INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-7,10.128.15.213' (ECDSA) to the list of known hosts.
2017/10/18 08:45:27 parsed 1 programs
2017/10/18 08:45:27 executed programs: 0
syzkaller login: [   79.832298] ==================================================================
[   79.839727] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   79.846452] Write of size 8 at addr ffff8801ce27b700 by task syz-executor0/2999
[   79.853865] 
[   79.855469] CPU: 1 PID: 2999 Comm: syz-executor0 Not tainted 4.14.0-rc4-next-20171009+ #33
[   79.863836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   79.873161] Call Trace:
[   79.875725]  dump_stack+0x194/0x257
[   79.879326]  ? arch_local_irq_restore+0x53/0x53
[   79.883964]  ? show_regs_print_info+0x65/0x65
[   79.888431]  ? lock_timer_base+0x1a3/0x2b0
[   79.892636]  ? detach_if_pending+0x557/0x610
[   79.897016]  print_address_description+0x73/0x250
[   79.901827]  ? detach_if_pending+0x557/0x610
[   79.906205]  kasan_report+0x25b/0x340
[   79.909979]  __asan_report_store8_noabort+0x17/0x20
[   79.914962]  detach_if_pending+0x557/0x610
[   79.919168]  ? trace_raw_output_tick_stop+0x130/0x130
[   79.924330]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   79.928964]  ? lock_timer_base+0x1a3/0x2b0
[   79.933171]  ? lock_timer_base+0x1eb/0x2b0
[   79.937380]  ? __internal_add_timer+0x2d0/0x2d0
[   79.942018]  ? trace_hardirqs_on+0xd/0x10
[   79.946141]  try_to_del_timer_sync+0xa2/0x120
[   79.950604]  ? del_timer+0x130/0x130
[   79.954289]  ? del_timer_sync+0xeb/0x240
[   79.958326]  del_timer_sync+0x18a/0x240
[   79.962275]  tun_free_netdev+0x105/0x1b0
[   79.966306]  ? tun_xdp+0x410/0x410
[   79.969814]  ? cpumask_next+0x24/0x30
[   79.973591]  ? netdev_refcnt_read+0xed/0x150
[   79.977975]  netdev_run_todo+0x683/0xae0
[   79.982007]  ? tun_xdp+0x410/0x410
[   79.985517]  ? register_netdev+0x30/0x30
[   79.989549]  ? refcount_inc+0x50/0x50
[   79.993320]  ? refcount_inc+0x50/0x50
[   79.997094]  ? sk_destruct+0x4c/0x80
[   80.000954]  ? __sk_free+0x5c/0x230
[   80.004554]  ? sk_free+0x2f/0x40
[   80.007889]  ? __tun_detach+0x760/0x1570
[   80.011936]  ? dentry_free+0xd2/0x130
[   80.015713]  ? locks_remove_file+0x3fa/0x5a0
[   80.020093]  ? fcntl_setlk+0x10d0/0x10d0
[   80.024133]  ? fsnotify+0x1af0/0x1af0
[   80.027907]  ? __tun_detach+0x1570/0x1570
[   80.032024]  ? __tun_detach+0x1570/0x1570
[   80.036142]  rtnl_unlock+0xe/0x10
[   80.039566]  tun_chr_close+0x49/0x60
[   80.043251]  __fput+0x333/0x7f0
[   80.046507]  ? fput+0x140/0x140
[   80.049759]  ? check_same_owner+0x320/0x320
[   80.054050]  ? _raw_spin_unlock_irq+0x27/0x70
[   80.058524]  ____fput+0x15/0x20
[   80.061774]  task_work_run+0x199/0x270
[   80.065634]  ? task_work_cancel+0x210/0x210
[   80.069925]  ? _raw_spin_unlock+0x22/0x30
[   80.074042]  ? switch_task_namespaces+0x87/0xc0
[   80.078689]  do_exit+0x9c8/0x1b00
[   80.082118]  ? mm_update_next_owner+0x930/0x930
[   80.086760]  ? check_same_owner+0x320/0x320
[   80.091060]  ? find_held_lock+0x39/0x1d0
[   80.095106]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[   80.100446]  ? check_noncircular+0x20/0x20
[   80.104678]  ? find_held_lock+0x39/0x1d0
[   80.108722]  ? lock_downgrade+0x990/0x990
[   80.112841]  ? recalc_sigpending_tsk+0x117/0x150
[   80.117567]  ? recalc_sigpending+0x103/0x160
[   80.121945]  ? recalc_sigpending_tsk+0x150/0x150
[   80.126667]  ? get_signal+0x2b2/0x16d0
[   80.130537]  do_group_exit+0x149/0x400
[   80.134394]  ? __lock_is_held+0xbc/0x140
[   80.138427]  ? SyS_exit+0x30/0x30
[   80.141851]  ? _raw_spin_unlock_irq+0x27/0x70
[   80.146319]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   80.151312]  get_signal+0x73f/0x16d0
[   80.155004]  ? ptrace_notify+0x130/0x130
[   80.159042]  ? kvfree+0x3b/0x60
[   80.162305]  ? exit_robust_list+0x240/0x240
[   80.166609]  do_signal+0x94/0x1ee0
[   80.170117]  ? lock_release+0xd70/0xd70
[   80.174066]  ? __lock_is_held+0xbc/0x140
[   80.178101]  ? setup_sigcontext+0x7d0/0x7d0
[   80.182414]  ? check_same_owner+0x320/0x320
[   80.186709]  ? fget_raw+0x20/0x20
[   80.190138]  ? tun_chr_compat_ioctl+0x30/0x30
[   80.194602]  ? tun_chr_ioctl+0x2a/0x40
[   80.198461]  ? exit_to_usermode_loop+0x8c/0x310
[   80.203106]  exit_to_usermode_loop+0x214/0x310
[   80.207660]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   80.213171]  ? selinux_capable+0x40/0x40
[   80.217209]  syscall_return_slowpath+0x42f/0x510
[   80.221937]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   80.226923]  ? entry_SYSCALL_64_fastpath+0x91/0xbe
[   80.231821]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   80.236806]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   80.241536]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   80.246262] RIP: 0033:0x452779
[   80.249422] RSP: 002b:00007fac4d3f8ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   80.257110] RAX: fffffffffffffe00 RBX: 0000000000758040 RCX: 0000000000452779
[   80.264351] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000758040
[   80.271602] RBP: 0000000000758040 R08: 0000000000000000 R09: 0000000000758020
[   80.278839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   80.286076] R13: 0000000000a6f7ff R14: 00007fac4d3f99c0 R15: 0000000000000000
[   80.293333] 
[   80.294930] Allocated by task 2999:
[   80.298528]  save_stack+0x43/0xd0
[   80.301954]  kasan_kmalloc+0xad/0xe0
[   80.305637]  __kmalloc_node+0x47/0x70
[   80.309414]  kvmalloc_node+0x64/0xd0
[   80.313097]  alloc_netdev_mqs+0x16d/0xed0
[   80.317212]  __tun_chr_ioctl+0x1386/0x3e40
[   80.321416]  tun_chr_ioctl+0x2a/0x40
[   80.325100]  do_vfs_ioctl+0x1b1/0x1530
[   80.328956]  SyS_ioctl+0x8f/0xc0
[   80.332291]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   80.337011] 
[   80.338609] Freed by task 2999:
[   80.341857]  save_stack+0x43/0xd0
[   80.345279]  kasan_slab_free+0x71/0xc0
[   80.349133]  kfree+0xca/0x250
[   80.352207]  kvfree+0x36/0x60
[   80.355282]  free_netdev+0x2cf/0x360
[   80.358962]  __tun_chr_ioctl+0x2df6/0x3e40
[   80.363164]  tun_chr_ioctl+0x2a/0x40
[   80.366847]  do_vfs_ioctl+0x1b1/0x1530
[   80.370701]  SyS_ioctl+0x8f/0xc0
[   80.374035]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   80.378754] 
[   80.380353] The buggy address belongs to the object at ffff8801ce278300
[   80.380353]  which belongs to the cache kmalloc-16384 of size 16384
[   80.393321] The buggy address is located 13312 bytes inside of
[   80.393321]  16384-byte region [ffff8801ce278300, ffff8801ce27c300)
[   80.405508] The buggy address belongs to the page:
[   80.410406] page:ffffea0007389e00 count:1 mapcount:0 mapping:ffff8801ce278300 index:0x0 compound_mapcount: 0
[   80.420350] flags: 0x200000000008100(slab|head)
[   80.424992] raw: 0200000000008100 ffff8801ce278300 0000000000000000 0000000100000001
[   80.432839] raw: ffffea00073a0e20 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   80.440684] page dumped because: kasan: bad access detected
[   80.446360] 
[   80.447955] Memory state around the buggy address:
[   80.452851]  ffff8801ce27b600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.460176]  ffff8801ce27b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.467505] >ffff8801ce27b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.474830]                    ^
[   80.478162]  ffff8801ce27b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.485489]  ffff8801ce27b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.492814] ==================================================================
[   80.500138] Disabling lock debugging due to kernel taint
[   80.505547] Kernel panic - not syncing: panic_on_warn set ...
[   80.505547] 
[   80.512871] CPU: 1 PID: 2999 Comm: syz-executor0 Tainted: G    B            4.14.0-rc4-next-20171009+ #33
[   80.522541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   80.531858] Call Trace:
[   80.534418]  dump_stack+0x194/0x257
[   80.538009]  ? arch_local_irq_restore+0x53/0x53
[   80.542646]  ? vprintk_default+0x28/0x30
[   80.546675]  ? detach_if_pending+0x470/0x610
[   80.551049]  panic+0x1e4/0x41c
[   80.554208]  ? refcount_error_report+0x214/0x214
[   80.558933]  ? detach_if_pending+0x557/0x610
[   80.563306]  kasan_end_report+0x50/0x50
[   80.567244]  kasan_report+0x144/0x340
[   80.571011]  __asan_report_store8_noabort+0x17/0x20
[   80.575991]  detach_if_pending+0x557/0x610
[   80.580189]  ? trace_raw_output_tick_stop+0x130/0x130
[   80.585345]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   80.589975]  ? lock_timer_base+0x1a3/0x2b0
[   80.594171]  ? lock_timer_base+0x1eb/0x2b0
[   80.598369]  ? __internal_add_timer+0x2d0/0x2d0
[   80.603001]  ? trace_hardirqs_on+0xd/0x10
[   80.607117]  try_to_del_timer_sync+0xa2/0x120
[   80.611574]  ? del_timer+0x130/0x130
[   80.615251]  ? del_timer_sync+0xeb/0x240
[   80.619279]  del_timer_sync+0x18a/0x240
[   80.623223]  tun_free_netdev+0x105/0x1b0
[   80.627247]  ? tun_xdp+0x410/0x410
[   80.630749]  ? cpumask_next+0x24/0x30
[   80.634516]  ? netdev_refcnt_read+0xed/0x150
[   80.638892]  netdev_run_todo+0x683/0xae0
[   80.642916]  ? tun_xdp+0x410/0x410
[   80.646420]  ? register_netdev+0x30/0x30
[   80.650445]  ? refcount_inc+0x50/0x50
[   80.654209]  ? refcount_inc+0x50/0x50
[   80.657977]  ? sk_destruct+0x4c/0x80
[   80.661655]  ? __sk_free+0x5c/0x230
[   80.665245]  ? sk_free+0x2f/0x40
[   80.668578]  ? __tun_detach+0x760/0x1570
[   80.672610]  ? dentry_free+0xd2/0x130
[   80.676380]  ? locks_remove_file+0x3fa/0x5a0
[   80.680752]  ? fcntl_setlk+0x10d0/0x10d0
[   80.684781]  ? fsnotify+0x1af0/0x1af0
[   80.688547]  ? __tun_detach+0x1570/0x1570
[   80.692659]  ? __tun_detach+0x1570/0x1570
[   80.696769]  rtnl_unlock+0xe/0x10
[   80.700186]  tun_chr_close+0x49/0x60
[   80.703865]  __fput+0x333/0x7f0
[   80.707112]  ? fput+0x140/0x140
[   80.710357]  ? check_same_owner+0x320/0x320
[   80.714644]  ? _raw_spin_unlock_irq+0x27/0x70
[   80.719106]  ____fput+0x15/0x20
[   80.722350]  task_work_run+0x199/0x270
[   80.726202]  ? task_work_cancel+0x210/0x210
[   80.730486]  ? _raw_spin_unlock+0x22/0x30
[   80.734598]  ? switch_task_namespaces+0x87/0xc0
[   80.739233]  do_exit+0x9c8/0x1b00
[   80.742653]  ? mm_update_next_owner+0x930/0x930
[   80.747287]  ? check_same_owner+0x320/0x320
[   80.751578]  ? find_held_lock+0x39/0x1d0
[   80.755612]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[   80.760942]  ? check_noncircular+0x20/0x20
[   80.765154]  ? find_held_lock+0x39/0x1d0
[   80.769184]  ? lock_downgrade+0x990/0x990
[   80.773305]  ? recalc_sigpending_tsk+0x117/0x150
[   80.778026]  ? recalc_sigpending+0x103/0x160
[   80.782399]  ? recalc_sigpending_tsk+0x150/0x150
[   80.787117]  ? get_signal+0x2b2/0x16d0
[   80.790973]  do_group_exit+0x149/0x400
[   80.794830]  ? __lock_is_held+0xbc/0x140
[   80.798855]  ? SyS_exit+0x30/0x30
[   80.802282]  ? _raw_spin_unlock_irq+0x27/0x70
[   80.806745]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   80.811729]  get_signal+0x73f/0x16d0
[   80.815411]  ? ptrace_notify+0x130/0x130
[   80.819439]  ? kvfree+0x3b/0x60
[   80.822691]  ? exit_robust_list+0x240/0x240
[   80.826985]  do_signal+0x94/0x1ee0
[   80.830487]  ? lock_release+0xd70/0xd70