x12be/0x3d20 [ 43.126508] tun_chr_ioctl+0x2a/0x40 [ 43.130204] do_vfs_ioctl+0x1b1/0x1530 [ 43.134076] SyS_ioctl+0x8f/0xc0 [ 43.137428] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 43.142164] [ 43.143786] Freed by task 2983: [ 43.147048] save_stack_trace+0x16/0x20 [ 43.151006] save_stack+0x43/0xd0 [ 43.154441] kasan_slab_free+0x71/0xc0 [ 43.158315] kfree+0xca/0x250 [ 43.161410] kvfree+0x36/0x60 [ 43.164501] free_netdev+0x2cf/0x360 [ 43.168199] __tun_chr_ioctl+0x2cf6/0x3d20 [ 43.172456] tun_chr_ioctl+0x2a/0x40 [ 43.176152] do_vfs_ioctl+0x1b1/0x1530 [ 43.180066] SyS_ioctl+0x8f/0xc0 [ 43.183455] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 43.188189] [ 43.189802] The buggy address belongs to the object at ffff8801ce9502c0 [ 43.189802] which belongs to the cache kmalloc-16384 of size 16384 [ 43.202789] The buggy address is located 13320 bytes inside of [ 43.202789] 16384-byte region [ffff8801ce9502c0, ffff8801ce9542c0) [ 43.214991] The buggy address belongs to the page: [ 43.219996] page:ffffea00073a5400 count:1 mapcount:0 mapping:ffff8801ce9502c0 index:0x0 compound_mapcount: 0 [ 43.229955] flags: 0x200000000008100(slab|head) [ 43.234606] raw: 0200000000008100 ffff8801ce9502c0 0000000000000000 0000000100000001 [ 43.242472] raw: ffffea0006fe2e20 ffffea0007391420 ffff8801dac02200 0000000000000000 [ 43.250338] page dumped because: kasan: bad access detected [ 43.256030] [ 43.257639] Memory state around the buggy address: [ 43.262555] ffff8801ce953580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.269895] ffff8801ce953600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.277264] >ffff8801ce953680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.284612] ^ [ 43.290317] ffff8801ce953700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.297659] ffff8801ce953780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.304999] ================================================================== [ 43.312345] Disabling lock debugging due to kernel taint [ 43.317784] Kernel panic - not syncing: panic_on_warn set ... [ 43.317784] [ 43.325122] CPU: 0 PID: 2983 Comm: syzkaller137130 Tainted: G B 4.13.0-next-20170905+ #15 [ 43.334539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.343869] Call Trace: [ 43.346438] dump_stack+0x194/0x257 [ 43.350045] ? arch_local_irq_restore+0x53/0x53 [ 43.354696] ? vprintk_default+0x28/0x30 [ 43.358739] ? __internal_add_timer+0x1e0/0x2d0 [ 43.363694] panic+0x1e4/0x417 [ 43.366867] ? __warn+0x1d9/0x1d9 [ 43.370582] ? __internal_add_timer+0x275/0x2d0 [ 43.375228] kasan_end_report+0x50/0x50 [ 43.379203] kasan_report+0x137/0x340 [ 43.382983] __asan_report_store8_noabort+0x17/0x20 [ 43.388024] __internal_add_timer+0x275/0x2d0 [ 43.392501] ? calc_wheel_index+0x200/0x200 [ 43.396807] mod_timer+0x622/0x15b0 [ 43.400414] ? mod_timer_pending+0x14e0/0x14e0 [ 43.404973] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 43.410110] ? trace_hardirqs_on+0xd/0x10 [ 43.414263] ? _crng_backtrack_protect+0xd9/0x130 [ 43.419090] ? __lock_is_held+0xbc/0x140 [ 43.423129] ? __lockdep_init_map+0xe4/0x650 [ 43.427517] ? lockdep_init_map+0x3d/0x70 [ 43.431643] ? rcu_read_lock_sched_held+0x108/0x120 [ 43.436638] ? init_timer_key+0x126/0x3b0 [ 43.440808] ? try_to_del_timer_sync+0x120/0x120 [ 43.445543] ? round_jiffies_up+0xce/0x100 [ 43.449755] ? __round_jiffies_up_relative+0x150/0x150 [ 43.455009] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 43.459961] __tun_chr_ioctl+0x1b23/0x3d20 [ 43.464172] ? unwind_get_return_address+0x84/0xa0 [ 43.469084] ? tun_chr_read_iter+0x1e0/0x1e0 [ 43.473470] ? putname+0xee/0x130 [ 43.476901] ? save_stack+0xa3/0xd0 [ 43.480508] ? save_stack_trace+0x16/0x20 [ 43.484631] ? save_stack+0x43/0xd0 [ 43.488232] ? kasan_slab_free+0x71/0xc0 [ 43.492292] ? kmem_cache_free+0x77/0x280 [ 43.496416] ? putname+0xee/0x130 [ 43.499848] ? __lock_is_held+0xbc/0x140 [ 43.503937] ? check_same_owner+0x320/0x320 [ 43.508261] ? tun_chr_compat_ioctl+0x30/0x30 [ 43.512735] tun_chr_ioctl+0x2a/0x40 [ 43.516425] ? tun_chr_ioctl+0x2a/0x40 [ 43.520296] do_vfs_ioctl+0x1b1/0x1530 [ 43.524168] ? ioctl_preallocate+0x2b0/0x2b0 [ 43.528558] ? selinux_capable+0x40/0x40 [ 43.532597] ? putname+0xf3/0x130 [ 43.536027] ? do_sys_open+0x320/0x6d0 [ 43.539898] ? security_file_ioctl+0x7d/0xb0 [ 43.544283] ? security_file_ioctl+0x89/0xb0 [ 43.548669] SyS_ioctl+0x8f/0xc0 [ 43.552017] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 43.556748] RIP: 0033:0x443db9 [ 43.559914] RSP: 002b:00007ffd75bc8bc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [ 43.567598] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9 [ 43.574847] RDX: 0000000020000fd8 RSI: 00000000400454ca RDI: 0000000000000004 [ 43.582092] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000 [ 43.589339] R10: 0000000000000000 R11: 0000000000000202 R12: a1d15a479d91caa6 [ 43.596585] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000