INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-4,10.128.15.192' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   48.289053] ==================================================================
[   48.290178] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   48.291147] Write of size 8 at addr ffff8801d203b600 by task syzkaller851329/2979
[   48.292143] 
[   48.292374] CPU: 1 PID: 2979 Comm: syzkaller851329 Not tainted 4.14.0-rc5+ #137
[   48.293350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.294613] Call Trace:
[   48.294974]  dump_stack+0x194/0x257
[   48.295466]  ? arch_local_irq_restore+0x53/0x53
[   48.296098]  ? show_regs_print_info+0x65/0x65
[   48.296700]  ? __kernel_text_address+0xd/0x40
[   48.297301]  ? __internal_add_timer+0x275/0x2d0
[   48.297934]  print_address_description+0x73/0x250
[   48.298577]  ? __internal_add_timer+0x275/0x2d0
[   48.299198]  kasan_report+0x25b/0x340
[   48.299737]  __asan_report_store8_noabort+0x17/0x20
[   48.300406]  __internal_add_timer+0x275/0x2d0
[   48.301008]  ? calc_wheel_index+0x200/0x200
[   48.301600]  mod_timer+0x622/0x15b0
[   48.302097]  ? mod_timer_pending+0x14e0/0x14e0
[   48.302709]  ? __lock_is_held+0xb6/0x140
[   48.303418]  ? __lock_is_held+0xb6/0x140
[   48.303973]  ? __lockdep_init_map+0xe4/0x650
[   48.304593]  ? lockdep_init_map+0x9/0x10
[   48.305139]  ? init_timer_key+0x126/0x3b0
[   48.305759]  ? try_to_del_timer_sync+0x120/0x120
[   48.306414]  ? round_jiffies_up+0xce/0x100
[   48.307006]  ? __round_jiffies_up_relative+0x150/0x150
[   48.307724]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   48.308381]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   48.309198]  __tun_chr_ioctl+0x1b17/0x3d20
[   48.313412]  ? tun_chr_read_iter+0x1e0/0x1e0
[   48.317787]  ? find_held_lock+0x35/0x1d0
[   48.321832]  ? __do_page_fault+0x64c/0xd60
[   48.326039]  ? lock_downgrade+0x990/0x990
[   48.330164]  ? handle_mm_fault+0x410/0x8d0
[   48.334387]  ? check_same_owner+0x320/0x320
[   48.338672]  ? up_read+0x1a/0x40
[   48.342007]  ? __do_page_fault+0x3d6/0xd60
[   48.346212]  ? tun_chr_compat_ioctl+0x30/0x30
[   48.350673]  tun_chr_ioctl+0x2a/0x40
[   48.354357]  ? tun_chr_ioctl+0x2a/0x40
[   48.358213]  do_vfs_ioctl+0x1b1/0x1520
[   48.362075]  ? ioctl_preallocate+0x2b0/0x2b0
[   48.366453]  ? selinux_capable+0x40/0x40
[   48.370483]  ? putname+0xf3/0x130
[   48.373908]  ? do_sys_open+0x320/0x6d0
[   48.377773]  ? security_file_ioctl+0x89/0xb0
[   48.382153]  SyS_ioctl+0x8f/0xc0
[   48.385491]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.390212] RIP: 0033:0x443db9
[   48.393369] RSP: 002b:00007ffc6b84c138 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   48.401042] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   48.408715] RDX: 00000000205bafd8 RSI: 00000000400454ca RDI: 0000000000000004
[   48.415967] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   48.423204] R10: 0000000000000000 R11: 0000000000000202 R12: aa339fce05306a46
[   48.430442] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   48.437695] 
[   48.439290] Allocated by task 2979:
[   48.442886]  save_stack_trace+0x16/0x20
[   48.446834]  save_stack+0x43/0xd0
[   48.450254]  kasan_kmalloc+0xad/0xe0
[   48.453931]  __kmalloc_node+0x47/0x70
[   48.457702]  kvmalloc_node+0x64/0xd0
[   48.461384]  alloc_netdev_mqs+0x16e/0xed0
[   48.465495]  __tun_chr_ioctl+0x12b2/0x3d20
[   48.469693]  tun_chr_ioctl+0x2a/0x40
[   48.473371]  do_vfs_ioctl+0x1b1/0x1520
[   48.477225]  SyS_ioctl+0x8f/0xc0
[   48.480558]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.485275] 
[   48.486868] Freed by task 2979:
[   48.490116]  save_stack_trace+0x16/0x20
[   48.494061]  save_stack+0x43/0xd0
[   48.497477]  kasan_slab_free+0x71/0xc0
[   48.501326]  kfree+0xca/0x250
[   48.504407]  kvfree+0x36/0x60
[   48.507482]  free_netdev+0x2cf/0x360
[   48.511162]  __tun_chr_ioctl+0x2cea/0x3d20
[   48.515362]  tun_chr_ioctl+0x2a/0x40
[   48.519042]  do_vfs_ioctl+0x1b1/0x1520
[   48.522896]  SyS_ioctl+0x8f/0xc0
[   48.526230]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.530947] 
[   48.532540] The buggy address belongs to the object at ffff8801d20382c0
[   48.532540]  which belongs to the cache kmalloc-16384 of size 16384
[   48.545509] The buggy address is located 13120 bytes inside of
[   48.545509]  16384-byte region [ffff8801d20382c0, ffff8801d203c2c0)
[   48.557693] The buggy address belongs to the page:
[   48.562592] page:ffffea0007480e00 count:1 mapcount:0 mapping:ffff8801d20382c0 index:0x0 compound_mapcount: 0
[   48.572528] flags: 0x200000000008100(slab|head)
[   48.577164] raw: 0200000000008100 ffff8801d20382c0 0000000000000000 0000000100000001
[   48.585017] raw: ffffea0007653a20 ffffea000767f020 ffff8801dac02200 0000000000000000
[   48.592863] page dumped because: kasan: bad access detected
[   48.598536] 
[   48.600130] Memory state around the buggy address:
[   48.605023]  ffff8801d203b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.612348]  ffff8801d203b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.619670] >ffff8801d203b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.627081]                    ^
[   48.630420]  ffff8801d203b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.637746]  ffff8801d203b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.645069] ==================================================================
[   48.652393] Disabling lock debugging due to kernel taint
[   48.657824] Kernel panic - not syncing: panic_on_warn set ...
[   48.657824] 
[   48.665154] CPU: 1 PID: 2979 Comm: syzkaller851329 Tainted: G    B           4.14.0-rc5+ #137
[   48.673777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   48.683100] Call Trace:
[   48.685658]  dump_stack+0x194/0x257
[   48.689260]  ? arch_local_irq_restore+0x53/0x53
[   48.693892]  ? kasan_end_report+0x32/0x50
[   48.698007]  ? lock_downgrade+0x990/0x990
[   48.702122]  ? __internal_add_timer+0x1c0/0x2d0
[   48.706757]  panic+0x1e4/0x417
[   48.709913]  ? __warn+0x1d9/0x1d9
[   48.713336]  ? __internal_add_timer+0x275/0x2d0
[   48.717970]  kasan_end_report+0x50/0x50
[   48.721907]  kasan_report+0x144/0x340
[   48.725676]  __asan_report_store8_noabort+0x17/0x20
[   48.730655]  __internal_add_timer+0x275/0x2d0
[   48.735116]  ? calc_wheel_index+0x200/0x200
[   48.739408]  mod_timer+0x622/0x15b0
[   48.743003]  ? mod_timer_pending+0x14e0/0x14e0
[   48.747550]  ? __lock_is_held+0xb6/0x140
[   48.751582]  ? __lock_is_held+0xb6/0x140
[   48.755609]  ? __lockdep_init_map+0xe4/0x650
[   48.759986]  ? lockdep_init_map+0x9/0x10
[   48.764010]  ? init_timer_key+0x126/0x3b0
[   48.768124]  ? try_to_del_timer_sync+0x120/0x120
[   48.772937]  ? round_jiffies_up+0xce/0x100
[   48.777135]  ? __round_jiffies_up_relative+0x150/0x150
[   48.782376]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   48.787269]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   48.792772]  __tun_chr_ioctl+0x1b17/0x3d20
[   48.796985]  ? tun_chr_read_iter+0x1e0/0x1e0
[   48.801356]  ? find_held_lock+0x35/0x1d0
[   48.805387]  ? __do_page_fault+0x64c/0xd60
[   48.809588]  ? lock_downgrade+0x990/0x990
[   48.813704]  ? handle_mm_fault+0x410/0x8d0
[   48.817913]  ? check_same_owner+0x320/0x320
[   48.822200]  ? up_read+0x1a/0x40
[   48.825530]  ? __do_page_fault+0x3d6/0xd60
[   48.829731]  ? tun_chr_compat_ioctl+0x30/0x30
[   48.834190]  tun_chr_ioctl+0x2a/0x40
[   48.837870]  ? tun_chr_ioctl+0x2a/0x40
[   48.841725]  do_vfs_ioctl+0x1b1/0x1520
[   48.845581]  ? ioctl_preallocate+0x2b0/0x2b0
[   48.849956]  ? selinux_capable+0x40/0x40
[   48.853984]  ? putname+0xf3/0x130
[   48.857406]  ? do_sys_open+0x320/0x6d0
[   48.861269]  ? security_file_ioctl+0x89/0xb0
[   48.865643]  SyS_ioctl+0x8f/0xc0
[   48.868979]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   48.873711] RIP: 0033:0x443db9
[   48.876869] RSP: 002b:00007ffc6b84c138 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
[   48.884541] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   48.891775] RDX: 00000000205bafd8 RSI: 00000000400454ca RDI: 0000000000000004
[   48.899016] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   48.906265] R10: 0000000000000000 R11: 0000000000000202 R12: aa339fce05306a46
[   48.913501] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   48.920786] Dumping ftrace buffer:
[   48.924301]    (ftrace buffer empty)
[   48.927980] Kernel Offset: disabled
[   48.931576] Rebooting in 86400 seconds..