net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   29.743818] ==================================================================
[   29.744459] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   29.745166] Write of size 8 at addr ffff88003c3537c0 by task syzkaller242605/2982
[   29.745915] 
[   29.746317] CPU: 0 PID: 2982 Comm: syzkaller242605 Not tainted 4.13.0-next-20170907+ #17
[   29.747734] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   29.749250] Call Trace:
[   29.750164]  dump_stack+0x194/0x257
[   29.750675]  ? arch_local_irq_restore+0x53/0x53
[   29.751328]  ? show_regs_print_info+0x65/0x65
[   29.751930]  ? lock_timer_base+0x1a3/0x2b0
[   29.752422]  ? detach_if_pending+0x557/0x610
[   29.752922]  print_address_description+0x73/0x250
[   29.753431]  ? detach_if_pending+0x557/0x610
[   29.754264]  kasan_report+0x24e/0x340
[   29.754880]  __asan_report_store8_noabort+0x17/0x20
[   29.755568]  detach_if_pending+0x557/0x610
[   29.756145]  ? trace_raw_output_tick_stop+0x130/0x130
[   29.756820]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   29.757432]  ? lock_timer_base+0x1a3/0x2b0
[   29.758224]  ? lock_timer_base+0x1eb/0x2b0
[   29.759064]  ? __internal_add_timer+0x2d0/0x2d0
[   29.760036]  ? trace_hardirqs_on+0xd/0x10
[   29.760908]  try_to_del_timer_sync+0xa2/0x120
[   29.761880]  ? del_timer+0x130/0x130
[   29.762650]  ? del_timer_sync+0xeb/0x240
[   29.763494]  del_timer_sync+0x18a/0x240
[   29.764289]  tun_free_netdev+0x105/0x1b0
[   29.765112]  ? tun_xdp+0x410/0x410
[   29.765840]  ? cpumask_next+0x24/0x30
[   29.766634]  ? netdev_refcnt_read+0xed/0x150
[   29.767552]  ? tun_xdp+0x410/0x410
[   29.768282]  netdev_run_todo+0x870/0xca0
[   29.769115]  ? do_group_exit+0x149/0x400
[   29.769931]  ? register_netdev+0x30/0x30
[   29.772088]  ? lock_downgrade+0x990/0x990
[   29.773794]  ? trace_hardirqs_on+0xd/0x10
[   29.775573]  ? refcount_sub_and_test+0x115/0x1b0
[   29.777002]  ? refcount_inc+0x50/0x50
[   29.777952]  ? refcount_inc+0x50/0x50
[   29.778528]  ? sk_destruct+0x4c/0x80
[   29.779071]  ? __sk_free+0x5c/0x230
[   29.779527]  ? sk_free+0x2f/0x40
[   29.780027]  ? __tun_detach+0x176/0x1390
[   29.780563]  ? tun_attach+0xf90/0xf90
[   29.781139]  ? do_raw_spin_trylock+0x190/0x190
[   29.781742]  ? locks_remove_file+0x3fa/0x5a0
[   29.782376]  ? fcntl_setlk+0x10d0/0x10d0
[   29.782918]  ? __fsnotify_parent+0xb4/0x3a0
[   29.783499]  ? fsnotify+0x1af0/0x1af0
[   29.784072]  ? __tun_detach+0x1390/0x1390
[   29.784948]  ? __tun_detach+0x1390/0x1390
[   29.785816]  rtnl_unlock+0xe/0x10
[   29.786564]  tun_chr_close+0x49/0x60
[   29.787381]  __fput+0x333/0x7f0
[   29.788153]  ? fput+0x140/0x140
[   29.788519]  ? check_same_owner+0x320/0x320
[   29.789385]  ? _raw_spin_unlock_irq+0x27/0x70
[   29.790136]  ____fput+0x15/0x20
[   29.790747]  task_work_run+0x199/0x270
[   29.791595]  ? task_work_cancel+0x210/0x210
[   29.793841]  ? _raw_spin_unlock+0x22/0x30
[   29.794703]  ? switch_task_namespaces+0x87/0xc0
[   29.795659]  do_exit+0xa52/0x1b40
[   29.796287]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   29.797231]  ? check_noncircular+0x20/0x20
[   29.798067]  ? __handle_mm_fault+0x587/0x39c0
[   29.798969]  ? mm_update_next_owner+0x930/0x930
[   29.799880]  ? __pmd_alloc+0x4e0/0x4e0
[   29.800716]  ? find_held_lock+0x39/0x1d0
[   29.801482]  ? lock_downgrade+0x990/0x990
[   29.802279]  ? handle_mm_fault+0x410/0x8d0
[   29.803161]  ? down_read_trylock+0xdb/0x170
[   29.803991]  ? __do_page_fault+0x2b8/0xb60
[   29.804808]  ? __handle_mm_fault+0x39c0/0x39c0
[   29.805715]  ? vmacache_find+0x61/0x270
[   29.806523]  ? up_read+0x1a/0x40
[   29.807193]  ? __do_page_fault+0x35b/0xb60
[   29.808045]  ? do_page_fault+0xee/0x720
[   29.808858]  ? __do_page_fault+0xb60/0xb60
[   29.809671]  ? putname+0xf3/0x130
[   29.810469]  do_group_exit+0x149/0x400
[   29.811251]  ? lockdep_sys_exit+0x47/0xf0
[   29.812108]  ? SyS_exit+0x30/0x30
[   29.812894]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   29.815154]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   29.816221]  SyS_exit_group+0x1d/0x20
[   29.817133]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.818167] RIP: 0033:0x438d69
[   29.818892] RSP: 002b:00007fff191fdc18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   29.820447] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438d69
[   29.821971] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   29.823645] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   29.825173] R10: ffffffffffffffcc R11: 0000000000000246 R12: 0000000000000001
[   29.826763] R13: 00000000006cd300 R14: 0000000000402860 R15: 0000000000000000
[   29.828243] 
[   29.828598] Allocated by task 2982:
[   29.829373]  save_stack_trace+0x16/0x20
[   29.830207]  save_stack+0x43/0xd0
[   29.830928]  kasan_kmalloc+0xad/0xe0
[   29.831617]  __kmalloc_node+0x47/0x70
[   29.832353]  kvmalloc_node+0x64/0xd0
[   29.833126]  alloc_netdev_mqs+0x16e/0xed0
[   29.833950]  __tun_chr_ioctl+0x12be/0x3d20
[   29.834806]  tun_chr_ioctl+0x2a/0x40
[   29.837538]  do_vfs_ioctl+0x1b1/0x1530
[   29.838797]  SyS_ioctl+0x8f/0xc0
[   29.840426]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.841823] 
[   29.842790] Freed by task 2982:
[   29.843755]  save_stack_trace+0x16/0x20
[   29.846871]  save_stack+0x43/0xd0
[   29.847851]  kasan_slab_free+0x71/0xc0
[   29.848219]  kfree+0xca/0x250
[   29.848544]  kvfree+0x36/0x60
[   29.848876]  free_netdev+0x2cf/0x360
[   29.849225]  __tun_chr_ioctl+0x2cf6/0x3d20
[   29.849674]  tun_chr_ioctl+0x2a/0x40
[   29.850020]  do_vfs_ioctl+0x1b1/0x1530
[   29.850835]  SyS_ioctl+0x8f/0xc0
[   29.851157]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.853653] 
[   29.853830] The buggy address belongs to the object at ffff88003c3503c0
[   29.853830]  which belongs to the cache kmalloc-16384 of size 16384
[   29.857656] The buggy address is located 13312 bytes inside of
[   29.857656]  16384-byte region [ffff88003c3503c0, ffff88003c3543c0)
[   29.858792] The buggy address belongs to the page:
[   29.859192] page:ffffea0000f0d400 count:1 mapcount:0 mapping:ffff88003c3503c0 index:0x0 compound_mapcount: 0
[   29.860145] flags: 0x100000000008100(slab|head)
[   29.860582] raw: 0100000000008100 ffff88003c3503c0 0000000000000000 0000000100000001
[   29.861322] raw: ffffea0000f73220 ffff88003e801c50 ffff88003e802200 0000000000000000
[   29.862054] page dumped because: kasan: bad access detected
[   29.862586] 
[   29.862744] Memory state around the buggy address:
[   29.863213]  ffff88003c353680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.863902]  ffff88003c353700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.864591] >ffff88003c353780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.865279]                                            ^
[   29.865783]  ffff88003c353800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.866478]  ffff88003c353880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.867161] ==================================================================
[   29.867832] Disabling lock debugging due to kernel taint
[   29.868351] Kernel panic - not syncing: panic_on_warn set ...
[   29.868351] 
[   29.869043] CPU: 0 PID: 2982 Comm: syzkaller242605 Tainted: G    B           4.13.0-next-20170907+ #17
[   29.869924] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   29.872459] Call Trace:
[   29.872701]  dump_stack+0x194/0x257
[   29.873041]  ? arch_local_irq_restore+0x53/0x53
[   29.873464]  ? vprintk_default+0x28/0x30
[   29.873837]  ? detach_if_pending+0x530/0x610
[   29.874336]  panic+0x1e4/0x417
[   29.874691]  ? __warn+0x1d9/0x1d9
[   29.875110]  ? detach_if_pending+0x557/0x610
[   29.875564]  kasan_end_report+0x50/0x50
[   29.875992]  kasan_report+0x137/0x340
[   29.876398]  __asan_report_store8_noabort+0x17/0x20
[   29.876906]  detach_if_pending+0x557/0x610
[   29.877340]  ? trace_raw_output_tick_stop+0x130/0x130
[   29.877768]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   29.878389]  ? lock_timer_base+0x1a3/0x2b0
[   29.878735]  ? lock_timer_base+0x1eb/0x2b0
[   29.879249]  ? __internal_add_timer+0x2d0/0x2d0
[   29.879725]  ? trace_hardirqs_on+0xd/0x10
[   29.880201]  try_to_del_timer_sync+0xa2/0x120
[   29.880660]  ? del_timer+0x130/0x130
[   29.881065]  ? del_timer_sync+0xeb/0x240
[   29.881500]  del_timer_sync+0x18a/0x240
[   29.881903]  tun_free_netdev+0x105/0x1b0
[   29.882379]  ? tun_xdp+0x410/0x410
[   29.882742]  ? cpumask_next+0x24/0x30
[   29.883184]  ? netdev_refcnt_read+0xed/0x150
[   29.883637]  ? tun_xdp+0x410/0x410
[   29.884007]  netdev_run_todo+0x870/0xca0
[   29.884512]  ? do_group_exit+0x149/0x400
[   29.884930]  ? register_netdev+0x30/0x30
[   29.885399]  ? lock_downgrade+0x990/0x990
[   29.885824]  ? trace_hardirqs_on+0xd/0x10
[   29.886315]  ? refcount_sub_and_test+0x115/0x1b0
[   29.886807]  ? refcount_inc+0x50/0x50
[   29.887225]  ? refcount_inc+0x50/0x50
[   29.887618]  ? sk_destruct+0x4c/0x80
[   29.887995]  ? __sk_free+0x5c/0x230
[   29.888444]  ? sk_free+0x2f/0x40
[   29.888787]  ? __tun_detach+0x176/0x1390
[   29.889254]  ? tun_attach+0xf90/0xf90
[   29.889649]  ? do_raw_spin_trylock+0x190/0x190
[   29.890125]  ? locks_remove_file+0x3fa/0x5a0
[   29.890627]  ? fcntl_setlk+0x10d0/0x10d0
[   29.891040]  ? __fsnotify_parent+0xb4/0x3a0
[   29.891541]  ? fsnotify+0x1af0/0x1af0
[   29.891933]  ? __tun_detach+0x1390/0x1390
[   29.892414]  ? __tun_detach+0x1390/0x1390
[   29.892840]  rtnl_unlock+0xe/0x10
[   29.893187]  tun_chr_close+0x49/0x60
[   29.893564]  __fput+0x333/0x7f0
[   29.893904]  ? fput+0x140/0x140
[   29.894298]  ? check_same_owner+0x320/0x320
[   29.894818]  ? _raw_spin_unlock_irq+0x27/0x70
[   29.895491]  ____fput+0x15/0x20
[   29.895990]  task_work_run+0x199/0x270
[   29.896598]  ? task_work_cancel+0x210/0x210
[   29.897257]  ? _raw_spin_unlock+0x22/0x30
[   29.897867]  ? switch_task_namespaces+0x87/0xc0
[   29.898599]  do_exit+0xa52/0x1b40
[   29.899151]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   29.900196]  ? check_noncircular+0x20/0x20
[   29.900830]  ? __handle_mm_fault+0x587/0x39c0
[   29.901509]  ? mm_update_next_owner+0x930/0x930
[   29.902231]  ? __pmd_alloc+0x4e0/0x4e0
[   29.902597]  ? find_held_lock+0x39/0x1d0
[   29.902978]  ? lock_downgrade+0x990/0x990
[   29.903367]  ? handle_mm_fault+0x410/0x8d0
[   29.903756]  ? down_read_trylock+0xdb/0x170
[   29.904154]  ? __do_page_fault+0x2b8/0xb60
[   29.904547]  ? __handle_mm_fault+0x39c0/0x39c0
[   29.904984]  ? vmacache_find+0x61/0x270
[   29.905355]  ? up_read+0x1a/0x40
[   29.905670]  ? __do_page_fault+0x35b/0xb60
[   29.906075]  ? do_page_fault+0xee/0x720
[   29.906444]  ? __do_page_fault+0xb60/0xb60
[   29.906836]  ? putname+0xf3/0x130
[   29.907158]  do_group_exit+0x149/0x400
[   29.907520]  ? lockdep_sys_exit+0x47/0xf0
[   29.907906]  ? SyS_exit+0x30/0x30
[   29.908231]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   29.908693]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   29.909133]  SyS_exit_group+0x1d/0x20
[   29.909488]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   29.909930] RIP: 0033:0x438d69
[   29.910232] RSP: 002b:00007fff191fdc18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   29.910935] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000438d69
[   29.911611] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   29.912280] RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7
[   29.912947] R10: ffffffffffffffcc R11: 0000000000000246 R12: 0000000000000001
[   29.913626] R13: 00000000006cd300 R14: 0000000000402860 R15: 0000000000000000