INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-1,10.128.0.37' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   49.429365] ==================================================================
[   49.436807] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   49.443533] Write of size 8 at addr ffff8801ce15b740 by task syzkaller096631/2986
[   49.451130] 
[   49.452733] CPU: 1 PID: 2986 Comm: syzkaller096631 Not tainted 4.14.0-rc2+ #18
[   49.460073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   49.469400] Call Trace:
[   49.471965]  dump_stack+0x194/0x257
[   49.475564]  ? arch_local_irq_restore+0x53/0x53
[   49.480205]  ? show_regs_print_info+0x65/0x65
[   49.484675]  ? lock_timer_base+0x1a3/0x2b0
[   49.488881]  ? detach_if_pending+0x557/0x610
[   49.493263]  print_address_description+0x73/0x250
[   49.498077]  ? detach_if_pending+0x557/0x610
[   49.502462]  kasan_report+0x25b/0x340
[   49.506240]  __asan_report_store8_noabort+0x17/0x20
[   49.511229]  detach_if_pending+0x557/0x610
[   49.515438]  ? trace_raw_output_tick_stop+0x130/0x130
[   49.520602]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   49.525240]  ? lock_timer_base+0x1a3/0x2b0
[   49.529445]  ? lock_timer_base+0x1eb/0x2b0
[   49.533655]  ? __internal_add_timer+0x2d0/0x2d0
[   49.538300]  ? trace_hardirqs_on+0xd/0x10
[   49.542426]  try_to_del_timer_sync+0xa2/0x120
[   49.546892]  ? del_timer+0x130/0x130
[   49.550579]  ? del_timer_sync+0xeb/0x240
[   49.554616]  del_timer_sync+0x18a/0x240
[   49.558571]  tun_free_netdev+0x105/0x1b0
[   49.562603]  ? tun_xdp+0x410/0x410
[   49.566112]  ? cpumask_next+0x24/0x30
[   49.569884]  ? netdev_refcnt_read+0xed/0x150
[   49.574267]  ? tun_xdp+0x410/0x410
[   49.577778]  netdev_run_todo+0x870/0xca0
[   49.581808]  ? do_group_exit+0x149/0x400
[   49.585845]  ? register_netdev+0x30/0x30
[   49.589879]  ? lock_downgrade+0x990/0x990
[   49.593997]  ? trace_hardirqs_on+0xd/0x10
[   49.598135]  ? refcount_sub_and_test+0x115/0x1b0
[   49.602862]  ? refcount_inc+0x50/0x50
[   49.606631]  ? refcount_inc+0x50/0x50
[   49.610410]  ? sk_destruct+0x4c/0x80
[   49.614093]  ? __sk_free+0x5c/0x230
[   49.617692]  ? sk_free+0x2f/0x40
[   49.621029]  ? __tun_detach+0x176/0x1390
[   49.625071]  ? tun_attach+0xf90/0xf90
[   49.628846]  ? do_raw_spin_trylock+0x190/0x190
[   49.633399]  ? locks_remove_file+0x3fa/0x5a0
[   49.637779]  ? fcntl_setlk+0x10d0/0x10d0
[   49.641812]  ? __fsnotify_parent+0xb4/0x3a0
[   49.646106]  ? fsnotify+0x1af0/0x1af0
[   49.649881]  ? __tun_detach+0x1390/0x1390
[   49.654001]  ? __tun_detach+0x1390/0x1390
[   49.658120]  rtnl_unlock+0xe/0x10
[   49.661544]  tun_chr_close+0x49/0x60
[   49.665227]  __fput+0x333/0x7f0
[   49.668482]  ? fput+0x140/0x140
[   49.671735]  ? check_same_owner+0x320/0x320
[   49.676025]  ? _raw_spin_unlock_irq+0x27/0x70
[   49.680495]  ____fput+0x15/0x20
[   49.683745]  task_work_run+0x199/0x270
[   49.687606]  ? task_work_cancel+0x210/0x210
[   49.691899]  ? _raw_spin_unlock+0x22/0x30
[   49.696019]  ? switch_task_namespaces+0x87/0xc0
[   49.700669]  do_exit+0x9d2/0x1af0
[   49.704099]  ? mm_update_next_owner+0x930/0x930
[   49.708737]  ? lock_acquire+0x1d5/0x580
[   49.712685]  ? __handle_mm_fault+0xf07/0x39c0
[   49.717181]  ? lock_release+0xd70/0xd70
[   49.721139]  ? check_noncircular+0x20/0x20
[   49.725349]  ? kvfree+0x3b/0x60
[   49.728605]  ? rtnl_unlock+0xe/0x10
[   49.732210]  ? check_noncircular+0x20/0x20
[   49.736419]  ? __handle_mm_fault+0x587/0x39c0
[   49.740889]  ? __pmd_alloc+0x4e0/0x4e0
[   49.744756]  ? find_held_lock+0x39/0x1d0
[   49.748799]  ? lock_downgrade+0x990/0x990
[   49.752946]  do_group_exit+0x149/0x400
[   49.756807]  ? __handle_mm_fault+0x39c0/0x39c0
[   49.761364]  ? vmacache_find+0x5f/0x280
[   49.765319]  ? SyS_exit+0x30/0x30
[   49.768750]  ? do_fast_syscall_32+0x158/0xf05
[   49.773219]  ? do_group_exit+0x400/0x400
[   49.777425]  SyS_exit_group+0x1d/0x20
[   49.781206]  do_fast_syscall_32+0x3f2/0xf05
[   49.785507]  ? do_int80_syscall_32+0x940/0x940
[   49.790064]  ? kasan_check_read+0x11/0x20
[   49.794188]  ? syscall_return_slowpath+0x510/0x510
[   49.799095]  ? SyS_rt_sigaction+0x94/0x1b0
[   49.803306]  ? lockdep_sys_exit+0x47/0xf0
[   49.807426]  ? retint_user+0x18/0x20
[   49.811116]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   49.815935]  entry_SYSENTER_compat+0x51/0x60
[   49.820313] RIP: 0023:0xf7fa5c79
[   49.823649] RSP: 002b:00000000ff9b4b1c EFLAGS: 00000292 ORIG_RAX: 00000000000000fc
[   49.831331] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000080f1298
[   49.838570] RDX: 0000000000000000 RSI: 00000000080dae18 RDI: 00000000080f12a0
[   49.845809] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
[   49.853048] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   49.860290] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   49.867549] 
[   49.869150] Allocated by task 2986:
[   49.872752]  save_stack_trace+0x16/0x20
[   49.876696]  save_stack+0x43/0xd0
[   49.880118]  kasan_kmalloc+0xad/0xe0
[   49.883799]  __kmalloc_node+0x47/0x70
[   49.887574]  kvmalloc_node+0x64/0xd0
[   49.891261]  alloc_netdev_mqs+0x16e/0xed0
[   49.895387]  __tun_chr_ioctl+0x12be/0x3d20
[   49.899590]  tun_chr_compat_ioctl+0x29/0x30
[   49.903885]  compat_SyS_ioctl+0x1d7/0x3290
[   49.908089]  do_fast_syscall_32+0x3f2/0xf05
[   49.912379]  entry_SYSENTER_compat+0x51/0x60
[   49.916764] 
[   49.918360] Freed by task 2986:
[   49.921609]  save_stack_trace+0x16/0x20
[   49.925551]  save_stack+0x43/0xd0
[   49.928983]  kasan_slab_free+0x71/0xc0
[   49.932839]  kfree+0xca/0x250
[   49.935914]  kvfree+0x36/0x60
[   49.938988]  free_netdev+0x2cf/0x360
[   49.942672]  __tun_chr_ioctl+0x2cf6/0x3d20
[   49.946875]  tun_chr_compat_ioctl+0x29/0x30
[   49.951170]  compat_SyS_ioctl+0x1d7/0x3290
[   49.955386]  do_fast_syscall_32+0x3f2/0xf05
[   49.959679]  entry_SYSENTER_compat+0x51/0x60
[   49.964052] 
[   49.965650] The buggy address belongs to the object at ffff8801ce158340
[   49.965650]  which belongs to the cache kmalloc-16384 of size 16384
[   49.978622] The buggy address is located 13312 bytes inside of
[   49.978622]  16384-byte region [ffff8801ce158340, ffff8801ce15c340)
[   49.990810] The buggy address belongs to the page:
[   49.995709] page:ffffea0007385600 count:1 mapcount:0 mapping:ffff8801ce158340 index:0x0 compound_mapcount: 0
[   50.005660] flags: 0x200000000008100(slab|head)
[   50.010302] raw: 0200000000008100 ffff8801ce158340 0000000000000000 0000000100000001
[   50.018151] raw: ffffea000733b020 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   50.026008] page dumped because: kasan: bad access detected
[   50.031684] 
[   50.033282] Memory state around the buggy address:
[   50.038182]  ffff8801ce15b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   50.045508]  ffff8801ce15b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   50.052834] >ffff8801ce15b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   50.060160]                                            ^
[   50.065582]  ffff8801ce15b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   50.072912]  ffff8801ce15b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   50.080238] ==================================================================
[   50.087572] Disabling lock debugging due to kernel taint
[   50.092985] Kernel panic - not syncing: panic_on_warn set ...
[   50.092985] 
[   50.100312] CPU: 1 PID: 2986 Comm: syzkaller096631 Tainted: G    B           4.14.0-rc2+ #18
[   50.108861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   50.118180] Call Trace:
[   50.120734]  dump_stack+0x194/0x257
[   50.124327]  ? arch_local_irq_restore+0x53/0x53
[   50.128960]  ? vprintk_default+0x28/0x30
[   50.132987]  ? detach_if_pending+0x4d0/0x610
[   50.137362]  panic+0x1e4/0x417
[   50.140519]  ? __warn+0x1d9/0x1d9
[   50.143943]  ? detach_if_pending+0x557/0x610
[   50.148317]  kasan_end_report+0x50/0x50
[   50.152254]  kasan_report+0x144/0x340
[   50.156022]  __asan_report_store8_noabort+0x17/0x20
[   50.161002]  detach_if_pending+0x557/0x610
[   50.165203]  ? trace_raw_output_tick_stop+0x130/0x130
[   50.170359]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   50.174988]  ? lock_timer_base+0x1a3/0x2b0
[   50.179188]  ? lock_timer_base+0x1eb/0x2b0
[   50.183387]  ? __internal_add_timer+0x2d0/0x2d0
[   50.188021]  ? trace_hardirqs_on+0xd/0x10
[   50.192138]  try_to_del_timer_sync+0xa2/0x120
[   50.196597]  ? del_timer+0x130/0x130
[   50.200279]  ? del_timer_sync+0xeb/0x240
[   50.204306]  del_timer_sync+0x18a/0x240
[   50.208248]  tun_free_netdev+0x105/0x1b0
[   50.212273]  ? tun_xdp+0x410/0x410
[   50.215775]  ? cpumask_next+0x24/0x30
[   50.219544]  ? netdev_refcnt_read+0xed/0x150
[   50.223920]  ? tun_xdp+0x410/0x410
[   50.227424]  netdev_run_todo+0x870/0xca0
[   50.231449]  ? do_group_exit+0x149/0x400
[   50.235478]  ? register_netdev+0x30/0x30
[   50.239506]  ? lock_downgrade+0x990/0x990
[   50.243619]  ? trace_hardirqs_on+0xd/0x10
[   50.247742]  ? refcount_sub_and_test+0x115/0x1b0
[   50.252460]  ? refcount_inc+0x50/0x50
[   50.256227]  ? refcount_inc+0x50/0x50
[   50.259993]  ? sk_destruct+0x4c/0x80
[   50.263670]  ? __sk_free+0x5c/0x230
[   50.267260]  ? sk_free+0x2f/0x40
[   50.270590]  ? __tun_detach+0x176/0x1390
[   50.274621]  ? tun_attach+0xf90/0xf90
[   50.278388]  ? do_raw_spin_trylock+0x190/0x190
[   50.282937]  ? locks_remove_file+0x3fa/0x5a0
[   50.287309]  ? fcntl_setlk+0x10d0/0x10d0
[   50.291346]  ? __fsnotify_parent+0xb4/0x3a0
[   50.295632]  ? fsnotify+0x1af0/0x1af0
[   50.299398]  ? __tun_detach+0x1390/0x1390
[   50.303519]  ? __tun_detach+0x1390/0x1390
[   50.307633]  rtnl_unlock+0xe/0x10
[   50.311051]  tun_chr_close+0x49/0x60
[   50.314741]  __fput+0x333/0x7f0
[   50.317988]  ? fput+0x140/0x140
[   50.321235]  ? check_same_owner+0x320/0x320
[   50.325519]  ? _raw_spin_unlock_irq+0x27/0x70
[   50.329981]  ____fput+0x15/0x20
[   50.333228]  task_work_run+0x199/0x270
[   50.337080]  ? task_work_cancel+0x210/0x210
[   50.341365]  ? _raw_spin_unlock+0x22/0x30
[   50.345478]  ? switch_task_namespaces+0x87/0xc0
[   50.350118]  do_exit+0x9d2/0x1af0
[   50.353547]  ? mm_update_next_owner+0x930/0x930
[   50.358183]  ? lock_acquire+0x1d5/0x580
[   50.362125]  ? __handle_mm_fault+0xf07/0x39c0
[   50.366588]  ? lock_release+0xd70/0xd70
[   50.370524]  ? check_noncircular+0x20/0x20
[   50.374726]  ? kvfree+0x3b/0x60
[   50.377975]  ? rtnl_unlock+0xe/0x10
[   50.381568]  ? check_noncircular+0x20/0x20
[   50.385770]  ? __handle_mm_fault+0x587/0x39c0
[   50.390232]  ? __pmd_alloc+0x4e0/0x4e0
[   50.394088]  ? find_held_lock+0x39/0x1d0
[   50.398121]  ? lock_downgrade+0x990/0x990
[   50.402254]  do_group_exit+0x149/0x400
[   50.406105]  ? __handle_mm_fault+0x39c0/0x39c0
[   50.410652]  ? vmacache_find+0x5f/0x280
[   50.414589]  ? SyS_exit+0x30/0x30
[   50.418012]  ? do_fast_syscall_32+0x158/0xf05
[   50.422471]  ? do_group_exit+0x400/0x400
[   50.426496]  SyS_exit_group+0x1d/0x20