BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:71
in_atomic(): 1, irqs_disabled(): 0, pid: 14371, name: syz-executor3
2 locks held by syz-executor3/14371:
 #0:  (&vcpu->mutex){+.+.}, at: [<ffffffff8106216c>] vcpu_load+0x1c/0x70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:154
 #1:  (&kvm->srcu){....}, at: [<ffffffff810e213d>] vcpu_enter_guest arch/x86/kvm/x86.c:7032 [inline]
 #1:  (&kvm->srcu){....}, at: [<ffffffff810e213d>] vcpu_run arch/x86/kvm/x86.c:7111 [inline]
 #1:  (&kvm->srcu){....}, at: [<ffffffff810e213d>] kvm_arch_vcpu_ioctl_run+0x1bdd/0x5a30 arch/x86/kvm/x86.c:7272
CPU: 0 PID: 14371 Comm: syz-executor3 Not tainted 4.13.0-rc7-next-20170829+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6022
 __might_sleep+0x95/0x190 kernel/sched/core.c:5975
 __might_fault+0xab/0x1d0 mm/memory.c:4483
 __copy_from_user include/linux/uaccess.h:71 [inline]
 paging32_walk_addr_generic+0x427/0x1d80 arch/x86/kvm/paging_tmpl.h:369
 paging32_walk_addr arch/x86/kvm/paging_tmpl.h:475 [inline]
 paging32_gva_to_gpa+0xa5/0x230 arch/x86/kvm/paging_tmpl.h:913
 kvm_read_guest_virt_helper+0xd8/0x140 arch/x86/kvm/x86.c:4436
 kvm_read_guest_virt_system+0x3c/0x50 arch/x86/kvm/x86.c:4503
 segmented_read_std+0x10c/0x180 arch/x86/kvm/emulate.c:822
 em_fxrstor+0x27b/0x410 arch/x86/kvm/emulate.c:4025
 x86_emulate_insn+0x55d/0x3cf0 arch/x86/kvm/emulate.c:5483
 x86_emulate_instruction+0x411/0x1ca0 arch/x86/kvm/x86.c:5735
 kvm_mmu_page_fault+0x1b0/0x2f0 arch/x86/kvm/mmu.c:4956
 handle_ept_violation+0x194/0x540 arch/x86/kvm/vmx.c:6502
 vmx_handle_exit+0x24b/0x1a60 arch/x86/kvm/vmx.c:8823
 vcpu_enter_guest arch/x86/kvm/x86.c:7049 [inline]
 vcpu_run arch/x86/kvm/x86.c:7111 [inline]
 kvm_arch_vcpu_ioctl_run+0x1d36/0x5a30 arch/x86/kvm/x86.c:7272
 kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2592
 vfs_ioctl fs/ioctl.c:45 [inline]
 do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
 SYSC_ioctl fs/ioctl.c:700 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x446749
RSP: 002b:00007f7e15a4dc08 EFLAGS: 00000296 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 0000000000446749
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000019
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000009120
R13: 000000002aaaaaab R14: 00000000006e7690 R15: 0000000000000019
QAT: Invalid ioctl
QAT: Invalid ioctl
do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app
selinux_nlmsg_perm: 2 callbacks suppressed
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14478 comm=syz-executor7
do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app
audit: type=1326 audit(1504075992.620:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14542 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0
audit: type=1326 audit(1504075992.711:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14542 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0
device lo entered promiscuous mode
sctp: [Deprecated]: syz-executor1 (pid 14682) Use of struct sctp_assoc_value in delayed_ack socket option.
Use struct sctp_sack_info instead
sctp: [Deprecated]: syz-executor1 (pid 14723) Use of struct sctp_assoc_value in delayed_ack socket option.
Use struct sctp_sack_info instead
kvm_hv_set_msr: 129 callbacks suppressed
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008f data 0x71
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008e data 0x71
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008d data 0x71
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008c data 0x71
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008b data 0xd1
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008a data 0x31
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000089 data 0x31
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000088 data 0x31
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000087 data 0x31
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000086 data 0x31
kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000020 data 0xb
nla_parse: 7 callbacks suppressed
netlink: 3440 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'.
audit: type=1326 audit(1504075993.919:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14790 comm="syz-executor2" exe="/syz-executor2" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0
netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'.
audit: type=1326 audit(1504075994.012:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14790 comm="syz-executor2" exe="/syz-executor2" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0
sg_write: data in/out 2127708969/6 bytes for SCSI command 0xe3-- guessing data in;
   program syz-executor5 not setting count and/or reply_len properly
9pnet_virtio: no channels available for device ./bus
sg_write: data in/out 2127708969/6 bytes for SCSI command 0xe3-- guessing data in;
   program syz-executor5 not setting count and/or reply_len properly
9pnet_virtio: no channels available for device ./bus
audit: type=1326 audit(1504075994.719:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14980 comm="syz-executor3" exe="/syz-executor3" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=37422 sclass=netlink_audit_socket pig=15032 comm=syz-executor5
audit: type=1326 audit(1504075994.813:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14980 comm="syz-executor3" exe="/syz-executor3" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=37422 sclass=netlink_audit_socket pig=15044 comm=syz-executor5
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=514 sclass=netlink_audit_socket pig=15051 comm=syz-executor5
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=514 sclass=netlink_audit_socket pig=15051 comm=syz-executor5
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=19 sclass=netlink_audit_socket pig=15071 comm=syz-executor4
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=19 sclass=netlink_audit_socket pig=15071 comm=syz-executor4
netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'.
QAT: Invalid ioctl
netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'.
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
device lo entered promiscuous mode
netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
audit: type=1326 audit(1504075995.516:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=15205 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0xffff0000
tmpfs: No value for mount option 'Em���2�?[��f���)ԇ��$�-tc�%os���XY�Q-��E
F���ˬ��g�K�T�\ê��65��E�q�`�UV���ͼ�Lv��T�(��b7O��tB�D�b�N�Z'
tmpfs: No value for mount option 'Em���2�?[��f���)ԇ��$�-tc�%os���XY�Q-��E
F���ˬ��g�K�T�\ê��65��E�q�`�UV���ͼ�Lv��T�(��b7O��tB�D�b�N�Z'
QAT: Invalid ioctl
audit: type=1326 audit(1504075995.675:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=15205 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0xffff0000
QAT: Invalid ioctl
device  entered promiscuous mode
device  left promiscuous mode
QAT: Invalid ioctl
QAT: Invalid ioctl
sock: process `syz-executor4' is using obsolete getsockopt SO_BSDCOMPAT
print_req_error: I/O error, dev loop0, sector 0
netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'.
sctp: [Deprecated]: syz-executor7 (pid 15725) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
PF_BRIDGE: RTM_SETLINK with unknown ifindex
sctp: [Deprecated]: syz-executor7 (pid 15749) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
PF_BRIDGE: RTM_SETLINK with unknown ifindex
sctp: [Deprecated]: syz-executor0 (pid 15786) Use of struct sctp_assoc_value in delayed_ack socket option.
Use struct sctp_sack_info instead
sctp: [Deprecated]: syz-executor0 (pid 15801) Use of struct sctp_assoc_value in delayed_ack socket option.
Use struct sctp_sack_info instead
RDS: rds_bind could not find a transport for 224.0.0.2, load rds_tcp or rds_rdma?
RDS: rds_bind could not find a transport for 224.0.0.2, load rds_tcp or rds_rdma?
sctp: [Deprecated]: syz-executor2 (pid 15951) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor2 (pid 15960) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
nla_parse: 2 callbacks suppressed
netlink: 6 bytes leftover after parsing attributes in process `syz-executor7'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'.
==================================================================
BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:673 [inline]
BUG: KASAN: use-after-free in enqueue_timer kernel/time/timer.c:520 [inline]
BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0 kernel/time/timer.c:531
Write of size 8 at addr ffff88002bfeb6c8 by task kworker/0:3/3689

CPU: 0 PID: 3689 Comm: kworker/0:3 Tainted: G        W       4.13.0-rc7-next-20170829+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: pm pm_runtime_work
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x24e/0x340 mm/kasan/report.c:409
 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:435
 hlist_add_head include/linux/list.h:673 [inline]
 enqueue_timer kernel/time/timer.c:520 [inline]
 __internal_add_timer+0x275/0x2d0 kernel/time/timer.c:531
 internal_add_timer kernel/time/timer.c:573 [inline]
 __mod_timer kernel/time/timer.c:1024 [inline]
 mod_timer+0x622/0x15b0 kernel/time/timer.c:1071
netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'.
 rpm_suspend+0x126b/0x1610 drivers/base/power/runtime.c:533
 __pm_runtime_suspend+0x5b/0xf0 drivers/base/power/runtime.c:1009
 pm_runtime_autosuspend include/linux/pm_runtime.h:195 [inline]
 usb_runtime_idle+0x2f/0x40 drivers/usb/core/driver.c:1889
 __rpm_callback+0x338/0xab0 drivers/base/power/runtime.c:334
 rpm_idle+0x632/0xac0 drivers/base/power/runtime.c:426
 pm_runtime_work+0x144/0x170 drivers/base/power/runtime.c:874
 process_one_work+0xbff/0x1bf0 kernel/workqueue.c:2119
 worker_thread+0x223/0x1860 kernel/workqueue.c:2254
 kthread+0x39c/0x470 kernel/kthread.c:231
 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

Allocated by task 15835:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 __do_kmalloc_node mm/slab.c:3689 [inline]
 __kmalloc_node+0x47/0x70 mm/slab.c:3696
 kmalloc_node include/linux/slab.h:535 [inline]
 kvmalloc_node+0x64/0xd0 mm/util.c:397
 kvmalloc include/linux/mm.h:529 [inline]
 kvzalloc include/linux/mm.h:537 [inline]
 alloc_netdev_mqs+0x16e/0xed0 net/core/dev.c:8010
 tun_set_iff drivers/net/tun.c:2008 [inline]
 __tun_chr_ioctl+0x12be/0x3d20 drivers/net/tun.c:2262
 tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:2507
 vfs_ioctl fs/ioctl.c:45 [inline]
 do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
 SYSC_ioctl fs/ioctl.c:700 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 15835:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xca/0x250 mm/slab.c:3820
 kvfree+0x36/0x60 mm/util.c:416
 netdev_freemem net/core/dev.c:7962 [inline]
 free_netdev+0x2cf/0x360 net/core/dev.c:8124
 tun_set_iff drivers/net/tun.c:2091 [inline]
 __tun_chr_ioctl+0x2cf6/0x3d20 drivers/net/tun.c:2262
 tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:2507
 vfs_ioctl fs/ioctl.c:45 [inline]
 do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
 SYSC_ioctl fs/ioctl.c:700 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
 entry_SYSCALL_64_fastpath+0x1f/0xbe

The buggy address belongs to the object at ffff88002bfe82c0
 which belongs to the cache kmalloc-16384 of size 16384
The buggy address is located 13320 bytes inside of
 16384-byte region [ffff88002bfe82c0, ffff88002bfec2c0)
The buggy address belongs to the page:
page:ffffea0000affa00 count:1 mapcount:0 mapping:ffff88002bfe82c0 index:0x0 compound_mapcount: 0
flags: 0x100000000008100(slab|head)
raw: 0100000000008100 ffff88002bfe82c0 0000000000000000 0000000100000001
raw: ffffea0000db4620 ffffea0000f47e20 ffff88003e802200 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88002bfeb580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88002bfeb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88002bfeb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88002bfeb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88002bfeb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================