INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-3,10.128.0.49' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   25.056570] ==================================================================
[   25.064035] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   25.071023] Write of size 8 at addr ffff8801ce763688 by task syzkaller183041/2982
[   25.078612] 
[   25.080216] CPU: 0 PID: 2982 Comm: syzkaller183041 Not tainted 4.14.0-rc2+ #14
[   25.087543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   25.096874] Call Trace:
[   25.099441]  dump_stack+0x194/0x257
[   25.103044]  ? arch_local_irq_restore+0x53/0x53
[   25.107685]  ? show_regs_print_info+0x65/0x65
[   25.112158]  ? __internal_add_timer+0x275/0x2d0
[   25.116801]  print_address_description+0x73/0x250
[   25.121616]  ? __internal_add_timer+0x275/0x2d0
[   25.126257]  kasan_report+0x25b/0x340
[   25.130035]  __asan_report_store8_noabort+0x17/0x20
[   25.135021]  __internal_add_timer+0x275/0x2d0
[   25.139491]  ? calc_wheel_index+0x200/0x200
[   25.143800]  mod_timer+0x622/0x15b0
[   25.147409]  ? mod_timer_pending+0x14e0/0x14e0
[   25.151964]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   25.156958]  ? trace_hardirqs_on+0xd/0x10
[   25.161185]  ? _crng_backtrack_protect+0xd9/0x130
[   25.166011]  ? __lock_is_held+0xbc/0x140
[   25.170048]  ? __lockdep_init_map+0xe4/0x650
[   25.174433]  ? lockdep_init_map+0x3d/0x70
[   25.178563]  ? rcu_read_lock_sched_held+0x108/0x120
[   25.183551]  ? init_timer_key+0x126/0x3b0
[   25.187674]  ? try_to_del_timer_sync+0x120/0x120
[   25.192405]  ? round_jiffies_up+0xce/0x100
[   25.196611]  ? __round_jiffies_up_relative+0x150/0x150
[   25.201859]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   25.206770]  __tun_chr_ioctl+0x1b23/0x3d20
[   25.210987]  ? tun_chr_read_iter+0x1e0/0x1e0
[   25.215370]  ? __pmd_alloc+0x4e0/0x4e0
[   25.219237]  ? __might_sleep+0x95/0x190
[   25.223197]  ? selinux_file_ioctl+0x444/0x690
[   25.227666]  ? __fget_light+0x29d/0x390
[   25.231615]  ? selinux_capable+0x40/0x40
[   25.235671]  tun_chr_compat_ioctl+0x29/0x30
[   25.239965]  ? tun_chr_compat_ioctl+0x29/0x30
[   25.244436]  compat_SyS_ioctl+0x1d7/0x3290
[   25.248642]  ? __handle_mm_fault+0x39c0/0x39c0
[   25.253198]  ? __tun_chr_ioctl+0x3d20/0x3d20
[   25.257589]  ? do_ioctl+0x60/0x60
[   25.261019]  ? do_fast_syscall_32+0x158/0xf05
[   25.265491]  ? do_ioctl+0x60/0x60
[   25.268917]  do_fast_syscall_32+0x3f2/0xf05
[   25.273218]  ? do_int80_syscall_32+0x940/0x940
[   25.277776]  ? kasan_check_read+0x11/0x20
[   25.281895]  ? syscall_return_slowpath+0x510/0x510
[   25.286797]  ? SyS_rt_sigaction+0x94/0x1b0
[   25.291019]  ? lockdep_sys_exit+0x47/0xf0
[   25.295139]  ? retint_user+0x18/0x20
[   25.298833]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   25.303654]  entry_SYSENTER_compat+0x51/0x60
[   25.308033] RIP: 0023:0xf7f3bc79
[   25.311367] RSP: 002b:00000000ffdaffdc EFLAGS: 00000286 ORIG_RAX: 0000000000000036
[   25.319049] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400454ca
[   25.326291] RDX: 00000000201dd000 RSI: 00000000080ef00c RDI: 000000000000003f
[   25.333533] RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000
[   25.340772] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   25.348012] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   25.355271] 
[   25.356870] Allocated by task 2982:
[   25.360471]  save_stack_trace+0x16/0x20
[   25.364415]  save_stack+0x43/0xd0
[   25.367837]  kasan_kmalloc+0xad/0xe0
[   25.371521]  __kmalloc_node+0x47/0x70
[   25.375291]  kvmalloc_node+0x64/0xd0
[   25.378979]  alloc_netdev_mqs+0x16e/0xed0
[   25.383096]  __tun_chr_ioctl+0x12be/0x3d20
[   25.387299]  tun_chr_compat_ioctl+0x29/0x30
[   25.391592]  compat_SyS_ioctl+0x1d7/0x3290
[   25.395798]  do_fast_syscall_32+0x3f2/0xf05
[   25.400088]  entry_SYSENTER_compat+0x51/0x60
[   25.404465] 
[   25.406064] Freed by task 2982:
[   25.409317]  save_stack_trace+0x16/0x20
[   25.413261]  save_stack+0x43/0xd0
[   25.416684]  kasan_slab_free+0x71/0xc0
[   25.420552]  kfree+0xca/0x250
[   25.423629]  kvfree+0x36/0x60
[   25.426708]  free_netdev+0x2cf/0x360
[   25.430390]  __tun_chr_ioctl+0x2cf6/0x3d20
[   25.434593]  tun_chr_compat_ioctl+0x29/0x30
[   25.438883]  compat_SyS_ioctl+0x1d7/0x3290
[   25.443086]  do_fast_syscall_32+0x3f2/0xf05
[   25.447378]  entry_SYSENTER_compat+0x51/0x60
[   25.451753] 
[   25.453355] The buggy address belongs to the object at ffff8801ce760280
[   25.453355]  which belongs to the cache kmalloc-16384 of size 16384
[   25.466328] The buggy address is located 13320 bytes inside of
[   25.466328]  16384-byte region [ffff8801ce760280, ffff8801ce764280)
[   25.478528] The buggy address belongs to the page:
[   25.483430] page:ffffea000739d800 count:1 mapcount:0 mapping:ffff8801ce760280 index:0x0 compound_mapcount: 0
[   25.493376] flags: 0x200000000008100(slab|head)
[   25.498016] raw: 0200000000008100 ffff8801ce760280 0000000000000000 0000000100000001
[   25.505866] raw: ffffea0007587620 ffffea00073ac620 ffff8801dac02200 0000000000000000
[   25.513717] page dumped because: kasan: bad access detected
[   25.519398] 
[   25.520995] Memory state around the buggy address:
[   25.525895]  ffff8801ce763580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   25.533228]  ffff8801ce763600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   25.540558] >ffff8801ce763680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   25.547886]                       ^
[   25.551483]  ffff8801ce763700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   25.558812]  ffff8801ce763780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   25.566140] ==================================================================
[   25.573471] Disabling lock debugging due to kernel taint
[   25.578884] Kernel panic - not syncing: panic_on_warn set ...
[   25.578884] 
[   25.586217] CPU: 0 PID: 2982 Comm: syzkaller183041 Tainted: G    B           4.14.0-rc2+ #14
[   25.594756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   25.604075] Call Trace:
[   25.606635]  dump_stack+0x194/0x257
[   25.610229]  ? arch_local_irq_restore+0x53/0x53
[   25.614865]  ? vprintk_default+0x28/0x30
[   25.618895]  ? __internal_add_timer+0x1f0/0x2d0
[   25.623531]  panic+0x1e4/0x417
[   25.626687]  ? __warn+0x1d9/0x1d9
[   25.630112]  ? __internal_add_timer+0x275/0x2d0
[   25.634746]  kasan_end_report+0x50/0x50
[   25.638686]  kasan_report+0x144/0x340
[   25.642454]  __asan_report_store8_noabort+0x17/0x20
[   25.647435]  __internal_add_timer+0x275/0x2d0
[   25.651899]  ? calc_wheel_index+0x200/0x200
[   25.656195]  mod_timer+0x622/0x15b0
[   25.659797]  ? mod_timer_pending+0x14e0/0x14e0
[   25.664346]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   25.669327]  ? trace_hardirqs_on+0xd/0x10
[   25.673444]  ? _crng_backtrack_protect+0xd9/0x130
[   25.678257]  ? __lock_is_held+0xbc/0x140
[   25.682284]  ? __lockdep_init_map+0xe4/0x650
[   25.686658]  ? lockdep_init_map+0x3d/0x70
[   25.690773]  ? rcu_read_lock_sched_held+0x108/0x120
[   25.695754]  ? init_timer_key+0x126/0x3b0
[   25.699868]  ? try_to_del_timer_sync+0x120/0x120
[   25.704590]  ? round_jiffies_up+0xce/0x100
[   25.708790]  ? __round_jiffies_up_relative+0x150/0x150
[   25.714033]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   25.718931]  __tun_chr_ioctl+0x1b23/0x3d20
[   25.723135]  ? tun_chr_read_iter+0x1e0/0x1e0
[   25.727508]  ? __pmd_alloc+0x4e0/0x4e0
[   25.731366]  ? __might_sleep+0x95/0x190
[   25.735311]  ? selinux_file_ioctl+0x444/0x690
[   25.739771]  ? __fget_light+0x29d/0x390
[   25.743710]  ? selinux_capable+0x40/0x40
[   25.747747]  tun_chr_compat_ioctl+0x29/0x30
[   25.752031]  ? tun_chr_compat_ioctl+0x29/0x30
[   25.756496]  compat_SyS_ioctl+0x1d7/0x3290
[   25.760695]  ? __handle_mm_fault+0x39c0/0x39c0
[   25.765243]  ? __tun_chr_ioctl+0x3d20/0x3d20
[   25.769617]  ? do_ioctl+0x60/0x60
[   25.773041]  ? do_fast_syscall_32+0x158/0xf05
[   25.777505]  ? do_ioctl+0x60/0x60
[   25.780923]  do_fast_syscall_32+0x3f2/0xf05
[   25.785213]  ? do_int80_syscall_32+0x940/0x940
[   25.789761]  ? kasan_check_read+0x11/0x20
[   25.793876]  ? syscall_return_slowpath+0x510/0x510
[   25.798770]  ? SyS_rt_sigaction+0x94/0x1b0
[   25.802973]  ? lockdep_sys_exit+0x47/0xf0
[   25.807089]  ? retint_user+0x18/0x20
[   25.810768]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   25.815584]  entry_SYSENTER_compat+0x51/0x60
[   25.819956] RIP: 0023:0xf7f3bc79
[   25.823284] RSP: 002b:00000000ffdaffdc EFLAGS: 00000286 ORIG_RAX: 0000000000000036
[   25.830957] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400454ca
[   25.838195] RDX: 00000000201dd000 RSI: 00000000080ef00c RDI: 000000000000003f
[   25.845429] RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000
[   25.852665] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   25.859900] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   25.867192] Dumping ftrace buffer:
[   25.870700]    (ftrace buffer empty)
[   25.874379] Kernel Offset: disabled
[   25.877975] Rebooting in 86400 seconds..