net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   38.934320] ==================================================================
[   38.934900] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   38.935386] Write of size 8 at addr ffff880069d5b6c0 by task syzkaller535486/2982
[   38.935914] 
[   38.936034] CPU: 0 PID: 2982 Comm: syzkaller535486 Not tainted 4.13.0-next-20170907+ #17
[   38.936600] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   38.937168] Call Trace:
[   38.937353]  dump_stack+0x194/0x257
[   38.937610]  ? arch_local_irq_restore+0x53/0x53
[   38.937935]  ? show_regs_print_info+0x65/0x65
[   38.938252]  ? lock_timer_base+0x1a3/0x2b0
[   38.938549]  ? detach_if_pending+0x557/0x610
[   38.938858]  print_address_description+0x73/0x250
[   38.939196]  ? detach_if_pending+0x557/0x610
[   38.939506]  kasan_report+0x24e/0x340
[   38.939777]  __asan_report_store8_noabort+0x17/0x20
[   38.940127]  detach_if_pending+0x557/0x610
[   38.940424]  ? trace_raw_output_tick_stop+0x130/0x130
[   38.940784]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   38.941106]  ? lock_timer_base+0x1a3/0x2b0
[   38.941403]  ? lock_timer_base+0x1eb/0x2b0
[   38.941704]  ? __internal_add_timer+0x2d0/0x2d0
[   38.942033]  ? trace_hardirqs_on+0xd/0x10
[   38.942330]  try_to_del_timer_sync+0xa2/0x120
[   38.942644]  ? del_timer+0x130/0x130
[   38.942907]  ? del_timer_sync+0xeb/0x240
[   38.943196]  del_timer_sync+0x18a/0x240
[   38.943477]  tun_free_netdev+0x105/0x1b0
[   38.943763]  ? tun_xdp+0x410/0x410
[   38.944012]  ? cpumask_next+0x24/0x30
[   38.944279]  ? netdev_refcnt_read+0xed/0x150
[   38.944589]  ? tun_xdp+0x410/0x410
[   38.944838]  netdev_run_todo+0x870/0xca0
[   38.945122]  ? do_group_exit+0x149/0x400
[   38.945411]  ? register_netdev+0x30/0x30
[   38.945697]  ? lock_downgrade+0x990/0x990
[   38.945988]  ? trace_hardirqs_on+0xd/0x10
[   38.946292]  ? refcount_sub_and_test+0x115/0x1b0
[   38.946626]  ? refcount_inc+0x50/0x50
[   38.946856]  ? refcount_inc+0x50/0x50
[   38.947447]  ? sk_destruct+0x4c/0x80
[   38.947715]  ? __sk_free+0x5c/0x230
[   38.947975]  ? sk_free+0x2f/0x40
[   38.948217]  ? __tun_detach+0x176/0x1390
[   38.948514]  ? tun_attach+0xf90/0xf90
[   38.948789]  ? do_raw_spin_trylock+0x190/0x190
[   38.949119]  ? locks_remove_file+0x3fa/0x5a0
[   38.949434]  ? fcntl_setlk+0x10d0/0x10d0
[   38.949724]  ? __fsnotify_parent+0xb4/0x3a0
[   38.950031]  ? fsnotify+0x1af0/0x1af0
[   38.950312]  ? __tun_detach+0x1390/0x1390
[   38.950608]  ? __tun_detach+0x1390/0x1390
[   38.950903]  rtnl_unlock+0xe/0x10
[   38.951150]  tun_chr_close+0x49/0x60
[   38.951415]  __fput+0x333/0x7f0
[   38.951655]  ? fput+0x140/0x140
[   38.951893]  ? check_same_owner+0x320/0x320
[   38.952199]  ? _raw_spin_unlock_irq+0x27/0x70
[   38.952525]  ____fput+0x15/0x20
[   38.952762]  task_work_run+0x199/0x270
[   38.953043]  ? task_work_cancel+0x210/0x210
[   38.953351]  ? _raw_spin_unlock+0x22/0x30
[   38.953647]  ? switch_task_namespaces+0x87/0xc0
[   38.953982]  do_exit+0xa52/0x1b40
[   38.954238]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   38.954600]  ? check_noncircular+0x20/0x20
[   38.954902]  ? __handle_mm_fault+0x587/0x39c0
[   38.955222]  ? mm_update_next_owner+0x930/0x930
[   38.955546]  ? __pmd_alloc+0x4e0/0x4e0
[   38.955829]  ? find_held_lock+0x39/0x1d0
[   38.956123]  ? lock_downgrade+0x990/0x990
[   38.956428]  ? handle_mm_fault+0x410/0x8d0
[   38.956723]  ? down_read_trylock+0xdb/0x170
[   38.957026]  ? __do_page_fault+0x2b8/0xb60
[   38.957336]  ? __handle_mm_fault+0x39c0/0x39c0
[   38.957719]  ? vmacache_find+0x61/0x270
[   38.958061]  ? up_read+0x1a/0x40
[   38.958303]  ? __do_page_fault+0x35b/0xb60
[   38.958608]  ? do_page_fault+0xee/0x720
[   38.958954]  ? __do_page_fault+0xb60/0xb60
[   38.959282]  ? putname+0xf3/0x130
[   38.959546]  do_group_exit+0x149/0x400
[   38.959821]  ? lockdep_sys_exit+0x47/0xf0
[   38.960196]  ? SyS_exit+0x30/0x30
[   38.960488]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   38.960912]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   38.961246]  SyS_exit_group+0x1d/0x20
[   38.961517]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   38.961875] RIP: 0033:0x438769
[   38.962097] RSP: 002b:00007ffdec41aeb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   38.962689] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438769
[   38.963262] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   38.963810] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   38.964345] R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000001
[   38.964903] R13: 00000000006cc300 R14: 0000000000402260 R15: 0000000000000000
[   38.965455] 
[   38.965585] Allocated by task 2982:
[   38.965847]  save_stack_trace+0x16/0x20
[   38.966136]  save_stack+0x43/0xd0
[   38.966382]  kasan_kmalloc+0xad/0xe0
[   38.966695]  __kmalloc_node+0x47/0x70
[   38.966954]  kvmalloc_node+0x64/0xd0
[   38.967254]  alloc_netdev_mqs+0x16e/0xed0
[   38.967595]  __tun_chr_ioctl+0x12be/0x3d20
[   38.967936]  tun_chr_ioctl+0x2a/0x40
[   38.968568]  do_vfs_ioctl+0x1b1/0x1530
[   38.968942]  SyS_ioctl+0x8f/0xc0
[   38.969204]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   38.969573] 
[   38.969708] Freed by task 2982:
[   38.970050]  save_stack_trace+0x16/0x20
[   38.970377]  save_stack+0x43/0xd0
[   38.970623]  kasan_slab_free+0x71/0xc0
[   38.970898]  kfree+0xca/0x250
[   38.971119]  kvfree+0x36/0x60
[   38.971342]  free_netdev+0x2cf/0x360
[   38.971605]  __tun_chr_ioctl+0x2cf6/0x3d20
[   38.971965]  tun_chr_ioctl+0x2a/0x40
[   38.972239]  do_vfs_ioctl+0x1b1/0x1530
[   38.972535]  SyS_ioctl+0x8f/0xc0
[   38.972812]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   38.973167] 
[   38.973289] The buggy address belongs to the object at ffff880069d582c0
[   38.973289]  which belongs to the cache kmalloc-16384 of size 16384
[   38.974182] The buggy address is located 13312 bytes inside of
[   38.974182]  16384-byte region [ffff880069d582c0, ffff880069d5c2c0)
[   38.975025] The buggy address belongs to the page:
[   38.975373] page:ffffea0001a75600 count:1 mapcount:0 mapping:ffff880069d582c0 index:0x0 compound_mapcount: 0
[   38.976063] flags: 0x500000000008100(slab|head)
[   38.976390] raw: 0500000000008100 ffff880069d582c0 0000000000000000 0000000100000001
[   38.976934] raw: ffffea0001a95420 ffff88006d800c50 ffff88003e802200 0000000000000000
[   38.977478] page dumped because: kasan: bad access detected
[   38.977874] 
[   38.977994] Memory state around the buggy address:
[   38.978342]  ffff880069d5b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.978855]  ffff880069d5b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.979363] >ffff880069d5b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.979877]                                            ^
[   38.980253]  ffff880069d5b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.980765]  ffff880069d5b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.981276] ==================================================================
[   38.981781] Disabling lock debugging due to kernel taint
[   38.982156] Kernel panic - not syncing: panic_on_warn set ...
[   38.982156] 
[   38.982675] CPU: 0 PID: 2982 Comm: syzkaller535486 Tainted: G    B           4.13.0-next-20170907+ #17
[   38.983316] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   38.983875] Call Trace:
[   38.984059]  dump_stack+0x194/0x257
[   38.984313]  ? arch_local_irq_restore+0x53/0x53
[   38.984637]  ? vprintk_default+0x28/0x30
[   38.984918]  ? detach_if_pending+0x530/0x610
[   38.985223]  panic+0x1e4/0x417
[   38.985445]  ? __warn+0x1d9/0x1d9
[   38.985690]  ? detach_if_pending+0x557/0x610
[   38.985993]  kasan_end_report+0x50/0x50
[   38.986273]  kasan_report+0x137/0x340
[   38.986539]  __asan_report_store8_noabort+0x17/0x20
[   38.986883]  detach_if_pending+0x557/0x610
[   38.987171]  ? trace_raw_output_tick_stop+0x130/0x130
[   38.987530]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   38.987858]  ? lock_timer_base+0x1a3/0x2b0
[   38.988153]  ? lock_timer_base+0x1eb/0x2b0
[   38.988452]  ? __internal_add_timer+0x2d0/0x2d0
[   38.988781]  ? trace_hardirqs_on+0xd/0x10
[   38.989073]  try_to_del_timer_sync+0xa2/0x120
[   38.989643]  ? del_timer+0x130/0x130
[   38.989906]  ? del_timer_sync+0xeb/0x240
[   38.990193]  del_timer_sync+0x18a/0x240
[   38.990506]  tun_free_netdev+0x105/0x1b0
[   38.990790]  ? tun_xdp+0x410/0x410
[   38.991039]  ? cpumask_next+0x24/0x30
[   38.991305]  ? netdev_refcnt_read+0xed/0x150
[   38.991627]  ? tun_xdp+0x410/0x410
[   38.991867]  netdev_run_todo+0x870/0xca0
[   38.992154]  ? do_group_exit+0x149/0x400
[   38.992443]  ? register_netdev+0x30/0x30
[   38.992732]  ? lock_downgrade+0x990/0x990
[   38.993019]  ? trace_hardirqs_on+0xd/0x10
[   38.993318]  ? refcount_sub_and_test+0x115/0x1b0
[   38.993649]  ? refcount_inc+0x50/0x50
[   38.993916]  ? refcount_inc+0x50/0x50
[   38.994182]  ? sk_destruct+0x4c/0x80
[   38.994447]  ? __sk_free+0x5c/0x230
[   38.994701]  ? sk_free+0x2f/0x40
[   38.994935]  ? __tun_detach+0x176/0x1390
[   38.995221]  ? tun_attach+0xf90/0xf90
[   38.995493]  ? do_raw_spin_trylock+0x190/0x190
[   38.995816]  ? locks_remove_file+0x3fa/0x5a0
[   38.996126]  ? fcntl_setlk+0x10d0/0x10d0
[   38.996407]  ? __fsnotify_parent+0xb4/0x3a0
[   38.996707]  ? fsnotify+0x1af0/0x1af0
[   38.996973]  ? __tun_detach+0x1390/0x1390
[   38.997261]  ? __tun_detach+0x1390/0x1390
[   38.997549]  rtnl_unlock+0xe/0x10
[   38.997789]  tun_chr_close+0x49/0x60
[   38.998050]  __fput+0x333/0x7f0
[   38.998288]  ? fput+0x140/0x140
[   38.998522]  ? check_same_owner+0x320/0x320
[   38.998816]  ? _raw_spin_unlock_irq+0x27/0x70
[   38.999133]  ____fput+0x15/0x20
[   38.999365]  task_work_run+0x199/0x270
[   38.999639]  ? task_work_cancel+0x210/0x210
[   38.999940]  ? _raw_spin_unlock+0x22/0x30
[   39.000230]  ? switch_task_namespaces+0x87/0xc0
[   39.000554]  do_exit+0xa52/0x1b40
[   39.000798]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   39.001147]  ? check_noncircular+0x20/0x20
[   39.001445]  ? __handle_mm_fault+0x587/0x39c0
[   39.001760]  ? mm_update_next_owner+0x930/0x930
[   39.002085]  ? __pmd_alloc+0x4e0/0x4e0
[   39.002365]  ? find_held_lock+0x39/0x1d0
[   39.002654]  ? lock_downgrade+0x990/0x990
[   39.002952]  ? handle_mm_fault+0x410/0x8d0
[   39.003247]  ? down_read_trylock+0xdb/0x170
[   39.003548]  ? __do_page_fault+0x2b8/0xb60
[   39.003845]  ? __handle_mm_fault+0x39c0/0x39c0
[   39.004164]  ? vmacache_find+0x61/0x270
[   39.004443]  ? up_read+0x1a/0x40
[   39.004680]  ? __do_page_fault+0x35b/0xb60
[   39.004976]  ? do_page_fault+0xee/0x720
[   39.005253]  ? __do_page_fault+0xb60/0xb60
[   39.005550]  ? putname+0xf3/0x130
[   39.005795]  do_group_exit+0x149/0x400
[   39.006069]  ? lockdep_sys_exit+0x47/0xf0
[   39.006361]  ? SyS_exit+0x30/0x30
[   39.006605]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   39.006956]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   39.007288]  SyS_exit_group+0x1d/0x20
[   39.007555]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   39.007886] RIP: 0033:0x438769
[   39.008110] RSP: 002b:00007ffdec41aeb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   39.008642] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438769
[   39.009148] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   39.009652] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   39.010165] R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000001
[   39.010673] R13: 00000000006cc300 R14: 0000000000402260 R15: 0000000000000000