kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 5415 Comm: syz-executor5 Not tainted 4.14.0-rc1-next-20170918+ #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006975a680 task.stack: ffff88005f320000
RIP: 0010:__hlist_del include/linux/list.h:650 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:791 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1309 [inline]
RIP: 0010:__run_timers+0x619/0xb90 kernel/time/timer.c:1620
RSP: 0000:ffff88003ec07968 EFLAGS: 00010806
RAX: 1bd5a00000000041 RBX: ffff88003b18bc40 RCX: 1ffff10007d80f76
RDX: ffff88003ec07bb0 RSI: 0000000000000008 RDI: dead000000000208
RBP: ffff88003ec07c58 R08: ffff88003ec072b8 R09: ffff88003ec072b0
R10: ffff88003ec07228 R11: 1ffff1000d2eb763 R12: ffff88003b18bc48
R13: dffffc0000000000 R14: dead000000000200 R15: ffff88003ec07c30
FS:  0000000002576940(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9dea07e000 CR3: 000000006a2aa000 CR4: 00000000000026f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1646
 __do_softirq+0x2bb/0xbd0 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x177/0x710 arch/x86/kernel/apic/apic.c:1048
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577
 </IRQ>
RIP: 0033:0x449a38
RSP: 002b:0000000000a5f8d8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: 00000000007080dc RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000a5f8f0
RBP: 000000000000a31f R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000a5f960 R11: 0000000000000206 R12: 0000000000000014
R13: 00000000007080dc R14: 0000000000000001 R15: 00000000007080b0
Code: 4d 85 f6 4c 89 32 48 89 95 58 fd ff ff 42 c6 04 28 f8 74 26 e8 a9 33 10 00 49 8d 7e 08 48 8b 95 58 fd ff ff 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 b5 04 00 00 49 89 56 08 e8 83 33 10 00 4c 
RIP: __hlist_del include/linux/list.h:650 [inline] RSP: ffff88003ec07968
RIP: detach_timer kernel/time/timer.c:791 [inline] RSP: ffff88003ec07968
RIP: expire_timers kernel/time/timer.c:1309 [inline] RSP: ffff88003ec07968
RIP: __run_timers+0x619/0xb90 kernel/time/timer.c:1620 RSP: ffff88003ec07968
---[ end trace 00759f669cf8c2e9 ]---
Kernel panic - not syncing: Fatal exception in interrupt
BUG: KASAN: use-after-free in __collect_expired_timers include/linux/list.h:729 [inline]
BUG: KASAN: use-after-free in collect_expired_timers kernel/time/timer.c:1569 [inline]
BUG: KASAN: use-after-free in __run_timers+0xa2e/0xb90 kernel/time/timer.c:1616
Write of size 8 at addr ffff88002c583a48 by task syz-executor6/5354

CPU: 1 PID: 5354 Comm: syz-executor6 Tainted: G      D         4.14.0-rc1-next-20170918+ #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x24e/0x340 mm/kasan/report.c:409
 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:435
 __collect_expired_timers include/linux/list.h:729 [inline]
 collect_expired_timers kernel/time/timer.c:1569 [inline]
 __run_timers+0xa2e/0xb90 kernel/time/timer.c:1616
 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1646
 __do_softirq+0x2bb/0xbd0 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x177/0x710 arch/x86/kernel/apic/apic.c:1048
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]
RIP: 0010:lock_acquire+0x256/0x580 kernel/locking/lockdep.c:4005
RSP: 0018:ffff8800379c71d8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffff880037a4c2c0 RCX: 0000000000000000
RDX: 1ffffffff0b5933d RSI: ffffffff8195bdca RDI: 0000000000000282
RBP: ffff8800379c72d0 R08: ffff8800379c6c50 R09: ffff8800379c6c48
R10: ffff8800379c6bc0 R11: 1ffff10006f49aeb R12: 1ffff10006f38e41
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:316 [inline]
 follow_page_pte+0x32d/0x15c0 mm/gup.c:86
 follow_pmd_mask mm/gup.c:271 [inline]
 follow_pud_mask mm/gup.c:339 [inline]
 follow_p4d_mask mm/gup.c:365 [inline]
 follow_page_mask+0xb72/0x16a0 mm/gup.c:418
 __get_user_pages+0x404/0x15f0 mm/gup.c:696
 populate_vma_page_range+0x20e/0x2f0 mm/gup.c:1152
 __mm_populate+0x23a/0x450 mm/gup.c:1202
 mm_populate include/linux/mm.h:2160 [inline]
 vm_mmap_pgoff+0x241/0x280 mm/util.c:338
 SYSC_mmap_pgoff mm/mmap.c:1518 [inline]
 SyS_mmap_pgoff+0x23b/0x5f0 mm/mmap.c:1476
 SYSC_mmap arch/x86/kernel/sys_x86_64.c:99 [inline]
 SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:90
 do_syscall_64+0x26c/0x8c0 arch/x86/entry/common.c:287
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x4474f9
RSP: 002b:00007f7eb22adc08 EFLAGS: 00000282 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 00000000004474f9
RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000000020000000
RBP: 0000000000708000 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000282 R12: 00000000ffffffff
R13: 00000000000038b0 R14: 00000000006e6970 R15: 0000000000b36000

Allocated by task 4905:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
 __do_kmalloc_node mm/slab.c:3689 [inline]
 __kmalloc_node_track_caller+0x47/0x70 mm/slab.c:3703
 __kmalloc_reserve.isra.40+0x41/0xd0 net/core/skbuff.c:138
 __alloc_skb+0x13b/0x740 net/core/skbuff.c:206
 alloc_skb include/linux/skbuff.h:976 [inline]
 alloc_skb_with_frags+0x10d/0x710 net/core/skbuff.c:5137
 sock_alloc_send_pskb+0x7b4/0x9d0 net/core/sock.c:2073
 unix_dgram_sendmsg+0x52d/0x1600 net/unix/af_unix.c:1681
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 ___sys_sendmsg+0x75b/0x8a0 net/socket.c:2049
 __sys_sendmsg+0xe5/0x210 net/socket.c:2083
 SYSC_sendmsg net/socket.c:2094 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2090
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 4905:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xca/0x250 mm/slab.c:3820
 skb_free_head+0x74/0xb0 net/core/skbuff.c:554
 skb_release_data+0x58c/0x790 net/core/skbuff.c:574
 skb_release_all+0x4a/0x60 net/core/skbuff.c:631
 __kfree_skb net/core/skbuff.c:645 [inline]
 kfree_skb+0x15d/0x4c0 net/core/skbuff.c:663
 unix_release_sock+0x5dd/0xc10 net/unix/af_unix.c:560
 unix_release+0x44/0x90 net/unix/af_unix.c:837
 sock_release+0x8d/0x1e0 net/socket.c:597
 sock_close+0x16/0x20 net/socket.c:1126
 __fput+0x333/0x7f0 fs/file_table.c:210
 ____fput+0x15/0x20 fs/file_table.c:244
 task_work_run+0x199/0x270 kernel/task_work.c:112
 exit_task_work include/linux/task_work.h:21 [inline]
 do_exit+0xa52/0x1b40 kernel/exit.c:865
 do_group_exit+0x149/0x400 kernel/exit.c:968
 get_signal+0x7e8/0x17e0 kernel/signal.c:2334
 do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:808
 exit_to_usermode_loop+0x224/0x300 arch/x86/entry/common.c:158
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath+0x42f/0x500 arch/x86/entry/common.c:266
 entry_SYSCALL_64_fastpath+0xbc/0xbe

The buggy address belongs to the object at ffff88002c580640
 which belongs to the cache kmalloc-16384 of size 16384
The buggy address is located 13320 bytes inside of
 16384-byte region [ffff88002c580640, ffff88002c584640)
The buggy address belongs to the page:
page:ffffea0000b16000 count:1 mapcount:0 mapping:ffff88002c580640 index:0x0 compound_mapcount: 0
flags: 0x100000000008100(slab|head)
raw: 0100000000008100 ffff88002c580640 0000000000000000 0000000100000001
raw: ffffea0000b23220 ffffea0000757220 ffff88003e802200 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88002c583900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88002c583980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88002c583a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88002c583a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88002c583b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Shutting down cpus with NMI
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..