Warning: Permanently added 'ci-upstream-next-kasan-gce-5,10.128.15.217' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
[   44.406255] ==================================================================
[   44.413672] BUG: KASAN: use-after-free in detach_if_pending+0x557/0x610
[   44.420394] Write of size 8 at addr ffff8801cd90b780 by task syzkaller143220/2984
[   44.427980] 
[   44.429579] CPU: 0 PID: 2984 Comm: syzkaller143220 Not tainted 4.13.0-next-20170905+ #15
[   44.437773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   44.447095] Call Trace:
[   44.449654]  dump_stack+0x194/0x257
[   44.453255]  ? arch_local_irq_restore+0x53/0x53
[   44.457893]  ? show_regs_print_info+0x65/0x65
[   44.462364]  ? lock_timer_base+0x1a3/0x2b0
[   44.466571]  ? detach_if_pending+0x557/0x610
[   44.470949]  print_address_description+0x73/0x250
[   44.475760]  ? detach_if_pending+0x557/0x610
[   44.480140]  kasan_report+0x24e/0x340
[   44.483913]  __asan_report_store8_noabort+0x17/0x20
[   44.488953]  detach_if_pending+0x557/0x610
[   44.493163]  ? trace_raw_output_tick_stop+0x130/0x130
[   44.498323]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   44.502961]  ? lock_timer_base+0x1a3/0x2b0
[   44.507165]  ? lock_timer_base+0x1eb/0x2b0
[   44.511376]  ? __internal_add_timer+0x2d0/0x2d0
[   44.516016]  ? trace_hardirqs_on+0xd/0x10
[   44.520145]  try_to_del_timer_sync+0xa2/0x120
[   44.524613]  ? del_timer+0x130/0x130
[   44.528299]  ? del_timer_sync+0xeb/0x240
[   44.532339]  del_timer_sync+0x18a/0x240
[   44.536287]  tun_free_netdev+0x105/0x1b0
[   44.540319]  ? tun_xdp+0x410/0x410
[   44.543827]  ? cpumask_next+0x24/0x30
[   44.547599]  ? netdev_refcnt_read+0xed/0x150
[   44.551980]  ? tun_xdp+0x410/0x410
[   44.555491]  netdev_run_todo+0x870/0xca0
[   44.559521]  ? do_group_exit+0x149/0x400
[   44.563559]  ? register_netdev+0x30/0x30
[   44.567595]  ? lock_downgrade+0x990/0x990
[   44.571712]  ? trace_hardirqs_on+0xd/0x10
[   44.575847]  ? refcount_sub_and_test+0x115/0x1b0
[   44.580574]  ? refcount_inc+0x50/0x50
[   44.584343]  ? refcount_inc+0x50/0x50
[   44.588122]  ? sk_destruct+0x4c/0x80
[   44.591810]  ? __sk_free+0x5c/0x230
[   44.595408]  ? sk_free+0x2f/0x40
[   44.598745]  ? __tun_detach+0x176/0x1390
[   44.602788]  ? tun_attach+0xf90/0xf90
[   44.606564]  ? do_raw_spin_trylock+0x190/0x190
[   44.611117]  ? locks_remove_file+0x3fa/0x5a0
[   44.615498]  ? fcntl_setlk+0x10d0/0x10d0
[   44.619531]  ? __fsnotify_parent+0xb4/0x3a0
[   44.623825]  ? fsnotify+0x1af0/0x1af0
[   44.627598]  ? __tun_detach+0x1390/0x1390
[   44.631719]  ? __tun_detach+0x1390/0x1390
[   44.635839]  rtnl_unlock+0xe/0x10
[   44.639260]  tun_chr_close+0x49/0x60
[   44.642943]  __fput+0x333/0x7f0
[   44.646201]  ? fput+0x140/0x140
[   44.649452]  ? check_same_owner+0x320/0x320
[   44.653744]  ? _raw_spin_unlock_irq+0x27/0x70
[   44.658217]  ____fput+0x15/0x20
[   44.661467]  task_work_run+0x199/0x270
[   44.665328]  ? task_work_cancel+0x210/0x210
[   44.669618]  ? _raw_spin_unlock+0x22/0x30
[   44.673739]  ? switch_task_namespaces+0x87/0xc0
[   44.678392]  do_exit+0xa52/0x1b40
[   44.681816]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   44.686802]  ? check_noncircular+0x20/0x20
[   44.691015]  ? mm_update_next_owner+0x930/0x930
[   44.695654]  ? __pmd_alloc+0x4e0/0x4e0
[   44.699521]  ? find_held_lock+0x39/0x1d0
[   44.703565]  ? lock_downgrade+0x990/0x990
[   44.707707]  ? handle_mm_fault+0x4a2/0x860
[   44.711911]  ? down_read_trylock+0xdb/0x170
[   44.716205]  ? __handle_mm_fault+0x39c0/0x39c0
[   44.720757]  ? vmacache_find+0x61/0x270
[   44.724724]  ? up_read+0x1a/0x40
[   44.728062]  ? __do_page_fault+0x35b/0xb60
[   44.732267]  ? do_vfs_ioctl+0x492/0x1530
[   44.736309]  ? do_page_fault+0xee/0x720
[   44.740256]  ? __do_page_fault+0xb60/0xb60
[   44.744463]  ? putname+0xf3/0x130
[   44.747896]  do_group_exit+0x149/0x400
[   44.751752]  ? lockdep_sys_exit+0x47/0xf0
[   44.755868]  ? SyS_exit+0x30/0x30
[   44.759291]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   44.764287]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   44.769016]  SyS_exit_group+0x1d/0x20
[   44.772790]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.777518] RIP: 0033:0x4435b8
[   44.780693] RSP: 002b:00007ffd6f702538 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   44.788375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004435b8
[   44.795613] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   44.802851] RBP: 0000000000000082 R08: 00000000000000e7 R09: ffffffffffffffd0
[   44.810091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[   44.817330] R13: 00000000006d6180 R14: 0000000000000000 R15: 0000000000000000
[   44.824588] 
[   44.826186] Allocated by task 2984:
[   44.829787]  save_stack_trace+0x16/0x20
[   44.833731]  save_stack+0x43/0xd0
[   44.837152]  kasan_kmalloc+0xad/0xe0
[   44.840836]  __kmalloc_node+0x47/0x70
[   44.844606]  kvmalloc_node+0x64/0xd0
[   44.848294]  alloc_netdev_mqs+0x16e/0xed0
[   44.852420]  __tun_chr_ioctl+0x12be/0x3d20
[   44.856629]  tun_chr_ioctl+0x2a/0x40
[   44.860314]  do_vfs_ioctl+0x1b1/0x1530
[   44.864168]  SyS_ioctl+0x8f/0xc0
[   44.867503]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.872224] 
[   44.873821] Freed by task 2984:
[   44.877068]  save_stack_trace+0x16/0x20
[   44.881010]  save_stack+0x43/0xd0
[   44.884432]  kasan_slab_free+0x71/0xc0
[   44.888288]  kfree+0xca/0x250
[   44.891364]  kvfree+0x36/0x60
[   44.894439]  free_netdev+0x2cf/0x360
[   44.898120]  __tun_chr_ioctl+0x2cf6/0x3d20
[   44.902320]  tun_chr_ioctl+0x2a/0x40
[   44.906010]  do_vfs_ioctl+0x1b1/0x1530
[   44.909877]  SyS_ioctl+0x8f/0xc0
[   44.913210]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   44.917931] 
[   44.919529] The buggy address belongs to the object at ffff8801cd908380
[   44.919529]  which belongs to the cache kmalloc-16384 of size 16384
[   44.932502] The buggy address is located 13312 bytes inside of
[   44.932502]  16384-byte region [ffff8801cd908380, ffff8801cd90c380)
[   44.944688] The buggy address belongs to the page:
[   44.949586] page:ffffea0007364200 count:1 mapcount:0 mapping:ffff8801cd908380 index:0x0 compound_mapcount: 0
[   44.959527] flags: 0x200000000008100(slab|head)
[   44.964166] raw: 0200000000008100 ffff8801cd908380 0000000000000000 0000000100000001
[   44.972024] raw: ffffea000735c420 ffff8801dac01c50 ffff8801dac02200 0000000000000000
[   44.979873] page dumped because: kasan: bad access detected
[   44.985549] 
[   44.987151] Memory state around the buggy address:
[   44.992050]  ffff8801cd90b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.999379]  ffff8801cd90b700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.006706] >ffff8801cd90b780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.014035]                    ^
[   45.017372]  ffff8801cd90b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.024711]  ffff8801cd90b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   45.032036] ==================================================================
[   45.039365] Disabling lock debugging due to kernel taint
[   45.044785] Kernel panic - not syncing: panic_on_warn set ...
[   45.044785] 
[   45.052132] CPU: 0 PID: 2984 Comm: syzkaller143220 Tainted: G    B           4.13.0-next-20170905+ #15
[   45.061537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.070854] Call Trace:
[   45.073406]  dump_stack+0x194/0x257
[   45.077015]  ? arch_local_irq_restore+0x53/0x53
[   45.081648]  ? vprintk_default+0x28/0x30
[   45.085680]  ? detach_if_pending+0x530/0x610
[   45.090056]  panic+0x1e4/0x417
[   45.093213]  ? __warn+0x1d9/0x1d9
[   45.096637]  ? detach_if_pending+0x557/0x610
[   45.101007]  kasan_end_report+0x50/0x50
[   45.104947]  kasan_report+0x137/0x340
[   45.108712]  __asan_report_store8_noabort+0x17/0x20
[   45.113695]  detach_if_pending+0x557/0x610
[   45.117896]  ? trace_raw_output_tick_stop+0x130/0x130
[   45.123065]  ? _raw_spin_lock_irqsave+0x9e/0xc0
[   45.127706]  ? lock_timer_base+0x1a3/0x2b0
[   45.131905]  ? lock_timer_base+0x1eb/0x2b0
[   45.136103]  ? __internal_add_timer+0x2d0/0x2d0
[   45.140746]  ? trace_hardirqs_on+0xd/0x10
[   45.144861]  try_to_del_timer_sync+0xa2/0x120
[   45.149321]  ? del_timer+0x130/0x130
[   45.153029]  ? del_timer_sync+0xeb/0x240
[   45.157073]  del_timer_sync+0x18a/0x240
[   45.161011]  tun_free_netdev+0x105/0x1b0
[   45.165036]  ? tun_xdp+0x410/0x410
[   45.168540]  ? cpumask_next+0x24/0x30
[   45.172309]  ? netdev_refcnt_read+0xed/0x150
[   45.176684]  ? tun_xdp+0x410/0x410
[   45.180189]  netdev_run_todo+0x870/0xca0
[   45.184214]  ? do_group_exit+0x149/0x400
[   45.188240]  ? register_netdev+0x30/0x30
[   45.192265]  ? lock_downgrade+0x990/0x990
[   45.196376]  ? trace_hardirqs_on+0xd/0x10
[   45.200495]  ? refcount_sub_and_test+0x115/0x1b0
[   45.205213]  ? refcount_inc+0x50/0x50
[   45.208977]  ? refcount_inc+0x50/0x50
[   45.212746]  ? sk_destruct+0x4c/0x80
[   45.216433]  ? __sk_free+0x5c/0x230
[   45.220032]  ? sk_free+0x2f/0x40
[   45.223449]  ? __tun_detach+0x176/0x1390
[   45.227491]  ? tun_attach+0xf90/0xf90
[   45.231257]  ? do_raw_spin_trylock+0x190/0x190
[   45.235804]  ? locks_remove_file+0x3fa/0x5a0
[   45.240175]  ? fcntl_setlk+0x10d0/0x10d0
[   45.244211]  ? __fsnotify_parent+0xb4/0x3a0
[   45.248499]  ? fsnotify+0x1af0/0x1af0
[   45.252266]  ? __tun_detach+0x1390/0x1390
[   45.256386]  ? __tun_detach+0x1390/0x1390
[   45.260500]  rtnl_unlock+0xe/0x10
[   45.263915]  tun_chr_close+0x49/0x60
[   45.267592]  __fput+0x333/0x7f0
[   45.270837]  ? fput+0x140/0x140
[   45.274081]  ? check_same_owner+0x320/0x320
[   45.278369]  ? _raw_spin_unlock_irq+0x27/0x70
[   45.282830]  ____fput+0x15/0x20
[   45.286075]  task_work_run+0x199/0x270
[   45.289926]  ? task_work_cancel+0x210/0x210
[   45.294211]  ? _raw_spin_unlock+0x22/0x30
[   45.298321]  ? switch_task_namespaces+0x87/0xc0
[   45.302962]  do_exit+0xa52/0x1b40
[   45.306387]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   45.311382]  ? check_noncircular+0x20/0x20
[   45.315585]  ? mm_update_next_owner+0x930/0x930
[   45.320216]  ? __pmd_alloc+0x4e0/0x4e0
[   45.324076]  ? find_held_lock+0x39/0x1d0
[   45.328106]  ? lock_downgrade+0x990/0x990
[   45.332231]  ? handle_mm_fault+0x4a2/0x860
[   45.336431]  ? down_read_trylock+0xdb/0x170
[   45.340715]  ? __handle_mm_fault+0x39c0/0x39c0
[   45.345261]  ? vmacache_find+0x61/0x270
[   45.349535]  ? up_read+0x1a/0x40
[   45.352871]  ? __do_page_fault+0x35b/0xb60
[   45.357072]  ? do_vfs_ioctl+0x492/0x1530
[   45.361101]  ? do_page_fault+0xee/0x720
[   45.365041]  ? __do_page_fault+0xb60/0xb60
[   45.369239]  ? putname+0xf3/0x130
[   45.372661]  do_group_exit+0x149/0x400
[   45.376514]  ? lockdep_sys_exit+0x47/0xf0
[   45.380626]  ? SyS_exit+0x30/0x30
[   45.384052]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   45.389034]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   45.393753]  SyS_exit_group+0x1d/0x20
[   45.397517]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.402235] RIP: 0033:0x4435b8