INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-1,10.128.0.43' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   39.643279] ==================================================================
[   39.650703] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   39.657434] Write of size 8 at addr ffff8801ce19b740 by task syzkaller506475/2988
[   39.665024] 
[   39.666626] CPU: 1 PID: 2988 Comm: syzkaller506475 Not tainted 4.14.0-rc3+ #24
[   39.673956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   39.683285] Call Trace:
[   39.685851]  dump_stack+0x194/0x257
[   39.689456]  ? arch_local_irq_restore+0x53/0x53
[   39.694098]  ? show_regs_print_info+0x65/0x65
[   39.698565]  ? lock_timer_base+0x1a3/0x2b0
[   39.702775]  ? detach_if_pending+0x557/0x610
[   39.707156]  print_address_description+0x73/0x250
[   39.711967]  ? detach_if_pending+0x557/0x610
[   39.716348]  kasan_report+0x25b/0x340
[   39.720124]  __asan_report_store8_noabort+0x17/0x20
[   39.725108]  detach_if_pending+0x557/0x610
[   39.729315]  ? trace_raw_output_tick_stop+0x130/0x130
[   39.734479]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   39.739116]  ? lock_timer_base+0x1a3/0x2b0
[   39.743324]  ? lock_timer_base+0x1eb/0x2b0
[   39.747535]  ? __internal_add_timer+0x2d0/0x2d0
[   39.752176]  ? trace_hardirqs_on+0xd/0x10
[   39.756302]  try_to_del_timer_sync+0xa2/0x120
[   39.760768]  ? del_timer+0x130/0x130
[   39.764453]  ? del_timer_sync+0xeb/0x240
[   39.768490]  del_timer_sync+0x18a/0x240
[   39.772438]  tun_free_netdev+0x105/0x1b0
[   39.776470]  ? tun_xdp+0x410/0x410
[   39.779979]  ? cpumask_next+0x24/0x30
[   39.783749]  ? netdev_refcnt_read+0xed/0x150
[   39.788131]  ? tun_xdp+0x410/0x410
[   39.791648]  netdev_run_todo+0x870/0xca0
[   39.795681]  ? do_group_exit+0x149/0x400
[   39.799718]  ? register_netdev+0x30/0x30
[   39.803755]  ? lock_downgrade+0x990/0x990
[   39.807876]  ? trace_hardirqs_on+0xd/0x10
[   39.812012]  ? refcount_sub_and_test+0x115/0x1b0
[   39.816739]  ? refcount_inc+0x50/0x50
[   39.820508]  ? refcount_inc+0x50/0x50
[   39.824283]  ? sk_destruct+0x4c/0x80
[   39.827967]  ? __sk_free+0x5c/0x230
[   39.831563]  ? sk_free+0x2f/0x40
[   39.834902]  ? __tun_detach+0x176/0x1390
[   39.838942]  ? tun_attach+0xf90/0xf90
[   39.842723]  ? locks_remove_file+0x3fa/0x5a0
[   39.847121]  ? fcntl_setlk+0x10d0/0x10d0
[   39.851158]  ? __fsnotify_parent+0xb4/0x3a0
[   39.855454]  ? fsnotify+0x1af0/0x1af0
[   39.859230]  ? __tun_detach+0x1390/0x1390
[   39.863351]  ? __tun_detach+0x1390/0x1390
[   39.867473]  rtnl_unlock+0xe/0x10
[   39.870896]  tun_chr_close+0x49/0x60
[   39.874581]  __fput+0x333/0x7f0
[   39.877836]  ? fput+0x140/0x140
[   39.881094]  ? check_same_owner+0x320/0x320
[   39.885392]  ____fput+0x15/0x20
[   39.888644]  task_work_run+0x199/0x270
[   39.892504]  ? task_work_cancel+0x210/0x210
[   39.896797]  ? free_nsproxy+0x185/0x1f0
[   39.900741]  ? switch_task_namespaces+0xa2/0xc0
[   39.905386]  do_exit+0x9d2/0x1af0
[   39.908808]  ? __handle_mm_fault+0xf07/0x39c0
[   39.913278]  ? mm_update_next_owner+0x930/0x930
[   39.917918]  ? lock_release+0xd70/0xd70
[   39.921861]  ? check_noncircular+0x20/0x20
[   39.926071]  ? kfree+0xe4/0x250
[   39.929320]  ? kvfree+0x36/0x60
[   39.932573]  ? trace_hardirqs_on+0xd/0x10
[   39.936696]  ? check_noncircular+0x20/0x20
[   39.940906]  ? __handle_mm_fault+0x587/0x39c0
[   39.945381]  ? __pmd_alloc+0x4e0/0x4e0
[   39.949252]  ? find_held_lock+0x39/0x1d0
[   39.953309]  ? lock_downgrade+0x990/0x990
[   39.957458]  ? handle_mm_fault+0x410/0x8d0
[   39.961663]  ? down_read_trylock+0xdb/0x170
[   39.965957]  ? __do_page_fault+0x31e/0xd60
[   39.970163]  ? __handle_mm_fault+0x39c0/0x39c0
[   39.974715]  ? vmacache_find+0x5f/0x280
[   39.978657]  ? vmacache_update+0xfe/0x130
[   39.982781]  do_group_exit+0x149/0x400
[   39.986638]  ? __do_page_fault+0x3d6/0xd60
[   39.990841]  ? __tun_chr_ioctl+0x3d20/0x3d20
[   39.995219]  ? SyS_exit+0x30/0x30
[   39.998649]  ? do_fast_syscall_32+0x158/0xf05
[   40.003112]  ? do_group_exit+0x400/0x400
[   40.007147]  SyS_exit_group+0x1d/0x20
[   40.010917]  do_fast_syscall_32+0x3f2/0xf05
[   40.015217]  ? do_int80_syscall_32+0x940/0x940
[   40.019767]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   40.024495]  ? lockdep_sys_exit+0x47/0xf0
[   40.028613]  ? syscall_return_slowpath+0x2b3/0x510
[   40.033521]  ? lockdep_sys_exit+0x47/0xf0
[   40.037642]  ? retint_user+0x18/0x20
[   40.041332]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   40.046151]  entry_SYSENTER_compat+0x51/0x60
[   40.050527] RIP: 0023:0xf7f48c79
[   40.053859] RSP: 002b:00000000ffe185ac EFLAGS: 00000286 ORIG_RAX: 00000000000000fc
[   40.061540] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000000000
[   40.068780] RDX: 0000000000000000 RSI: 0000000020927fd8 RDI: 00000000400454ca
[   40.076018] RBP: 0000000008072986 R08: 0000000000000000 R09: 0000000000000000
[   40.083257] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   40.090495] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   40.097754] 
[   40.099356] Allocated by task 2988:
[   40.102956]  save_stack_trace+0x16/0x20
[   40.106900]  save_stack+0x43/0xd0
[   40.110324]  kasan_kmalloc+0xad/0xe0
[   40.114004]  __kmalloc_node+0x47/0x70
[   40.117772]  kvmalloc_node+0x64/0xd0
[   40.121455]  alloc_netdev_mqs+0x16e/0xed0
[   40.125571]  __tun_chr_ioctl+0x12be/0x3d20
[   40.129773]  tun_chr_compat_ioctl+0x29/0x30
[   40.134065]  compat_SyS_ioctl+0x1d7/0x3290
[   40.138270]  do_fast_syscall_32+0x3f2/0xf05
[   40.142557]  entry_SYSENTER_compat+0x51/0x60
[   40.146930] 
[   40.148525] Freed by task 2988:
[   40.151775]  save_stack_trace+0x16/0x20
[   40.155716]  save_stack+0x43/0xd0
[   40.159135]  kasan_slab_free+0x71/0xc0
[   40.162990]  kfree+0xca/0x250
[   40.166062]  kvfree+0x36/0x60
[   40.169135]  free_netdev+0x2cf/0x360
[   40.172816]  __tun_chr_ioctl+0x2cf6/0x3d20
[   40.177016]  tun_chr_compat_ioctl+0x29/0x30
[   40.181304]  compat_SyS_ioctl+0x1d7/0x3290
[   40.185505]  do_fast_syscall_32+0x3f2/0xf05
[   40.189792]  entry_SYSENTER_compat+0x51/0x60
[   40.194164] 
[   40.195761] The buggy address belongs to the object at ffff8801ce198340
[   40.195761]  which belongs to the cache kmalloc-16384 of size 16384
[   40.208730] The buggy address is located 13312 bytes inside of
[   40.208730]  16384-byte region [ffff8801ce198340, ffff8801ce19c340)
[   40.220917] The buggy address belongs to the page:
[   40.225815] page:ffffea0007386600 count:1 mapcount:0 mapping:ffff8801ce198340 index:0x0 compound_mapcount: 0
[   40.235755] flags: 0x200000000008100(slab|head)
[   40.240397] raw: 0200000000008100 ffff8801ce198340 0000000000000000 0000000100000001
[   40.248245] raw: ffffea000735a820 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   40.256091] page dumped because: kasan: bad access detected
[   40.261766] 
[   40.263361] Memory state around the buggy address:
[   40.268261]  ffff8801ce19b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.275591]  ffff8801ce19b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.282917] >ffff8801ce19b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.290245]                                            ^
[   40.295662]  ffff8801ce19b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.302997]  ffff8801ce19b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.310322] ==================================================================
[   40.317646] Disabling lock debugging due to kernel taint
[   40.323061] Kernel panic - not syncing: panic_on_warn set ...
[   40.323061] 
[   40.330386] CPU: 1 PID: 2988 Comm: syzkaller506475 Tainted: G    B           4.14.0-rc3+ #24
[   40.338929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   40.348247] Call Trace:
[   40.350800]  dump_stack+0x194/0x257
[   40.354395]  ? arch_local_irq_restore+0x53/0x53
[   40.359029]  ? vprintk_default+0x28/0x30
[   40.363057]  ? detach_if_pending+0x500/0x610
[   40.367428]  panic+0x1e4/0x417
[   40.370585]  ? __warn+0x1d9/0x1d9
[   40.374007]  ? detach_if_pending+0x557/0x610
[   40.378379]  kasan_end_report+0x50/0x50
[   40.382411]  kasan_report+0x144/0x340
[   40.386178]  __asan_report_store8_noabort+0x17/0x20
[   40.391162]  detach_if_pending+0x557/0x610
[   40.395361]  ? trace_raw_output_tick_stop+0x130/0x130
[   40.400517]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   40.405148]  ? lock_timer_base+0x1a3/0x2b0
[   40.409347]  ? lock_timer_base+0x1eb/0x2b0
[   40.413549]  ? __internal_add_timer+0x2d0/0x2d0
[   40.418184]  ? trace_hardirqs_on+0xd/0x10
[   40.422301]  try_to_del_timer_sync+0xa2/0x120
[   40.426760]  ? del_timer+0x130/0x130
[   40.430438]  ? del_timer_sync+0xeb/0x240
[   40.434466]  del_timer_sync+0x18a/0x240
[   40.438406]  tun_free_netdev+0x105/0x1b0
[   40.442433]  ? tun_xdp+0x410/0x410
[   40.445935]  ? cpumask_next+0x24/0x30
[   40.449703]  ? netdev_refcnt_read+0xed/0x150
[   40.454077]  ? tun_xdp+0x410/0x410
[   40.457584]  netdev_run_todo+0x870/0xca0
[   40.461609]  ? do_group_exit+0x149/0x400
[   40.465640]  ? register_netdev+0x30/0x30
[   40.469667]  ? lock_downgrade+0x990/0x990
[   40.473778]  ? trace_hardirqs_on+0xd/0x10
[   40.477899]  ? refcount_sub_and_test+0x115/0x1b0
[   40.482620]  ? refcount_inc+0x50/0x50
[   40.486385]  ? refcount_inc+0x50/0x50
[   40.490153]  ? sk_destruct+0x4c/0x80
[   40.493828]  ? __sk_free+0x5c/0x230
[   40.497422]  ? sk_free+0x2f/0x40
[   40.500753]  ? __tun_detach+0x176/0x1390
[   40.504782]  ? tun_attach+0xf90/0xf90
[   40.508552]  ? locks_remove_file+0x3fa/0x5a0
[   40.512932]  ? fcntl_setlk+0x10d0/0x10d0
[   40.516961]  ? __fsnotify_parent+0xb4/0x3a0
[   40.521250]  ? fsnotify+0x1af0/0x1af0
[   40.525015]  ? __tun_detach+0x1390/0x1390
[   40.529127]  ? __tun_detach+0x1390/0x1390
[   40.533239]  rtnl_unlock+0xe/0x10
[   40.536656]  tun_chr_close+0x49/0x60
[   40.540334]  __fput+0x333/0x7f0
[   40.543580]  ? fput+0x140/0x140
[   40.546825]  ? check_same_owner+0x320/0x320
[   40.551112]  ____fput+0x15/0x20
[   40.554357]  task_work_run+0x199/0x270
[   40.558209]  ? task_work_cancel+0x210/0x210
[   40.562493]  ? free_nsproxy+0x185/0x1f0
[   40.566434]  ? switch_task_namespaces+0xa2/0xc0
[   40.571067]  do_exit+0x9d2/0x1af0
[   40.574485]  ? __handle_mm_fault+0xf07/0x39c0
[   40.578948]  ? mm_update_next_owner+0x930/0x930
[   40.583592]  ? lock_release+0xd70/0xd70
[   40.587534]  ? check_noncircular+0x20/0x20
[   40.591736]  ? kfree+0xe4/0x250
[   40.594981]  ? kvfree+0x36/0x60
[   40.598227]  ? trace_hardirqs_on+0xd/0x10
[   40.602342]  ? check_noncircular+0x20/0x20
[   40.606541]  ? __handle_mm_fault+0x587/0x39c0
[   40.611002]  ? __pmd_alloc+0x4e0/0x4e0
[   40.614860]  ? find_held_lock+0x39/0x1d0
[   40.618889]  ? lock_downgrade+0x990/0x990
[   40.623012]  ? handle_mm_fault+0x410/0x8d0
[   40.627209]  ? down_read_trylock+0xdb/0x170
[   40.631494]  ? __do_page_fault+0x31e/0xd60
[   40.635811]  ? __handle_mm_fault+0x39c0/0x39c0
[   40.640358]  ? vmacache_find+0x5f/0x280