net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   29.941302] ==================================================================
[   29.941931] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   29.942394] Write of size 8 at addr ffff88006a5d3880 by task syzkaller480687/2969
[   29.942940] 
[   29.943059] CPU: 3 PID: 2969 Comm: syzkaller480687 Not tainted 4.13.0-next-20170911+ #1
[   29.943729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   29.944365] Call Trace:
[   29.944612]  dump_stack+0x194/0x257
[   29.944894]  ? arch_local_irq_restore+0x53/0x53
[   29.945237]  ? show_regs_print_info+0x65/0x65
[   29.945538]  ? lock_timer_base+0x1a3/0x2b0
[   29.945891]  ? detach_if_pending+0x557/0x610
[   29.946206]  print_address_description+0x73/0x250
[   29.946597]  ? detach_if_pending+0x557/0x610
[   29.946902]  kasan_report+0x24e/0x340
[   29.947201]  __asan_report_store8_noabort+0x17/0x20
[   29.947596]  detach_if_pending+0x557/0x610
[   29.947938]  ? trace_raw_output_tick_stop+0x130/0x130
[   29.948319]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   29.948648]  ? lock_timer_base+0x1a3/0x2b0
[   29.948940]  ? lock_timer_base+0x1eb/0x2b0
[   29.949235]  ? __internal_add_timer+0x2d0/0x2d0
[   29.949555]  ? trace_hardirqs_on+0xd/0x10
[   29.949855]  try_to_del_timer_sync+0xa2/0x120
[   29.950164]  ? del_timer+0x130/0x130
[   29.950423]  ? del_timer_sync+0xeb/0x240
[   29.950719]  del_timer_sync+0x18a/0x240
[   29.951019]  tun_free_netdev+0x105/0x1b0
[   29.951801]  ? tun_xdp+0x410/0x410
[   29.952087]  ? cpumask_next+0x24/0x30
[   29.952355]  ? netdev_refcnt_read+0xed/0x150
[   29.952679]  ? tun_xdp+0x410/0x410
[   29.952928]  netdev_run_todo+0x870/0xca0
[   29.953209]  ? do_group_exit+0x149/0x400
[   29.953492]  ? register_netdev+0x30/0x30
[   29.953784]  ? lock_downgrade+0x990/0x990
[   29.954072]  ? trace_hardirqs_on+0xd/0x10
[   29.954370]  ? refcount_sub_and_test+0x115/0x1b0
[   29.954707]  ? refcount_inc+0x50/0x50
[   29.954970]  ? refcount_inc+0x50/0x50
[   29.955249]  ? sk_destruct+0x4c/0x80
[   29.955505]  ? __sk_free+0x5c/0x230
[   29.955768]  ? sk_free+0x2f/0x40
[   29.956003]  ? __tun_detach+0x176/0x1390
[   29.956292]  ? tun_attach+0xf90/0xf90
[   29.956559]  ? do_raw_spin_trylock+0x190/0x190
[   29.956904]  ? locks_remove_file+0x3fa/0x5a0
[   29.957291]  ? fcntl_setlk+0x10d0/0x10d0
[   29.957631]  ? __fsnotify_parent+0xb4/0x3a0
[   29.957985]  ? fsnotify+0x1af0/0x1af0
[   29.958334]  ? __tun_detach+0x1390/0x1390
[   29.958676]  ? __tun_detach+0x1390/0x1390
[   29.959027]  rtnl_unlock+0xe/0x10
[   29.959309]  tun_chr_close+0x49/0x60
[   29.959568]  __fput+0x333/0x7f0
[   29.959813]  ? fput+0x140/0x140
[   29.960044]  ? check_same_owner+0x320/0x320
[   29.960356]  ? _raw_spin_unlock_irq+0x27/0x70
[   29.960747]  ____fput+0x15/0x20
[   29.960977]  task_work_run+0x199/0x270
[   29.961248]  ? task_work_cancel+0x210/0x210
[   29.961547]  ? _raw_spin_unlock+0x22/0x30
[   29.961845]  ? switch_task_namespaces+0x87/0xc0
[   29.962177]  do_exit+0xa52/0x1b40
[   29.962418]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   29.962774]  ? check_noncircular+0x20/0x20
[   29.963072]  ? __handle_mm_fault+0x587/0x39c0
[   29.963396]  ? mm_update_next_owner+0x930/0x930
[   29.963730]  ? __pmd_alloc+0x4e0/0x4e0
[   29.964020]  ? find_held_lock+0x39/0x1d0
[   29.964310]  ? lock_downgrade+0x990/0x990
[   29.964614]  ? handle_mm_fault+0x410/0x8d0
[   29.964917]  ? down_read_trylock+0xdb/0x170
[   29.965216]  ? __do_page_fault+0x2b8/0xb60
[   29.965510]  ? __handle_mm_fault+0x39c0/0x39c0
[   29.965838]  ? vmacache_find+0x61/0x270
[   29.966119]  ? up_read+0x1a/0x40
[   29.966408]  ? __do_page_fault+0x35b/0xb60
[   29.966722]  ? do_page_fault+0xee/0x720
[   29.967023]  ? __do_page_fault+0xb60/0xb60
[   29.967375]  ? putname+0xf3/0x130
[   29.967703]  do_group_exit+0x149/0x400
[   29.968010]  ? lockdep_sys_exit+0x47/0xf0
[   29.968352]  ? SyS_exit+0x30/0x30
[   29.968607]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   29.969023]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   29.969365]  SyS_exit_group+0x1d/0x20
[   29.969628]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.969962] RIP: 0033:0x438759
[   29.970209] RSP: 002b:00007ffdccbf0ab8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   29.970746] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438759
[   29.971282] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   29.971790] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   29.972774] R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000001
[   29.973297] R13: 00000000006cc300 R14: 0000000000402250 R15: 0000000000000000
[   29.973802] 
[   29.973919] Allocated by task 2969:
[   29.974211]  save_stack_trace+0x16/0x20
[   29.974485]  save_stack+0x43/0xd0
[   29.974724]  kasan_kmalloc+0xad/0xe0
[   29.974992]  __kmalloc_node+0x47/0x70
[   29.975333]  kvmalloc_node+0x64/0xd0
[   29.975625]  alloc_netdev_mqs+0x16e/0xed0
[   29.975926]  __tun_chr_ioctl+0x12be/0x3d20
[   29.976218]  tun_chr_ioctl+0x2a/0x40
[   29.976488]  do_vfs_ioctl+0x1b1/0x1530
[   29.976782]  SyS_ioctl+0x8f/0xc0
[   29.977070]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.977436] 
[   29.977551] Freed by task 2969:
[   29.977807]  save_stack_trace+0x16/0x20
[   29.978097]  save_stack+0x43/0xd0
[   29.978363]  kasan_slab_free+0x71/0xc0
[   29.978672]  kfree+0xca/0x250
[   29.978915]  kvfree+0x36/0x60
[   29.979145]  free_netdev+0x2cf/0x360
[   29.979449]  __tun_chr_ioctl+0x2cf6/0x3d20
[   29.979807]  tun_chr_ioctl+0x2a/0x40
[   29.980116]  do_vfs_ioctl+0x1b1/0x1530
[   29.980397]  SyS_ioctl+0x8f/0xc0
[   29.980658]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.980996] 
[   29.981139] The buggy address belongs to the object at ffff88006a5d0480
[   29.981139]  which belongs to the cache kmalloc-16384 of size 16384
[   29.982051] The buggy address is located 13312 bytes inside of
[   29.982051]  16384-byte region [ffff88006a5d0480, ffff88006a5d4480)
[   29.982903] The buggy address belongs to the page:
[   29.983282] page:ffffea0001a97400 count:1 mapcount:0 mapping:ffff88006a5d0480 index:0x0 compound_mapcount: 0
[   29.983947] flags: 0x500000000008100(slab|head)
[   29.984317] raw: 0500000000008100 ffff88006a5d0480 0000000000000000 0000000100000001
[   29.984839] raw: ffffea0001a4b820 ffff88006d800c50 ffff88003e802200 0000000000000000
[   29.985389] page dumped because: kasan: bad access detected
[   29.985764] 
[   29.985875] Memory state around the buggy address:
[   29.986245]  ffff88006a5d3780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.986733]  ffff88006a5d3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.987250] >ffff88006a5d3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.987770]                    ^
[   29.987997]  ffff88006a5d3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.988521]  ffff88006a5d3980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.989004] ==================================================================
[   29.989541] Disabling lock debugging due to kernel taint
[   29.989930] Kernel panic - not syncing: panic_on_warn set ...
[   29.989930] 
[   29.990442] CPU: 3 PID: 2969 Comm: syzkaller480687 Tainted: G    B           4.13.0-next-20170911+ #1
[   29.991086] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   29.991682] Call Trace:
[   29.991856]  dump_stack+0x194/0x257
[   29.992126]  ? arch_local_irq_restore+0x53/0x53
[   29.992460]  ? vprintk_default+0x28/0x30
[   29.992728]  ? detach_if_pending+0x4c0/0x610
[   29.993034]  panic+0x1e4/0x417
[   29.993286]  ? __warn+0x1d9/0x1d9
[   29.993548]  ? detach_if_pending+0x557/0x610
[   29.994341]  kasan_end_report+0x50/0x50
[   29.994668]  kasan_report+0x137/0x340
[   29.994928]  __asan_report_store8_noabort+0x17/0x20
[   29.995312]  detach_if_pending+0x557/0x610
[   29.995622]  ? trace_raw_output_tick_stop+0x130/0x130
[   29.995992]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   29.996339]  ? lock_timer_base+0x1a3/0x2b0
[   29.996646]  ? lock_timer_base+0x1eb/0x2b0
[   29.996926]  ? __internal_add_timer+0x2d0/0x2d0
[   29.997262]  ? trace_hardirqs_on+0xd/0x10
[   29.997567]  try_to_del_timer_sync+0xa2/0x120
[   29.997917]  ? del_timer+0x130/0x130
[   29.998210]  ? del_timer_sync+0xeb/0x240
[   29.998501]  del_timer_sync+0x18a/0x240
[   29.998785]  tun_free_netdev+0x105/0x1b0
[   29.999072]  ? tun_xdp+0x410/0x410
[   29.999337]  ? cpumask_next+0x24/0x30
[   29.999617]  ? netdev_refcnt_read+0xed/0x150
[   29.999936]  ? tun_xdp+0x410/0x410
[   30.000200]  netdev_run_todo+0x870/0xca0
[   30.000576]  ? do_group_exit+0x149/0x400
[   30.000867]  ? register_netdev+0x30/0x30
[   30.001159]  ? lock_downgrade+0x990/0x990
[   30.001468]  ? trace_hardirqs_on+0xd/0x10
[   30.001775]  ? refcount_sub_and_test+0x115/0x1b0
[   30.002109]  ? refcount_inc+0x50/0x50
[   30.002388]  ? refcount_inc+0x50/0x50
[   30.002669]  ? sk_destruct+0x4c/0x80
[   30.002942]  ? __sk_free+0x5c/0x230
[   30.003213]  ? sk_free+0x2f/0x40
[   30.003455]  ? __tun_detach+0x176/0x1390
[   30.003740]  ? tun_attach+0xf90/0xf90
[   30.004049]  ? do_raw_spin_trylock+0x190/0x190
[   30.004394]  ? locks_remove_file+0x3fa/0x5a0
[   30.004728]  ? fcntl_setlk+0x10d0/0x10d0
[   30.004997]  ? __fsnotify_parent+0xb4/0x3a0
[   30.005325]  ? fsnotify+0x1af0/0x1af0
[   30.005633]  ? __tun_detach+0x1390/0x1390
[   30.005907]  ? __tun_detach+0x1390/0x1390
[   30.006200]  rtnl_unlock+0xe/0x10
[   30.006435]  tun_chr_close+0x49/0x60
[   30.006687]  __fput+0x333/0x7f0
[   30.006913]  ? fput+0x140/0x140
[   30.007137]  ? check_same_owner+0x320/0x320
[   30.007440]  ? _raw_spin_unlock_irq+0x27/0x70
[   30.007767]  ____fput+0x15/0x20
[   30.008014]  task_work_run+0x199/0x270
[   30.008299]  ? task_work_cancel+0x210/0x210
[   30.008628]  ? _raw_spin_unlock+0x22/0x30
[   30.008917]  ? switch_task_namespaces+0x87/0xc0
[   30.009246]  do_exit+0xa52/0x1b40
[   30.009481]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   30.009874]  ? check_noncircular+0x20/0x20
[   30.010177]  ? __handle_mm_fault+0x587/0x39c0
[   30.010488]  ? mm_update_next_owner+0x930/0x930
[   30.010822]  ? __pmd_alloc+0x4e0/0x4e0
[   30.011100]  ? find_held_lock+0x39/0x1d0
[   30.011408]  ? lock_downgrade+0x990/0x990
[   30.011696]  ? handle_mm_fault+0x410/0x8d0
[   30.012039]  ? down_read_trylock+0xdb/0x170
[   30.012360]  ? __do_page_fault+0x2b8/0xb60
[   30.012647]  ? __handle_mm_fault+0x39c0/0x39c0
[   30.012997]  ? vmacache_find+0x61/0x270
[   30.013282]  ? up_read+0x1a/0x40
[   30.013524]  ? __do_page_fault+0x35b/0xb60
[   30.013855]  ? do_page_fault+0xee/0x720
[   30.014165]  ? __do_page_fault+0xb60/0xb60
[   30.014452]  ? putname+0xf3/0x130
[   30.014696]  do_group_exit+0x149/0x400
[   30.015410]  ? lockdep_sys_exit+0x47/0xf0
[   30.015714]  ? SyS_exit+0x30/0x30
[   30.015969]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   30.016325]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   30.016637]  SyS_exit_group+0x1d/0x20
[   30.016886]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   30.017227] RIP: 0033:0x438759
[   30.017437] RSP: 002b:00007ffdccbf0ab8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   30.017969] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438759
[   30.018470] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   30.018972] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   30.019495] R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000001
[   30.019987] R13: 00000000006cc300 R14: 0000000000402250 R15: 0000000000000000
[   30.020606] Dumping ftrace buffer:
[   30.020856]    (ftrace buffer empty)
[   30.021170] Kernel Offset: disabled
[   30.021412] Rebooting in 86400 seconds..