audit: type=1804 audit(2000000012.100:135): pid=796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir883749155/syzkaller.N7saTC/782/file0" dev="sda1" ino=17005 res=1
==================================================================
BUG: KASAN: use-after-free in pppol2tp_session_close+0xcd/0xe0 net/l2tp/l2tp_ppp.c:436
Read of size 8 at addr ffff888094331920 by task kworker/u4:5/7106

CPU: 1 PID: 7106 Comm: kworker/u4:5 Not tainted 4.14.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: l2tp l2tp_tunnel_del_work
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x142/0x197 lib/dump_stack.c:58
 print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
 pppol2tp_session_close+0xcd/0xe0 net/l2tp/l2tp_ppp.c:436
 l2tp_tunnel_closeall+0x243/0x380 net/l2tp/l2tp_core.c:1340
 l2tp_tunnel_del_work+0x64/0x410 net/l2tp/l2tp_core.c:1380
 process_one_work+0x863/0x1600 kernel/workqueue.c:2114
 worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
 kthread+0x319/0x430 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Allocated by task 32431:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x45/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc mm/kasan/kasan.c:551 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
 __do_kmalloc_node mm/slab.c:3682 [inline]
 __kmalloc_node+0x51/0x80 mm/slab.c:3689
 kmalloc_node include/linux/slab.h:530 [inline]
 kvmalloc_node+0x4e/0xe0 mm/util.c:397
 kvmalloc include/linux/mm.h:531 [inline]
 kvmalloc_array include/linux/mm.h:547 [inline]
 alloc_fdtable+0xcf/0x280 fs/file.c:120
 dup_fd+0x693/0xa40 fs/file.c:315
 copy_files kernel/fork.c:1304 [inline]
 copy_process.part.0+0x1b5a/0x6a70 kernel/fork.c:1759
 copy_process kernel/fork.c:1586 [inline]
 _do_fork+0x19e/0xce0 kernel/fork.c:2070
 SYSC_clone kernel/fork.c:2180 [inline]
 SyS_clone+0x37/0x50 kernel/fork.c:2174
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 32714:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x45/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kfree+0xcc/0x270 mm/slab.c:3815
 kvfree+0x4d/0x60 mm/util.c:416
 __free_fdtable+0x34/0x80 fs/file.c:36
 put_files_struct fs/file.c:425 [inline]
 put_files_struct+0x233/0x2d0 fs/file.c:418
 exit_files+0x83/0xb0 fs/file.c:450
 do_exit+0x790/0x2c80 kernel/exit.c:849
 do_group_exit+0x111/0x330 kernel/exit.c:951
 get_signal+0x381/0x1cd0 kernel/signal.c:2413
 do_signal+0x86/0x19a0 arch/x86/kernel/signal.c:814
 exit_to_usermode_loop+0x15c/0x220 arch/x86/entry/common.c:160
 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
 do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff888094331540
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 992 bytes inside of
 2048-byte region [ffff888094331540, ffff888094331d40)
The buggy address belongs to the page:
page:ffffea000250cc00 count:1 mapcount:0 mapping:ffff888094330440 index:0x0 compound_mapcount: 0
flags: 0xfffe0000008100(slab|head)
raw: 00fffe0000008100 ffff888094330440 0000000000000000 0000000100000003
raw: ffffea00027ee120 ffffea0001644e20 ffff8880aa800c40 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888094331800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888094331880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888094331900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff888094331980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888094331a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================