INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-1,10.128.0.12' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   42.965615] ==================================================================
[   42.973057] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   42.980049] Write of size 8 at addr ffff8801d4c6b6c8 by task syzkaller191108/3039
[   42.987643] 
[   42.989273] CPU: 1 PID: 3039 Comm: syzkaller191108 Not tainted 4.13.0-rc6-next-20170823+ #7
[   42.997735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   43.007066] Call Trace:
[   43.009635]  dump_stack+0x194/0x257
[   43.013242]  ? arch_local_irq_restore+0x53/0x53
[   43.017887]  ? show_regs_print_info+0x65/0x65
[   43.022364]  ? __internal_add_timer+0x275/0x2d0
[   43.027096]  print_address_description+0x73/0x250
[   43.031915]  ? __internal_add_timer+0x275/0x2d0
[   43.036558]  kasan_report+0x24e/0x340
[   43.040337]  __asan_report_store8_noabort+0x17/0x20
[   43.045351]  __internal_add_timer+0x275/0x2d0
[   43.049824]  ? calc_wheel_index+0x200/0x200
[   43.054164]  mod_timer+0x6e8/0xf40
[   43.057688]  ? mod_timer_pending+0xe80/0xe80
[   43.062082]  ? __lock_is_held+0xbc/0x140
[   43.066146]  ? __lockdep_init_map+0xe4/0x650
[   43.070547]  ? lockdep_init_map+0x3d/0x70
[   43.074673]  ? rcu_read_lock_sched_held+0x108/0x120
[   43.079672]  ? try_to_del_timer_sync+0x120/0x120
[   43.084405]  ? round_jiffies_up+0xce/0x100
[   43.088630]  ? __round_jiffies_up_relative+0x150/0x150
[   43.093906]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   43.098816]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   43.104340]  __tun_chr_ioctl+0x1b2c/0x3d40
[   43.108574]  ? unwind_get_return_address+0x84/0xa0
[   43.113489]  ? tun_chr_read_iter+0x1e0/0x1e0
[   43.117876]  ? putname+0xee/0x130
[   43.121304]  ? check_noncircular+0x20/0x20
[   43.125518]  ? __handle_mm_fault+0x577/0x39e0
[   43.130005]  ? __pmd_alloc+0x4e0/0x4e0
[   43.133889]  ? check_same_owner+0x320/0x320
[   43.138196]  ? tun_chr_compat_ioctl+0x30/0x30
[   43.142664]  tun_chr_ioctl+0x2a/0x40
[   43.146355]  ? tun_chr_ioctl+0x2a/0x40
[   43.150221]  do_vfs_ioctl+0x1b1/0x1530
[   43.154087]  ? _cond_resched+0x14/0x30
[   43.157956]  ? ioctl_preallocate+0x2b0/0x2b0
[   43.162344]  ? selinux_capable+0x40/0x40
[   43.166382]  ? __handle_mm_fault+0x39e0/0x39e0
[   43.170998]  ? security_file_ioctl+0x7d/0xb0
[   43.175384]  ? security_file_ioctl+0x89/0xb0
[   43.179771]  SyS_ioctl+0x8f/0xc0
[   43.183119]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   43.187848] RIP: 0033:0x443e09
[   43.191045] RSP: 002b:00007ffde43e2a78 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   43.198731] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443e09
[   43.205976] RDX: 0000000020982fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   43.213232] RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
[   43.220478] R10: 0000000000000000 R11: 0000000000000206 R12: 8a43cf6a0d164a66
[   43.227725] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   43.235001] 
[   43.236605] Allocated by task 3039:
[   43.240212]  save_stack_trace+0x16/0x20
[   43.244171]  save_stack+0x43/0xd0
[   43.247624]  kasan_kmalloc+0xad/0xe0
[   43.251332]  __kmalloc_node+0x47/0x70
[   43.255145]  kvmalloc_node+0x64/0xd0
[   43.258841]  alloc_netdev_mqs+0x16e/0xed0
[   43.263079]  __tun_chr_ioctl+0x12be/0x3d40
[   43.267289]  tun_chr_ioctl+0x2a/0x40
[   43.270978]  do_vfs_ioctl+0x1b1/0x1530
[   43.274850]  SyS_ioctl+0x8f/0xc0
[   43.278200]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   43.282930] 
[   43.284536] Freed by task 3039:
[   43.287795]  save_stack_trace+0x16/0x20
[   43.291750]  save_stack+0x43/0xd0
[   43.295198]  kasan_slab_free+0x71/0xc0
[   43.299061]  kfree+0xca/0x250
[   43.302141]  kvfree+0x36/0x60
[   43.305226]  free_netdev+0x2cf/0x360
[   43.308937]  __tun_chr_ioctl+0x2cff/0x3d40
[   43.313233]  tun_chr_ioctl+0x2a/0x40
[   43.316921]  do_vfs_ioctl+0x1b1/0x1530
[   43.320782]  SyS_ioctl+0x8f/0xc0
[   43.324125]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   43.328852] 
[   43.330454] The buggy address belongs to the object at ffff8801d4c682c0
[   43.330454]  which belongs to the cache kmalloc-16384 of size 16384
[   43.343431] The buggy address is located 13320 bytes inside of
[   43.343431]  16384-byte region [ffff8801d4c682c0, ffff8801d4c6c2c0)
[   43.355629] The buggy address belongs to the page:
[   43.360537] page:ffffea0007531a00 count:1 mapcount:0 mapping:ffff8801d4c682c0 index:0x0 compound_mapcount: 0
[   43.370496] flags: 0x200000000008100(slab|head)
[   43.375149] raw: 0200000000008100 ffff8801d4c682c0 0000000000000000 0000000100000001
[   43.383017] raw: ffffea0007485c20 ffffea0006fe4a20 ffff8801dac02200 0000000000000000
[   43.390872] page dumped because: kasan: bad access detected
[   43.396556] 
[   43.398158] Memory state around the buggy address:
[   43.403085]  ffff8801d4c6b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.410419]  ffff8801d4c6b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.417754] >ffff8801d4c6b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.425098]                                               ^
[   43.430788]  ffff8801d4c6b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.438123]  ffff8801d4c6b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.445469] ==================================================================
[   43.452823] Disabling lock debugging due to kernel taint
[   43.458244] Kernel panic - not syncing: panic_on_warn set ...
[   43.458244] 
[   43.465576] CPU: 1 PID: 3039 Comm: syzkaller191108 Tainted: G    B           4.13.0-rc6-next-20170823+ #7
[   43.475248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   43.484591] Call Trace:
[   43.487157]  dump_stack+0x194/0x257
[   43.490756]  ? arch_local_irq_restore+0x53/0x53
[   43.495397]  ? vprintk_default+0x28/0x30
[   43.499429]  ? __internal_add_timer+0x1b0/0x2d0
[   43.504072]  panic+0x1e4/0x41c
[   43.507235]  ? refcount_error_report+0x214/0x214
[   43.511966]  ? __internal_add_timer+0x275/0x2d0
[   43.516616]  kasan_end_report+0x50/0x50
[   43.520561]  kasan_report+0x137/0x340
[   43.524332]  __asan_report_store8_noabort+0x17/0x20
[   43.529316]  __internal_add_timer+0x275/0x2d0
[   43.533781]  ? calc_wheel_index+0x200/0x200
[   43.538078]  mod_timer+0x6e8/0xf40
[   43.541591]  ? mod_timer_pending+0xe80/0xe80
[   43.545973]  ? __lock_is_held+0xbc/0x140
[   43.550021]  ? __lockdep_init_map+0xe4/0x650
[   43.554403]  ? lockdep_init_map+0x3d/0x70
[   43.558523]  ? rcu_read_lock_sched_held+0x108/0x120
[   43.563515]  ? try_to_del_timer_sync+0x120/0x120
[   43.568240]  ? round_jiffies_up+0xce/0x100
[   43.572444]  ? __round_jiffies_up_relative+0x150/0x150
[   43.577689]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   43.582589]  ? selinux_tun_dev_alloc_security+0x124/0x170
[   43.588102]  __tun_chr_ioctl+0x1b2c/0x3d40
[   43.592310]  ? unwind_get_return_address+0x84/0xa0
[   43.597214]  ? tun_chr_read_iter+0x1e0/0x1e0
[   43.601591]  ? putname+0xee/0x130
[   43.605031]  ? check_noncircular+0x20/0x20
[   43.609236]  ? __handle_mm_fault+0x577/0x39e0
[   43.613722]  ? __pmd_alloc+0x4e0/0x4e0
[   43.617588]  ? check_same_owner+0x320/0x320
[   43.621881]  ? tun_chr_compat_ioctl+0x30/0x30
[   43.626347]  tun_chr_ioctl+0x2a/0x40
[   43.630031]  ? tun_chr_ioctl+0x2a/0x40
[   43.633912]  do_vfs_ioctl+0x1b1/0x1530
[   43.637770]  ? _cond_resched+0x14/0x30
[   43.641630]  ? ioctl_preallocate+0x2b0/0x2b0
[   43.646102]  ? selinux_capable+0x40/0x40
[   43.650136]  ? __handle_mm_fault+0x39e0/0x39e0
[   43.654698]  ? security_file_ioctl+0x7d/0xb0
[   43.659079]  ? security_file_ioctl+0x89/0xb0
[   43.663567]  SyS_ioctl+0x8f/0xc0
[   43.666928]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   43.671653] RIP: 0033:0x443e09
[   43.674813] RSP: 002b:00007ffde43e2a78 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   43.682490] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443e09
[   43.689729] RDX: 0000000020982fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   43.696969] RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
[   43.704219] R10: 0000000000000000 R11: 0000000000000206 R12: 8a43cf6a0d164a66
[   43.711461] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   43.718773] Dumping ftrace buffer:
[   43.722283]    (ftrace buffer empty)
[   43.725963] Kernel Offset: disabled
[   43.729569] Rebooting in 86400 seconds..