INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-1,10.128.0.19' (ECDSA) to the list of known hosts.
executing program
executing program
syzkaller login: [   53.752256] ==================================================================
[   53.759703] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0
[   53.766685] Write of size 8 at addr ffff8801ce163688 by task syzkaller808305/2981
[   53.774270] 
[   53.775872] CPU: 0 PID: 2981 Comm: syzkaller808305 Not tainted 4.14.0-rc4-mm1+ #16
[   53.783545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   53.792873] Call Trace:
[   53.795429]  dump_stack+0x194/0x257
[   53.799030]  ? arch_local_irq_restore+0x53/0x53
[   53.803668]  ? show_regs_print_info+0x65/0x65
[   53.808150]  ? __internal_add_timer+0x275/0x2d0
[   53.812791]  print_address_description+0x73/0x250
[   53.817602]  ? __internal_add_timer+0x275/0x2d0
[   53.822242]  kasan_report+0x25b/0x340
[   53.826018]  __asan_report_store8_noabort+0x17/0x20
[   53.831005]  __internal_add_timer+0x275/0x2d0
[   53.835474]  ? calc_wheel_index+0x200/0x200
[   53.839777]  mod_timer+0x622/0x15b0
[   53.843385]  ? mod_timer_pending+0x14e0/0x14e0
[   53.847940]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   53.852929]  ? trace_hardirqs_on+0xd/0x10
[   53.857053]  ? _crng_backtrack_protect+0xd9/0x130
[   53.861872]  ? __lock_is_held+0xbc/0x140
[   53.865907]  ? __lockdep_init_map+0xe4/0x650
[   53.870290]  ? lockdep_init_map+0x3d/0x70
[   53.874410]  ? rcu_read_lock_sched_held+0x108/0x120
[   53.879397]  ? init_timer_key+0x126/0x3b0
[   53.883519]  ? try_to_del_timer_sync+0x120/0x120
[   53.888248]  ? round_jiffies_up+0xce/0x100
[   53.892455]  ? __round_jiffies_up_relative+0x150/0x150
[   53.897704]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   53.902616]  __tun_chr_ioctl+0x1beb/0x3e40
[   53.906833]  ? tun_chr_read_iter+0x1e0/0x1e0
[   53.911210]  ? lock_downgrade+0x990/0x990
[   53.915351]  ? handle_mm_fault+0x410/0x8d0
[   53.919555]  ? __do_page_fault+0x31e/0xd60
[   53.923772]  ? check_same_owner+0x320/0x320
[   53.928064]  ? up_read+0x1a/0x40
[   53.931401]  ? __do_page_fault+0x3d6/0xd60
[   53.935610]  ? tun_chr_compat_ioctl+0x30/0x30
[   53.940077]  tun_chr_ioctl+0x2a/0x40
[   53.943761]  ? tun_chr_ioctl+0x2a/0x40
[   53.947621]  do_vfs_ioctl+0x1b1/0x1530
[   53.951484]  ? ioctl_preallocate+0x2b0/0x2b0
[   53.955867]  ? selinux_capable+0x40/0x40
[   53.959900]  ? putname+0xf3/0x130
[   53.963327]  ? do_sys_open+0x320/0x6d0
[   53.967198]  ? security_file_ioctl+0x89/0xb0
[   53.971582]  SyS_ioctl+0x8f/0xc0
[   53.974925]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   53.979650] RIP: 0033:0x443db9
[   53.982810] RSP: 002b:00007ffccf43a5d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   53.990491] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   53.997731] RDX: 00000000201e8fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   54.004971] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   54.012211] R10: 0000000000000000 R11: 0000000000000206 R12: e25d67edc2cfa056
[   54.019451] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000
[   54.026710] 
[   54.028309] Allocated by task 2981:
[   54.031907]  save_stack+0x43/0xd0
[   54.035331]  kasan_kmalloc+0xad/0xe0
[   54.039013]  __kmalloc_node+0x47/0x70
[   54.042785]  kvmalloc_node+0x64/0xd0
[   54.046468]  alloc_netdev_mqs+0x16d/0xed0
[   54.050584]  __tun_chr_ioctl+0x1386/0x3e40
[   54.054789]  tun_chr_ioctl+0x2a/0x40
[   54.058471]  do_vfs_ioctl+0x1b1/0x1530
[   54.062327]  SyS_ioctl+0x8f/0xc0
[   54.065662]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   54.070385] 
[   54.071983] Freed by task 2981:
[   54.075232]  save_stack+0x43/0xd0
[   54.078654]  kasan_slab_free+0x71/0xc0
[   54.082509]  kfree+0xca/0x250
[   54.085583]  kvfree+0x36/0x60
[   54.088662]  free_netdev+0x2cf/0x360
[   54.092344]  __tun_chr_ioctl+0x2df6/0x3e40
[   54.096546]  tun_chr_ioctl+0x2a/0x40
[   54.100229]  do_vfs_ioctl+0x1b1/0x1530
[   54.104085]  SyS_ioctl+0x8f/0xc0
[   54.107421]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   54.112144] 
[   54.113741] The buggy address belongs to the object at ffff8801ce160280
[   54.113741]  which belongs to the cache kmalloc-16384 of size 16384
[   54.126711] The buggy address is located 13320 bytes inside of
[   54.126711]  16384-byte region [ffff8801ce160280, ffff8801ce164280)
[   54.138897] The buggy address belongs to the page:
[   54.143795] page:ffffea0007385800 count:1 mapcount:0 mapping:ffff8801ce160280 index:0x0 compound_mapcount: 0
[   54.153737] flags: 0x200000000008100(slab|head)
[   54.158376] raw: 0200000000008100 ffff8801ce160280 0000000000000000 0000000100000001
[   54.166227] raw: ffffea000756d620 ffffea0007383220 ffff8801dac02200 0000000000000000
[   54.174076] page dumped because: kasan: bad access detected
[   54.179753] 
[   54.181349] Memory state around the buggy address:
[   54.186245]  ffff8801ce163580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.193572]  ffff8801ce163600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.200900] >ffff8801ce163680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.208226]                       ^
[   54.211819]  ffff8801ce163700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.219148]  ffff8801ce163780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.226472] ==================================================================
[   54.233795] Disabling lock debugging due to kernel taint
[   54.239205] Kernel panic - not syncing: panic_on_warn set ...
[   54.239205] 
[   54.246532] CPU: 0 PID: 2981 Comm: syzkaller808305 Tainted: G    B            4.14.0-rc4-mm1+ #16
[   54.255502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   54.264819] Call Trace:
[   54.267371]  dump_stack+0x194/0x257
[   54.270965]  ? arch_local_irq_restore+0x53/0x53
[   54.275601]  ? vprintk_default+0x28/0x30
[   54.279627]  ? __internal_add_timer+0x1f0/0x2d0
[   54.284260]  panic+0x1e4/0x41c
[   54.287417]  ? refcount_error_report+0x214/0x214
[   54.292142]  ? __internal_add_timer+0x275/0x2d0
[   54.296776]  kasan_end_report+0x50/0x50
[   54.300712]  kasan_report+0x144/0x340
[   54.304478]  __asan_report_store8_noabort+0x17/0x20
[   54.309456]  __internal_add_timer+0x275/0x2d0
[   54.313915]  ? calc_wheel_index+0x200/0x200
[   54.318206]  mod_timer+0x622/0x15b0
[   54.321800]  ? mod_timer_pending+0x14e0/0x14e0
[   54.326348]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   54.331329]  ? trace_hardirqs_on+0xd/0x10
[   54.335445]  ? _crng_backtrack_protect+0xd9/0x130
[   54.340253]  ? __lock_is_held+0xbc/0x140
[   54.344281]  ? __lockdep_init_map+0xe4/0x650
[   54.348655]  ? lockdep_init_map+0x3d/0x70
[   54.352767]  ? rcu_read_lock_sched_held+0x108/0x120
[   54.357746]  ? init_timer_key+0x126/0x3b0
[   54.361874]  ? try_to_del_timer_sync+0x120/0x120
[   54.366595]  ? round_jiffies_up+0xce/0x100
[   54.370794]  ? __round_jiffies_up_relative+0x150/0x150
[   54.376035]  ? debug_lockdep_rcu_enabled+0x77/0x90
[   54.380934]  __tun_chr_ioctl+0x1beb/0x3e40
[   54.385138]  ? tun_chr_read_iter+0x1e0/0x1e0
[   54.389510]  ? lock_downgrade+0x990/0x990
[   54.393633]  ? handle_mm_fault+0x410/0x8d0
[   54.397831]  ? __do_page_fault+0x31e/0xd60
[   54.402039]  ? check_same_owner+0x320/0x320
[   54.406324]  ? up_read+0x1a/0x40
[   54.409653]  ? __do_page_fault+0x3d6/0xd60
[   54.413853]  ? tun_chr_compat_ioctl+0x30/0x30
[   54.418311]  tun_chr_ioctl+0x2a/0x40
[   54.421990]  ? tun_chr_ioctl+0x2a/0x40
[   54.425843]  do_vfs_ioctl+0x1b1/0x1530
[   54.429696]  ? ioctl_preallocate+0x2b0/0x2b0
[   54.434070]  ? selinux_capable+0x40/0x40
[   54.438102]  ? putname+0xf3/0x130
[   54.441520]  ? do_sys_open+0x320/0x6d0
[   54.445378]  ? security_file_ioctl+0x89/0xb0
[   54.449751]  SyS_ioctl+0x8f/0xc0
[   54.453089]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   54.457806] RIP: 0033:0x443db9
[   54.460962] RSP: 002b:00007ffccf43a5d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[   54.468632] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443db9
[   54.475867] RDX: 00000000201e8fd8 RSI: 00000000400454ca RDI: 0000000000000004
[   54.483102] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[   54.490335] R10: 0000000000000000 R11: 0000000000000206 R12: e25d67edc2cfa056
[   54.497570] R13: 74656e2f7665642f R14: 0000000000000000 R15: 0000000000000000