INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-2,10.128.15.195' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   30.249372] ==================================================================
[   30.256853] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   30.263577] Write of size 8 at addr ffff8801cddeb740 by task syzkaller575663/2985
[   30.271164] 
[   30.272769] CPU: 1 PID: 2985 Comm: syzkaller575663 Not tainted 4.14.0-rc2+ #19
[   30.280099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   30.289424] Call Trace:
[   30.291986]  dump_stack+0x194/0x257
[   30.295591]  ? arch_local_irq_restore+0x53/0x53
[   30.300234]  ? show_regs_print_info+0x65/0x65
[   30.304706]  ? lock_timer_base+0x1a3/0x2b0
[   30.308919]  ? detach_if_pending+0x557/0x610
[   30.313308]  print_address_description+0x73/0x250
[   30.318126]  ? detach_if_pending+0x557/0x610
[   30.322508]  kasan_report+0x25b/0x340
[   30.326287]  __asan_report_store8_noabort+0x17/0x20
[   30.331274]  detach_if_pending+0x557/0x610
[   30.335485]  ? trace_raw_output_tick_stop+0x130/0x130
[   30.340647]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   30.345283]  ? lock_timer_base+0x1a3/0x2b0
[   30.349489]  ? lock_timer_base+0x1eb/0x2b0
[   30.353698]  ? __internal_add_timer+0x2d0/0x2d0
[   30.358340]  ? trace_hardirqs_on+0xd/0x10
[   30.362466]  try_to_del_timer_sync+0xa2/0x120
[   30.366930]  ? del_timer+0x130/0x130
[   30.370615]  ? del_timer_sync+0xeb/0x240
[   30.374653]  del_timer_sync+0x18a/0x240
[   30.378601]  tun_free_netdev+0x105/0x1b0
[   30.382633]  ? tun_xdp+0x410/0x410
[   30.386144]  ? cpumask_next+0x24/0x30
[   30.389920]  ? netdev_refcnt_read+0xed/0x150
[   30.394301]  ? tun_xdp+0x410/0x410
[   30.397814]  netdev_run_todo+0x870/0xca0
[   30.401846]  ? do_group_exit+0x149/0x400
[   30.405885]  ? register_netdev+0x30/0x30
[   30.409918]  ? lock_downgrade+0x990/0x990
[   30.414037]  ? trace_hardirqs_on+0xd/0x10
[   30.418187]  ? refcount_sub_and_test+0x115/0x1b0
[   30.422921]  ? refcount_inc+0x50/0x50
[   30.426692]  ? refcount_inc+0x50/0x50
[   30.430475]  ? sk_destruct+0x4c/0x80
[   30.434158]  ? __sk_free+0x5c/0x230
[   30.437765]  ? sk_free+0x2f/0x40
[   30.441101]  ? __tun_detach+0x176/0x1390
[   30.445143]  ? tun_attach+0xf90/0xf90
[   30.448917]  ? do_raw_spin_trylock+0x190/0x190
[   30.453472]  ? locks_remove_file+0x3fa/0x5a0
[   30.457852]  ? fcntl_setlk+0x10d0/0x10d0
[   30.461887]  ? __fsnotify_parent+0xb4/0x3a0
[   30.466180]  ? fsnotify+0x1af0/0x1af0
[   30.469954]  ? __tun_detach+0x1390/0x1390
[   30.474072]  ? __tun_detach+0x1390/0x1390
[   30.478193]  rtnl_unlock+0xe/0x10
[   30.481616]  tun_chr_close+0x49/0x60
[   30.485304]  __fput+0x333/0x7f0
[   30.488559]  ? fput+0x140/0x140
[   30.491811]  ? check_same_owner+0x320/0x320
[   30.496103]  ? _raw_spin_unlock_irq+0x27/0x70
[   30.500573]  ____fput+0x15/0x20
[   30.503833]  task_work_run+0x199/0x270
[   30.507694]  ? task_work_cancel+0x210/0x210
[   30.511988]  ? _raw_spin_unlock+0x22/0x30
[   30.516106]  ? switch_task_namespaces+0x87/0xc0
[   30.520750]  do_exit+0x9d2/0x1af0
[   30.524178]  ? mm_update_next_owner+0x930/0x930
[   30.528819]  ? lock_acquire+0x1d5/0x580
[   30.532765]  ? __handle_mm_fault+0xf07/0x39c0
[   30.537235]  ? lock_release+0xd70/0xd70
[   30.541186]  ? check_noncircular+0x20/0x20
[   30.545394]  ? kvfree+0x3b/0x60
[   30.548659]  ? rtnl_unlock+0xe/0x10
[   30.552258]  ? check_noncircular+0x20/0x20
[   30.556465]  ? __handle_mm_fault+0x587/0x39c0
[   30.560934]  ? __pmd_alloc+0x4e0/0x4e0
[   30.564802]  ? find_held_lock+0x39/0x1d0
[   30.568846]  ? lock_downgrade+0x990/0x990
[   30.572989]  do_group_exit+0x149/0x400
[   30.576844]  ? __handle_mm_fault+0x39c0/0x39c0
[   30.581396]  ? vmacache_find+0x5f/0x280
[   30.585341]  ? SyS_exit+0x30/0x30
[   30.588773]  ? do_fast_syscall_32+0x158/0xf05
[   30.593237]  ? do_group_exit+0x400/0x400
[   30.597271]  SyS_exit_group+0x1d/0x20
[   30.601042]  do_fast_syscall_32+0x3f2/0xf05
[   30.605355]  ? do_int80_syscall_32+0x940/0x940
[   30.609913]  ? kasan_check_read+0x11/0x20
[   30.614035]  ? syscall_return_slowpath+0x510/0x510
[   30.618943]  ? SyS_rt_sigaction+0x94/0x1b0
[   30.623156]  ? lockdep_sys_exit+0x47/0xf0
[   30.627278]  ? retint_user+0x18/0x20
[   30.630967]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   30.635790]  entry_SYSENTER_compat+0x51/0x60
[   30.640168] RIP: 0023:0xf7fbcc79
[   30.643503] RSP: 002b:00000000ffc1a37c EFLAGS: 00000292 ORIG_RAX: 00000000000000fc
[   30.651194] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000080f2298
[   30.658445] RDX: 0000000000000000 RSI: 00000000080db4b8 RDI: 00000000080f22a0
[   30.665688] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
[   30.672942] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   30.680182] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   30.687440] 
[   30.689041] Allocated by task 2985:
[   30.692641]  save_stack_trace+0x16/0x20
[   30.696584]  save_stack+0x43/0xd0
[   30.700019]  kasan_kmalloc+0xad/0xe0
[   30.703708]  __kmalloc_node+0x47/0x70
[   30.707480]  kvmalloc_node+0x64/0xd0
[   30.711165]  alloc_netdev_mqs+0x16e/0xed0
[   30.715284]  __tun_chr_ioctl+0x12be/0x3d20
[   30.719488]  tun_chr_compat_ioctl+0x29/0x30
[   30.723781]  compat_SyS_ioctl+0x1d7/0x3290
[   30.727985]  do_fast_syscall_32+0x3f2/0xf05
[   30.732275]  entry_SYSENTER_compat+0x51/0x60
[   30.736649] 
[   30.738246] Freed by task 2985:
[   30.741494]  save_stack_trace+0x16/0x20
[   30.745436]  save_stack+0x43/0xd0
[   30.748857]  kasan_slab_free+0x71/0xc0
[   30.752713]  kfree+0xca/0x250
[   30.755789]  kvfree+0x36/0x60
[   30.758873]  free_netdev+0x2cf/0x360
[   30.762555]  __tun_chr_ioctl+0x2cf6/0x3d20
[   30.766759]  tun_chr_compat_ioctl+0x29/0x30
[   30.771048]  compat_SyS_ioctl+0x1d7/0x3290
[   30.775250]  do_fast_syscall_32+0x3f2/0xf05
[   30.779541]  entry_SYSENTER_compat+0x51/0x60
[   30.783915] 
[   30.785512] The buggy address belongs to the object at ffff8801cdde8340
[   30.785512]  which belongs to the cache kmalloc-16384 of size 16384
[   30.798483] The buggy address is located 13312 bytes inside of
[   30.798483]  16384-byte region [ffff8801cdde8340, ffff8801cddec340)
[   30.810680] The buggy address belongs to the page:
[   30.815584] page:ffffea0007377a00 count:1 mapcount:0 mapping:ffff8801cdde8340 index:0x0 compound_mapcount: 0
[   30.825529] flags: 0x200000000008100(slab|head)
[   30.830167] raw: 0200000000008100 ffff8801cdde8340 0000000000000000 0000000100000001
[   30.838021] raw: ffffea000733de20 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   30.845869] page dumped because: kasan: bad access detected
[   30.851545] 
[   30.853142] Memory state around the buggy address:
[   30.858038]  ffff8801cddeb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.865375]  ffff8801cddeb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.872703] >ffff8801cddeb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.880029]                                            ^
[   30.885446]  ffff8801cddeb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.892774]  ffff8801cddeb800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.900102] ==================================================================
[   30.907429] Disabling lock debugging due to kernel taint
[   30.912842] Kernel panic - not syncing: panic_on_warn set ...
[   30.912842] 
[   30.920168] CPU: 1 PID: 2985 Comm: syzkaller575663 Tainted: G    B           4.14.0-rc2+ #19
[   30.928706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   30.938023] Call Trace:
[   30.940578]  dump_stack+0x194/0x257
[   30.944171]  ? arch_local_irq_restore+0x53/0x53
[   30.948807]  ? vprintk_default+0x28/0x30
[   30.952837]  ? detach_if_pending+0x4d0/0x610
[   30.957219]  panic+0x1e4/0x417
[   30.960378]  ? __warn+0x1d9/0x1d9
[   30.963804]  ? detach_if_pending+0x557/0x610
[   30.968178]  kasan_end_report+0x50/0x50
[   30.972114]  kasan_report+0x144/0x340
[   30.975887]  __asan_report_store8_noabort+0x17/0x20
[   30.980874]  detach_if_pending+0x557/0x610
[   30.985075]  ? trace_raw_output_tick_stop+0x130/0x130
[   30.990230]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   30.994860]  ? lock_timer_base+0x1a3/0x2b0
[   30.999077]  ? lock_timer_base+0x1eb/0x2b0
[   31.003276]  ? __internal_add_timer+0x2d0/0x2d0
[   31.007910]  ? trace_hardirqs_on+0xd/0x10
[   31.012025]  try_to_del_timer_sync+0xa2/0x120
[   31.016484]  ? del_timer+0x130/0x130
[   31.020162]  ? del_timer_sync+0xeb/0x240
[   31.024189]  del_timer_sync+0x18a/0x240
[   31.028129]  tun_free_netdev+0x105/0x1b0
[   31.032153]  ? tun_xdp+0x410/0x410
[   31.035657]  ? cpumask_next+0x24/0x30
[   31.039425]  ? netdev_refcnt_read+0xed/0x150
[   31.043798]  ? tun_xdp+0x410/0x410
[   31.047303]  netdev_run_todo+0x870/0xca0
[   31.051330]  ? do_group_exit+0x149/0x400
[   31.055359]  ? register_netdev+0x30/0x30
[   31.059386]  ? lock_downgrade+0x990/0x990
[   31.063498]  ? trace_hardirqs_on+0xd/0x10
[   31.067622]  ? refcount_sub_and_test+0x115/0x1b0
[   31.072341]  ? refcount_inc+0x50/0x50
[   31.076103]  ? refcount_inc+0x50/0x50
[   31.079880]  ? sk_destruct+0x4c/0x80
[   31.083830]  ? __sk_free+0x5c/0x230
[   31.087432]  ? sk_free+0x2f/0x40
[   31.090766]  ? __tun_detach+0x176/0x1390
[   31.094798]  ? tun_attach+0xf90/0xf90
[   31.098569]  ? do_raw_spin_trylock+0x190/0x190
[   31.103121]  ? locks_remove_file+0x3fa/0x5a0
[   31.107508]  ? fcntl_setlk+0x10d0/0x10d0
[   31.111537]  ? __fsnotify_parent+0xb4/0x3a0
[   31.115824]  ? fsnotify+0x1af0/0x1af0
[   31.119590]  ? __tun_detach+0x1390/0x1390
[   31.123706]  ? __tun_detach+0x1390/0x1390
[   31.127825]  rtnl_unlock+0xe/0x10
[   31.131244]  tun_chr_close+0x49/0x60
[   31.134923]  __fput+0x333/0x7f0
[   31.138169]  ? fput+0x140/0x140
[   31.141478]  ? check_same_owner+0x320/0x320
[   31.145768]  ? _raw_spin_unlock_irq+0x27/0x70
[   31.150242]  ____fput+0x15/0x20
[   31.153487]  task_work_run+0x199/0x270
[   31.157340]  ? task_work_cancel+0x210/0x210
[   31.161626]  ? _raw_spin_unlock+0x22/0x30
[   31.165740]  ? switch_task_namespaces+0x87/0xc0
[   31.170377]  do_exit+0x9d2/0x1af0
[   31.173799]  ? mm_update_next_owner+0x930/0x930
[   31.178437]  ? lock_acquire+0x1d5/0x580
[   31.182374]  ? __handle_mm_fault+0xf07/0x39c0
[   31.186837]  ? lock_release+0xd70/0xd70
[   31.190777]  ? check_noncircular+0x20/0x20
[   31.194978]  ? kvfree+0x3b/0x60
[   31.198226]  ? rtnl_unlock+0xe/0x10
[   31.201820]  ? check_noncircular+0x20/0x20
[   31.206021]  ? __handle_mm_fault+0x587/0x39c0
[   31.210484]  ? __pmd_alloc+0x4e0/0x4e0
[   31.214340]  ? find_held_lock+0x39/0x1d0
[   31.218370]  ? lock_downgrade+0x990/0x990
[   31.222506]  do_group_exit+0x149/0x400
[   31.226359]  ? __handle_mm_fault+0x39c0/0x39c0
[   31.230917]  ? vmacache_find+0x5f/0x280
[   31.234859]  ? SyS_exit+0x30/0x30
[   31.238281]  ? do_fast_syscall_32+0x158/0xf05
[   31.242749]  ? do_group_exit+0x400/0x400
[   31.246774]  SyS_exit_group+0x1d/0x20