INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-2,10.128.0.14' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   44.681534] ==================================================================
[   44.688989] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   44.695714] Write of size 8 at addr ffff8801ce11b780 by task syzkaller919301/2986
[   44.703318] 
[   44.704921] CPU: 1 PID: 2986 Comm: syzkaller919301 Not tainted 4.14.0-rc2+ #20
[   44.712253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   44.721578] Call Trace:
[   44.724145]  dump_stack+0x194/0x257
[   44.727751]  ? arch_local_irq_restore+0x53/0x53
[   44.732396]  ? show_regs_print_info+0x65/0x65
[   44.736869]  ? lock_timer_base+0x1a3/0x2b0
[   44.741077]  ? detach_if_pending+0x557/0x610
[   44.745459]  print_address_description+0x73/0x250
[   44.750270]  ? detach_if_pending+0x557/0x610
[   44.754648]  kasan_report+0x25b/0x340
[   44.758424]  __asan_report_store8_noabort+0x17/0x20
[   44.763407]  detach_if_pending+0x557/0x610
[   44.767616]  ? trace_raw_output_tick_stop+0x130/0x130
[   44.772778]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   44.777414]  ? lock_timer_base+0x1a3/0x2b0
[   44.781623]  ? lock_timer_base+0x1eb/0x2b0
[   44.785831]  ? __internal_add_timer+0x2d0/0x2d0
[   44.790474]  ? trace_hardirqs_on+0xd/0x10
[   44.794609]  try_to_del_timer_sync+0xa2/0x120
[   44.799072]  ? del_timer+0x130/0x130
[   44.802757]  ? del_timer_sync+0xeb/0x240
[   44.806804]  del_timer_sync+0x18a/0x240
[   44.810751]  tun_free_netdev+0x105/0x1b0
[   44.814782]  ? tun_xdp+0x410/0x410
[   44.818290]  ? cpumask_next+0x24/0x30
[   44.822063]  ? netdev_refcnt_read+0xed/0x150
[   44.826451]  ? tun_xdp+0x410/0x410
[   44.829961]  netdev_run_todo+0x870/0xca0
[   44.833991]  ? do_group_exit+0x149/0x400
[   44.838026]  ? register_netdev+0x30/0x30
[   44.842060]  ? lock_downgrade+0x990/0x990
[   44.846177]  ? trace_hardirqs_on+0xd/0x10
[   44.850312]  ? refcount_sub_and_test+0x115/0x1b0
[   44.855047]  ? refcount_inc+0x50/0x50
[   44.858817]  ? refcount_inc+0x50/0x50
[   44.862592]  ? sk_destruct+0x4c/0x80
[   44.866274]  ? __sk_free+0x5c/0x230
[   44.869872]  ? sk_free+0x2f/0x40
[   44.873207]  ? __tun_detach+0x176/0x1390
[   44.877251]  ? tun_attach+0xf90/0xf90
[   44.881030]  ? locks_remove_file+0x3fa/0x5a0
[   44.885409]  ? fcntl_setlk+0x10d0/0x10d0
[   44.889446]  ? __fsnotify_parent+0xb4/0x3a0
[   44.893738]  ? fsnotify+0x1af0/0x1af0
[   44.897514]  ? __tun_detach+0x1390/0x1390
[   44.901634]  ? __tun_detach+0x1390/0x1390
[   44.905751]  rtnl_unlock+0xe/0x10
[   44.909171]  tun_chr_close+0x49/0x60
[   44.912852]  __fput+0x333/0x7f0
[   44.916106]  ? fput+0x140/0x140
[   44.919357]  ? check_same_owner+0x320/0x320
[   44.923653]  ____fput+0x15/0x20
[   44.926902]  task_work_run+0x199/0x270
[   44.930761]  ? task_work_cancel+0x210/0x210
[   44.935060]  ? free_nsproxy+0x185/0x1f0
[   44.939005]  ? switch_task_namespaces+0xa2/0xc0
[   44.943651]  do_exit+0x9d2/0x1af0
[   44.947071]  ? trace_hardirqs_on+0xd/0x10
[   44.951193]  ? mm_update_next_owner+0x930/0x930
[   44.955830]  ? lock_acquire+0x1d5/0x580
[   44.959774]  ? __handle_mm_fault+0xf07/0x39c0
[   44.964245]  ? lock_release+0xd70/0xd70
[   44.968187]  ? check_noncircular+0x20/0x20
[   44.972393]  ? kvfree+0x3b/0x60
[   44.975648]  ? rtnl_unlock+0xe/0x10
[   44.979246]  ? check_noncircular+0x20/0x20
[   44.983453]  ? __handle_mm_fault+0x587/0x39c0
[   44.987924]  ? __pmd_alloc+0x4e0/0x4e0
[   44.991791]  ? find_held_lock+0x39/0x1d0
[   44.995835]  ? lock_downgrade+0x990/0x990
[   44.999979]  do_group_exit+0x149/0x400
[   45.003833]  ? __handle_mm_fault+0x39c0/0x39c0
[   45.008386]  ? vmacache_find+0x5f/0x280
[   45.012330]  ? SyS_exit+0x30/0x30
[   45.015761]  ? do_fast_syscall_32+0x158/0xf05
[   45.020225]  ? do_group_exit+0x400/0x400
[   45.024255]  SyS_exit_group+0x1d/0x20
[   45.028025]  do_fast_syscall_32+0x3f2/0xf05
[   45.032325]  ? do_int80_syscall_32+0x940/0x940
[   45.036883]  ? lockdep_sys_exit+0x47/0xf0
[   45.040999]  ? syscall_return_slowpath+0x2b3/0x510
[   45.045900]  ? finish_task_switch+0x1aa/0x740
[   45.050367]  ? lockdep_sys_exit+0x47/0xf0
[   45.054485]  ? retint_user+0x18/0x20
[   45.058173]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   45.062993]  entry_SYSENTER_compat+0x51/0x60
[   45.067369] RIP: 0023:0xf7f8ac79
[   45.070705] RSP: 002b:000000000820fe2c EFLAGS: 00000202 ORIG_RAX: 00000000000000fc
[   45.078390] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000000000
[   45.085632] RDX: 0000000000000001 RSI: 0000000020906fd8 RDI: 00000000400454ca
[   45.092875] RBP: 0000000008072cd6 R08: 0000000000000000 R09: 0000000000000000
[   45.100123] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   45.107365] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   45.114625] 
[   45.116223] Allocated by task 2986:
[   45.119826]  save_stack_trace+0x16/0x20
[   45.123771]  save_stack+0x43/0xd0
[   45.127191]  kasan_kmalloc+0xad/0xe0
[   45.130883]  __kmalloc_node+0x47/0x70
[   45.134654]  kvmalloc_node+0x64/0xd0
[   45.138342]  alloc_netdev_mqs+0x16e/0xed0
[   45.142458]  __tun_chr_ioctl+0x12be/0x3d20
[   45.146748]  tun_chr_compat_ioctl+0x29/0x30
[   45.151039]  compat_SyS_ioctl+0x1d7/0x3290
[   45.155244]  do_fast_syscall_32+0x3f2/0xf05
[   45.159535]  entry_SYSENTER_compat+0x51/0x60
[   45.163909] 
[   45.165504] Freed by task 2986:
[   45.168752]  save_stack_trace+0x16/0x20
[   45.172695]  save_stack+0x43/0xd0
[   45.176115]  kasan_slab_free+0x71/0xc0
[   45.179971]  kfree+0xca/0x250
[   45.183044]  kvfree+0x36/0x60
[   45.186117]  free_netdev+0x2cf/0x360
[   45.189798]  __tun_chr_ioctl+0x2cf6/0x3d20
[   45.193999]  tun_chr_compat_ioctl+0x29/0x30
[   45.198287]  compat_SyS_ioctl+0x1d7/0x3290
[   45.202491]  do_fast_syscall_32+0x3f2/0xf05
[   45.206780]  entry_SYSENTER_compat+0x51/0x60
[   45.211152] 
[   45.212750] The buggy address belongs to the object at ffff8801ce118380
[   45.212750]  which belongs to the cache kmalloc-16384 of size 16384
[   45.225721] The buggy address is located 13312 bytes inside of
[   45.225721]  16384-byte region [ffff8801ce118380, ffff8801ce11c380)
[   45.237908] The buggy address belongs to the page:
[   45.242806] page:ffffea0007384600 count:1 mapcount:0 mapping:ffff8801ce118380 index:0x0 compound_mapcount: 0
[   45.252750] flags: 0x200000000008100(slab|head)
[   45.257391] raw: 0200000000008100 ffff8801ce118380 0000000000000000 0000000100000001
[   45.265244] raw: ffffea0007350220 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   45.273657] page dumped because: kasan: bad access detected
[   45.279337] 
[   45.280933] Memory state around the buggy address:
[   45.285831]  ffff8801ce11b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.293167]  ffff8801ce11b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.300496] >ffff8801ce11b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.307823]                    ^
[   45.311157]  ffff8801ce11b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.318486]  ffff8801ce11b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.325812] ==================================================================
[   45.333138] Disabling lock debugging due to kernel taint
[   45.338551] Kernel panic - not syncing: panic_on_warn set ...
[   45.338551] 
[   45.345876] CPU: 1 PID: 2986 Comm: syzkaller919301 Tainted: G    B           4.14.0-rc2+ #20
[   45.354413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.363729] Call Trace:
[   45.366290]  dump_stack+0x194/0x257
[   45.369884]  ? arch_local_irq_restore+0x53/0x53
[   45.374519]  ? vprintk_default+0x28/0x30
[   45.378551]  ? detach_if_pending+0x4d0/0x610
[   45.382928]  panic+0x1e4/0x417
[   45.386084]  ? __warn+0x1d9/0x1d9
[   45.389506]  ? detach_if_pending+0x557/0x610
[   45.393878]  kasan_end_report+0x50/0x50
[   45.397813]  kasan_report+0x144/0x340
[   45.401578]  __asan_report_store8_noabort+0x17/0x20
[   45.406559]  detach_if_pending+0x557/0x610
[   45.410757]  ? trace_raw_output_tick_stop+0x130/0x130
[   45.415912]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   45.420544]  ? lock_timer_base+0x1a3/0x2b0
[   45.424742]  ? lock_timer_base+0x1eb/0x2b0
[   45.428944]  ? __internal_add_timer+0x2d0/0x2d0
[   45.433577]  ? trace_hardirqs_on+0xd/0x10
[   45.437692]  try_to_del_timer_sync+0xa2/0x120
[   45.442149]  ? del_timer+0x130/0x130
[   45.445825]  ? del_timer_sync+0xeb/0x240
[   45.449852]  del_timer_sync+0x18a/0x240
[   45.453791]  tun_free_netdev+0x105/0x1b0
[   45.457815]  ? tun_xdp+0x410/0x410
[   45.461320]  ? cpumask_next+0x24/0x30
[   45.465086]  ? netdev_refcnt_read+0xed/0x150
[   45.469459]  ? tun_xdp+0x410/0x410
[   45.472964]  netdev_run_todo+0x870/0xca0
[   45.476989]  ? do_group_exit+0x149/0x400
[   45.481017]  ? register_netdev+0x30/0x30
[   45.485044]  ? lock_downgrade+0x990/0x990
[   45.489156]  ? trace_hardirqs_on+0xd/0x10
[   45.493288]  ? refcount_sub_and_test+0x115/0x1b0
[   45.498018]  ? refcount_inc+0x50/0x50
[   45.501784]  ? refcount_inc+0x50/0x50
[   45.505551]  ? sk_destruct+0x4c/0x80
[   45.509229]  ? __sk_free+0x5c/0x230
[   45.512830]  ? sk_free+0x2f/0x40
[   45.516169]  ? __tun_detach+0x176/0x1390
[   45.520202]  ? tun_attach+0xf90/0xf90
[   45.523972]  ? locks_remove_file+0x3fa/0x5a0
[   45.528347]  ? fcntl_setlk+0x10d0/0x10d0
[   45.532394]  ? __fsnotify_parent+0xb4/0x3a0
[   45.536683]  ? fsnotify+0x1af0/0x1af0
[   45.540450]  ? __tun_detach+0x1390/0x1390
[   45.544561]  ? __tun_detach+0x1390/0x1390
[   45.548674]  rtnl_unlock+0xe/0x10
[   45.552091]  tun_chr_close+0x49/0x60
[   45.555769]  __fput+0x333/0x7f0
[   45.559014]  ? fput+0x140/0x140
[   45.562259]  ? check_same_owner+0x320/0x320
[   45.566549]  ____fput+0x15/0x20
[   45.569793]  task_work_run+0x199/0x270
[   45.573645]  ? task_work_cancel+0x210/0x210
[   45.577931]  ? free_nsproxy+0x185/0x1f0
[   45.581868]  ? switch_task_namespaces+0xa2/0xc0
[   45.586516]  do_exit+0x9d2/0x1af0
[   45.589934]  ? trace_hardirqs_on+0xd/0x10
[   45.594048]  ? mm_update_next_owner+0x930/0x930
[   45.598681]  ? lock_acquire+0x1d5/0x580
[   45.602619]  ? __handle_mm_fault+0xf07/0x39c0
[   45.607083]  ? lock_release+0xd70/0xd70
[   45.611020]  ? check_noncircular+0x20/0x20
[   45.615219]  ? kvfree+0x3b/0x60
[   45.618466]  ? rtnl_unlock+0xe/0x10
[   45.622057]  ? check_noncircular+0x20/0x20
[   45.626255]  ? __handle_mm_fault+0x587/0x39c0
[   45.630715]  ? __pmd_alloc+0x4e0/0x4e0
[   45.634571]  ? find_held_lock+0x39/0x1d0
[   45.638601]  ? lock_downgrade+0x990/0x990
[   45.642726]  do_group_exit+0x149/0x400
[   45.646579]  ? __handle_mm_fault+0x39c0/0x39c0
[   45.651127]  ? vmacache_find+0x5f/0x280
[   45.655063]  ? SyS_exit+0x30/0x30
[   45.658503]  ? do_fast_syscall_32+0x158/0xf05
[   45.662963]  ? do_group_exit+0x400/0x400
[   45.666987]  SyS_exit_group+0x1d/0x20
[   45.670750]  do_fast_syscall_32+0x3f2/0xf05
[   45.675038]  ? do_int80_syscall_32+0x940/0x940
[   45.679584]  ? lockdep_sys_exit+0x47/0xf0