executing program
executing program
syzkaller login: [   29.417987] ==================================================================
[   29.418905] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   29.419796] Write of size 8 at addr ffff88003cfe3748 by task syzkaller879757/3106
[   29.420578] 
[   29.420751] CPU: 0 PID: 3106 Comm: syzkaller879757 Not tainted 4.13.0-rc6-next-20170823+ #7
[   29.421641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   29.423217] Call Trace:
[   29.423656]  dump_stack+0x194/0x257
[   29.424297]  ? arch_local_irq_restore+0x53/0x53
[   29.425074]  ? show_regs_print_info+0x65/0x65
[   29.425831]  ? __internal_add_timer+0x275/0x2d0
[   29.426709]  print_address_description+0x73/0x250
[   29.427693]  ? __internal_add_timer+0x275/0x2d0
[   29.428630]  kasan_report+0x24e/0x340
[   29.429416]  __asan_report_store8_noabort+0x17/0x20
[   29.430437]  __internal_add_timer+0x275/0x2d0
[   29.433609]  ? calc_wheel_index+0x200/0x200
[   29.434008]  mod_timer+0x6e8/0xf40
[   29.434453]  ? mod_timer_pending+0xe80/0xe80
[   29.437007]  ? __lock_is_held+0xbc/0x140
[   29.437879]  ? __lockdep_init_map+0xe4/0x650
[   29.438790]  ? lockdep_init_map+0x3d/0x70
[   29.439669]  ? rcu_read_lock_sched_held+0x108/0x120
[   29.440152]  ? try_to_del_timer_sync+0x120/0x120
[   29.440758]  ? round_jiffies_up+0xce/0x100
[   29.441161]  ? __round_jiffies_up_relative+0x150/0x150
[   29.441724]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   29.442210]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   29.442748]  __tun_chr_ioctl+0x1b2c/0x3d40
[   29.443134]  ? tun_chr_read_iter+0x1e0/0x1e0
[   29.443562]  ? lock_downgrade+0x990/0x990
[   29.443943]  ? check_same_owner+0x320/0x320
[   29.444333]  ? __handle_mm_fault+0x39e0/0x39e0
[   29.444740]  ? vmacache_find+0x61/0x270
[   29.445090]  ? tun_chr_compat_ioctl+0x30/0x30
[   29.445498]  tun_chr_ioctl+0x2a/0x40
[   29.445825]  ? tun_chr_ioctl+0x2a/0x40
[   29.446171]  do_vfs_ioctl+0x1b1/0x1530
[   29.446512]  ? _cond_resched+0x14/0x30
[   29.446855]  ? ioctl_preallocate+0x2b0/0x2b0
[   29.447249]  ? selinux_capable+0x40/0x40
[   29.447603]  ? putname+0xf3/0x130
[   29.447938]  ? do_sys_open+0x320/0x6d0
[   29.448324]  ? security_file_ioctl+0x7d/0xb0
[   29.448759]  ? security_file_ioctl+0x89/0xb0
[   29.449188]  SyS_ioctl+0x8f/0xc0
[   29.449528]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.449951] RIP: 0033:0x439089
[   29.450269] RSP: 002b:00007ffe0a4c1c28 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   29.450984] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000439089
[   29.451672] RDX: 0000000020982fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   29.452356] RBP: 0000000000000086 R08: 00000000000000fd R09: 0000000000000000
[   29.453045] R10: 0000000000000000 R11: 0000000000000202 R12: 8a43cf6a0d164a66
[   29.453837] R13: 74656e2f7665642f R14: 0000000000401d70 R15: 0000000000000000
[   29.454554] 
[   29.454706] Allocated by task 3106:
[   29.455038]  save_stack_trace+0x16/0x20
[   29.455429]  save_stack+0x43/0xd0
[   29.455778]  kasan_kmalloc+0xad/0xe0
[   29.456115]  __kmalloc_node+0x47/0x70
[   29.456513]  kvmalloc_node+0x64/0xd0
[   29.456848]  alloc_netdev_mqs+0x16e/0xed0
[   29.458696]  __tun_chr_ioctl+0x12be/0x3d40
[   29.459052]  tun_chr_ioctl+0x2a/0x40
[   29.459418]  do_vfs_ioctl+0x1b1/0x1530
[   29.459776]  SyS_ioctl+0x8f/0xc0
[   29.460124]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.460595] 
[   29.460754] Freed by task 3106:
[   29.461073]  save_stack_trace+0x16/0x20
[   29.461444]  save_stack+0x43/0xd0
[   29.461769]  kasan_slab_free+0x71/0xc0
[   29.462152]  kfree+0xca/0x250
[   29.462449]  kvfree+0x36/0x60
[   29.462732]  free_netdev+0x2cf/0x360
[   29.463335]  __tun_chr_ioctl+0x2cff/0x3d40
[   29.463887]  tun_chr_ioctl+0x2a/0x40
[   29.464256]  do_vfs_ioctl+0x1b1/0x1530
[   29.464606]  SyS_ioctl+0x8f/0xc0
[   29.464916]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.465357] 
[   29.465532] The buggy address belongs to the object at ffff88003cfe0340
[   29.465532]  which belongs to the cache kmalloc-16384 of size 16384
[   29.466712] The buggy address is located 13320 bytes inside of
[   29.466712]  16384-byte region [ffff88003cfe0340, ffff88003cfe4340)
[   29.468222] The buggy address belongs to the page:
[   29.468650] page:ffffea0000f3f800 count:1 mapcount:0 mapping:ffff88003cfe0340 index:0x0 compound_mapcount: 0
[   29.469678] flags: 0x100000000008100(slab|head)
[   29.470243] raw: 0100000000008100 ffff88003cfe0340 0000000000000000 0000000100000001
[   29.470931] raw: ffffea0000ee2020 ffffea0000dd0a20 ffff88003e802200 0000000000000000
[   29.471667] page dumped because: kasan: bad access detected
[   29.472226] 
[   29.472397] Memory state around the buggy address:
[   29.472886]  ffff88003cfe3600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.473680]  ffff88003cfe3680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.478188] >ffff88003cfe3700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.479284]                                               ^
[   29.484834]  ffff88003cfe3780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.485870]  ffff88003cfe3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.486975] ==================================================================
[   29.488192] Disabling lock debugging due to kernel taint
[   29.489098] Kernel panic - not syncing: panic_on_warn set ...
[   29.489098] 
[   29.490155] CPU: 0 PID: 3106 Comm: syzkaller879757 Tainted: G    B           4.13.0-rc6-next-20170823+ #7
[   29.491432] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   29.492458] Call Trace:
[   29.492810]  dump_stack+0x194/0x257
[   29.493348]  ? arch_local_irq_restore+0x53/0x53
[   29.493917]  ? vprintk_default+0x28/0x30
[   29.494360]  ? __internal_add_timer+0x1b0/0x2d0
[   29.494771]  panic+0x1e4/0x41c
[   29.495051]  ? refcount_error_report+0x214/0x214
[   29.495531]  ? __internal_add_timer+0x275/0x2d0
[   29.495937]  kasan_end_report+0x50/0x50
[   29.496302]  kasan_report+0x137/0x340
[   29.496670]  __asan_report_store8_noabort+0x17/0x20
[   29.497105]  __internal_add_timer+0x275/0x2d0
[   29.497617]  ? calc_wheel_index+0x200/0x200
[   29.497999]  mod_timer+0x6e8/0xf40
[   29.498420]  ? mod_timer_pending+0xe80/0xe80
[   29.498814]  ? __lock_is_held+0xbc/0x140
[   29.499232]  ? __lockdep_init_map+0xe4/0x650
[   29.499731]  ? lockdep_init_map+0x3d/0x70
[   29.500130]  ? rcu_read_lock_sched_held+0x108/0x120
[   29.500599]  ? try_to_del_timer_sync+0x120/0x120
[   29.501440]  ? round_jiffies_up+0xce/0x100
[   29.502074]  ? __round_jiffies_up_relative+0x150/0x150
[   29.502802]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   29.503570]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   29.504509]  __tun_chr_ioctl+0x1b2c/0x3d40
[   29.505220]  ? tun_chr_read_iter+0x1e0/0x1e0
[   29.505980]  ? lock_downgrade+0x990/0x990
[   29.506615]  ? check_same_owner+0x320/0x320
[   29.507003]  ? __handle_mm_fault+0x39e0/0x39e0
[   29.507503]  ? vmacache_find+0x61/0x270
[   29.507866]  ? tun_chr_compat_ioctl+0x30/0x30
[   29.508326]  tun_chr_ioctl+0x2a/0x40
[   29.508660]  ? tun_chr_ioctl+0x2a/0x40
[   29.509009]  do_vfs_ioctl+0x1b1/0x1530
[   29.509441]  ? _cond_resched+0x14/0x30
[   29.509801]  ? ioctl_preallocate+0x2b0/0x2b0
[   29.510252]  ? selinux_capable+0x40/0x40
[   29.510615]  ? putname+0xf3/0x130
[   29.511056]  ? do_sys_open+0x320/0x6d0
[   29.511738]  ? security_file_ioctl+0x7d/0xb0
[   29.512494]  ? security_file_ioctl+0x89/0xb0
[   29.513243]  SyS_ioctl+0x8f/0xc0
[   29.513823]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.514646] RIP: 0033:0x439089
[   29.515198] RSP: 002b:00007ffe0a4c1c28 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   29.516515] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000439089
[   29.517744] RDX: 0000000020982fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   29.518634] RBP: 0000000000000086 R08: 00000000000000fd R09: 0000000000000000
[   29.519311] R10: 0000000000000000 R11: 0000000000000202 R12: 8a43cf6a0d164a66
[   29.519998] R13: 74656e2f7665642f R14: 0000000000401d70 R15: 0000000000000000
[   29.521053] Dumping ftrace buffer:
[   29.521394]    (ftrace buffer empty)
[   29.521926] Kernel Offset: disabled
[   29.522542] Rebooting in 86400 seconds..