net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   20.105232] ==================================================================
[   20.105979] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   20.106628] Write of size 8 at addr ffff8800696d3880 by task syzkaller942861/2976
[   20.107345] 
[   20.107501] CPU: 3 PID: 2976 Comm: syzkaller942861 Not tainted 4.13.0-next-20170912+ #2
[   20.108654] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   20.109913] Call Trace:
[   20.110414]  dump_stack+0x194/0x257
[   20.111115]  ? arch_local_irq_restore+0x53/0x53
[   20.111797]  ? show_regs_print_info+0x65/0x65
[   20.112245]  ? lock_timer_base+0x1a3/0x2b0
[   20.112639]  ? detach_if_pending+0x557/0x610
[   20.113057]  print_address_description+0x73/0x250
[   20.113511]  ? detach_if_pending+0x557/0x610
[   20.113920]  kasan_report+0x24e/0x340
[   20.114297]  __asan_report_store8_noabort+0x17/0x20
[   20.114759]  detach_if_pending+0x557/0x610
[   20.115172]  ? trace_raw_output_tick_stop+0x130/0x130
[   20.116357]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   20.116788]  ? lock_timer_base+0x1a3/0x2b0
[   20.117209]  ? lock_timer_base+0x1eb/0x2b0
[   20.117508]  ? __internal_add_timer+0x2d0/0x2d0
[   20.117836]  ? trace_hardirqs_on+0xd/0x10
[   20.118171]  try_to_del_timer_sync+0xa2/0x120
[   20.118487]  ? del_timer+0x130/0x130
[   20.118750]  ? del_timer_sync+0xeb/0x240
[   20.119060]  del_timer_sync+0x18a/0x240
[   20.119352]  tun_free_netdev+0x105/0x1b0
[   20.119637]  ? tun_xdp+0x410/0x410
[   20.119893]  ? cpumask_next+0x24/0x30
[   20.120188]  ? netdev_refcnt_read+0xed/0x150
[   20.120501]  ? tun_xdp+0x410/0x410
[   20.120750]  netdev_run_todo+0x870/0xca0
[   20.121051]  ? do_group_exit+0x149/0x400
[   20.121349]  ? register_netdev+0x30/0x30
[   20.121636]  ? lock_downgrade+0x990/0x990
[   20.121932]  ? trace_hardirqs_on+0xd/0x10
[   20.122254]  ? refcount_sub_and_test+0x115/0x1b0
[   20.122587]  ? refcount_inc+0x50/0x50
[   20.122862]  ? refcount_inc+0x50/0x50
[   20.123142]  ? sk_destruct+0x4c/0x80
[   20.123412]  ? __sk_free+0x5c/0x230
[   20.123668]  ? sk_free+0x2f/0x40
[   20.123905]  ? __tun_detach+0x176/0x1390
[   20.124227]  ? tun_attach+0xf90/0xf90
[   20.124500]  ? do_raw_spin_trylock+0x190/0x190
[   20.124824]  ? locks_remove_file+0x3fa/0x5a0
[   20.125158]  ? fcntl_setlk+0x10d0/0x10d0
[   20.125453]  ? __fsnotify_parent+0xb4/0x3a0
[   20.125758]  ? fsnotify+0x1af0/0x1af0
[   20.126041]  ? __tun_detach+0x1390/0x1390
[   20.126346]  ? __tun_detach+0x1390/0x1390
[   20.126637]  rtnl_unlock+0xe/0x10
[   20.126880]  tun_chr_close+0x49/0x60
[   20.127152]  __fput+0x333/0x7f0
[   20.127399]  ? fput+0x140/0x140
[   20.127632]  ? check_same_owner+0x320/0x320
[   20.127934]  ? _raw_spin_unlock_irq+0x27/0x70
[   20.128273]  ____fput+0x15/0x20
[   20.128505]  task_work_run+0x199/0x270
[   20.128779]  ? task_work_cancel+0x210/0x210
[   20.129096]  ? _raw_spin_unlock+0x22/0x30
[   20.129429]  ? switch_task_namespaces+0x87/0xc0
[   20.129759]  do_exit+0xa52/0x1b40
[   20.130004]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   20.130371]  ? check_noncircular+0x20/0x20
[   20.130671]  ? __handle_mm_fault+0x587/0x39c0
[   20.130987]  ? mm_update_next_owner+0x930/0x930
[   20.131330]  ? __pmd_alloc+0x4e0/0x4e0
[   20.131611]  ? find_held_lock+0x39/0x1d0
[   20.131904]  ? lock_downgrade+0x990/0x990
[   20.132228]  ? handle_mm_fault+0x410/0x8d0
[   20.132615]  ? down_read_trylock+0xdb/0x170
[   20.132928]  ? __do_page_fault+0x2b8/0xb60
[   20.133248]  ? __handle_mm_fault+0x39c0/0x39c0
[   20.133577]  ? vmacache_find+0x61/0x270
[   20.133864]  ? up_read+0x1a/0x40
[   20.134116]  ? __do_page_fault+0x35b/0xb60
[   20.134430]  ? do_page_fault+0xee/0x720
[   20.134716]  ? __do_page_fault+0xb60/0xb60
[   20.135037]  ? putname+0xf3/0x130
[   20.135284]  do_group_exit+0x149/0x400
[   20.135569]  ? lockdep_sys_exit+0x47/0xf0
[   20.135864]  ? SyS_exit+0x30/0x30
[   20.136140]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   20.136499]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   20.137399]  SyS_exit_group+0x1d/0x20
[   20.137780]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   20.138174] RIP: 0033:0x438b99
[   20.138410] RSP: 002b:00007fff3fb4caf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   20.138962] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438b99
[   20.139483] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   20.139997] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   20.140531] R10: ffffffffffffffcc R11: 0000000000000246 R12: 0000000000000001
[   20.141081] R13: 00000000006cc300 R14: 0000000000402690 R15: 0000000000000000
[   20.141835] 
[   20.141962] Allocated by task 2976:
[   20.142235]  save_stack_trace+0x16/0x20
[   20.142524]  save_stack+0x43/0xd0
[   20.142779]  kasan_kmalloc+0xad/0xe0
[   20.143063]  __kmalloc_node+0x47/0x70
[   20.143331]  kvmalloc_node+0x64/0xd0
[   20.143602]  alloc_netdev_mqs+0x16e/0xed0
[   20.143904]  __tun_chr_ioctl+0x12be/0x3d20
[   20.144253]  tun_chr_ioctl+0x2a/0x40
[   20.144602]  do_vfs_ioctl+0x1b1/0x1530
[   20.144887]  SyS_ioctl+0x8f/0xc0
[   20.145149]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   20.145478] 
[   20.145595] Freed by task 2976:
[   20.145838]  save_stack_trace+0x16/0x20
[   20.146139]  save_stack+0x43/0xd0
[   20.146380]  kasan_slab_free+0x71/0xc0
[   20.146650]  kfree+0xca/0x250
[   20.146879]  kvfree+0x36/0x60
[   20.147120]  free_netdev+0x2cf/0x360
[   20.147433]  __tun_chr_ioctl+0x2cf6/0x3d20
[   20.147766]  tun_chr_ioctl+0x2a/0x40
[   20.148119]  do_vfs_ioctl+0x1b1/0x1530
[   20.148417]  SyS_ioctl+0x8f/0xc0
[   20.148681]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   20.149095] 
[   20.149213] The buggy address belongs to the object at ffff8800696d0480
[   20.149213]  which belongs to the cache kmalloc-16384 of size 16384
[   20.150132] The buggy address is located 13312 bytes inside of
[   20.150132]  16384-byte region [ffff8800696d0480, ffff8800696d4480)
[   20.150970] The buggy address belongs to the page:
[   20.151349] page:ffffea0001a5b400 count:1 mapcount:0 mapping:ffff8800696d0480 index:0x0 compound_mapcount: 0
[   20.152092] flags: 0x500000000008100(slab|head)
[   20.152562] raw: 0500000000008100 ffff8800696d0480 0000000000000000 0000000100000001
[   20.153522] raw: ffffea0001aa0c20 ffff88006d800c50 ffff88003e802200 0000000000000000
[   20.154356] page dumped because: kasan: bad access detected
[   20.154980] 
[   20.155197] Memory state around the buggy address:
[   20.155798]  ffff8800696d3780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.156609]  ffff8800696d3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.157249] >ffff8800696d3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.157750]                    ^
[   20.158279]  ffff8800696d3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.158991]  ffff8800696d3980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.159510] ==================================================================
[   20.160010] Disabling lock debugging due to kernel taint
[   20.160608] Kernel panic - not syncing: panic_on_warn set ...
[   20.160608] 
[   20.161360] CPU: 3 PID: 2976 Comm: syzkaller942861 Tainted: G    B           4.13.0-next-20170912+ #2
[   20.161995] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   20.162676] Call Trace:
[   20.162906]  dump_stack+0x194/0x257
[   20.163232]  ? arch_local_irq_restore+0x53/0x53
[   20.163537]  ? vprintk_default+0x28/0x30
[   20.163905]  ? detach_if_pending+0x4c0/0x610
[   20.164225]  panic+0x1e4/0x417
[   20.164448]  ? __warn+0x1d9/0x1d9
[   20.164808]  ? detach_if_pending+0x557/0x610
[   20.165216]  kasan_end_report+0x50/0x50
[   20.165581]  kasan_report+0x137/0x340
[   20.165823]  __asan_report_store8_noabort+0x17/0x20
[   20.166171]  detach_if_pending+0x557/0x610
[   20.166509]  ? trace_raw_output_tick_stop+0x130/0x130
[   20.166825]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   20.167158]  ? lock_timer_base+0x1a3/0x2b0
[   20.167507]  ? lock_timer_base+0x1eb/0x2b0
[   20.167770]  ? __internal_add_timer+0x2d0/0x2d0
[   20.168057]  ? trace_hardirqs_on+0xd/0x10
[   20.168424]  try_to_del_timer_sync+0xa2/0x120
[   20.168831]  ? del_timer+0x130/0x130
[   20.169136]  ? del_timer_sync+0xeb/0x240
[   20.169433]  del_timer_sync+0x18a/0x240
[   20.169698]  tun_free_netdev+0x105/0x1b0
[   20.169983]  ? tun_xdp+0x410/0x410
[   20.170278]  ? cpumask_next+0x24/0x30
[   20.170683]  ? netdev_refcnt_read+0xed/0x150
[   20.171169]  ? tun_xdp+0x410/0x410
[   20.171533]  netdev_run_todo+0x870/0xca0
[   20.171810]  ? do_group_exit+0x149/0x400
[   20.172095]  ? register_netdev+0x30/0x30
[   20.172387]  ? lock_downgrade+0x990/0x990
[   20.172681]  ? trace_hardirqs_on+0xd/0x10
[   20.172969]  ? refcount_sub_and_test+0x115/0x1b0
[   20.173300]  ? refcount_inc+0x50/0x50
[   20.173556]  ? refcount_inc+0x50/0x50
[   20.173816]  ? sk_destruct+0x4c/0x80
[   20.174068]  ? __sk_free+0x5c/0x230
[   20.174398]  ? sk_free+0x2f/0x40
[   20.174701]  ? __tun_detach+0x176/0x1390
[   20.175000]  ? tun_attach+0xf90/0xf90
[   20.175350]  ? do_raw_spin_trylock+0x190/0x190
[   20.175776]  ? locks_remove_file+0x3fa/0x5a0
[   20.176196]  ? fcntl_setlk+0x10d0/0x10d0
[   20.176572]  ? __fsnotify_parent+0xb4/0x3a0
[   20.176962]  ? fsnotify+0x1af0/0x1af0
[   20.177317]  ? __tun_detach+0x1390/0x1390
[   20.177702]  ? __tun_detach+0x1390/0x1390
[   20.178088]  rtnl_unlock+0xe/0x10
[   20.178409]  tun_chr_close+0x49/0x60
[   20.178796]  __fput+0x333/0x7f0
[   20.179050]  ? fput+0x140/0x140
[   20.179357]  ? check_same_owner+0x320/0x320
[   20.179950]  ? _raw_spin_unlock_irq+0x27/0x70
[   20.180382]  ____fput+0x15/0x20
[   20.180685]  task_work_run+0x199/0x270
[   20.181072]  ? task_work_cancel+0x210/0x210
[   20.181474]  ? _raw_spin_unlock+0x22/0x30
[   20.181859]  ? switch_task_namespaces+0x87/0xc0
[   20.182290]  do_exit+0xa52/0x1b40
[   20.182595]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   20.183032]  ? check_noncircular+0x20/0x20
[   20.183426]  ? __handle_mm_fault+0x587/0x39c0
[   20.183841]  ? mm_update_next_owner+0x930/0x930
[   20.184302]  ? __pmd_alloc+0x4e0/0x4e0
[   20.184665]  ? find_held_lock+0x39/0x1d0
[   20.185043]  ? lock_downgrade+0x990/0x990
[   20.185434]  ? handle_mm_fault+0x410/0x8d0
[   20.185826]  ? down_read_trylock+0xdb/0x170
[   20.186191]  ? __do_page_fault+0x2b8/0xb60
[   20.186609]  ? __handle_mm_fault+0x39c0/0x39c0
[   20.187031]  ? vmacache_find+0x61/0x270
[   20.187401]  ? up_read+0x1a/0x40
[   20.187713]  ? __do_page_fault+0x35b/0xb60
[   20.188110]  ? do_page_fault+0xee/0x720
[   20.188477]  ? __do_page_fault+0xb60/0xb60
[   20.188895]  ? putname+0xf3/0x130
[   20.189216]  do_group_exit+0x149/0x400
[   20.189576]  ? lockdep_sys_exit+0x47/0xf0
[   20.189970]  ? SyS_exit+0x30/0x30
[   20.190303]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   20.190765]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   20.191204]  SyS_exit_group+0x1d/0x20
[   20.191555]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   20.191994] RIP: 0033:0x438b99
[   20.192306] RSP: 002b:00007fff3fb4caf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   20.193023] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438b99
[   20.193689] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   20.194357] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   20.195103] R10: ffffffffffffffcc R11: 0000000000000246 R12: 0000000000000001
[   20.195821] R13: 00000000006cc300 R14: 0000000000402690 R15: 0000000000000000
[   20.196617] Dumping ftrace buffer:
[   20.196942]    (ftrace buffer empty)
[   20.197202] Kernel Offset: disabled
[   20.197464] Rebooting in 86400 seconds..