[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.028702] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.433429] random: sshd: uninitialized urandom read (32 bytes read) [ 23.820568] random: sshd: uninitialized urandom read (32 bytes read) [ 24.710560] random: sshd: uninitialized urandom read (32 bytes read) [ 24.857511] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.60' (ECDSA) to the list of known hosts. [ 30.260912] random: sshd: uninitialized urandom read (32 bytes read) 2018/07/09 08:16:18 parsed 1 programs [ 31.937423] random: cc1: uninitialized urandom read (8 bytes read) 2018/07/09 08:16:20 executed programs: 0 [ 33.072163] IPVS: ftp: loaded support on port[0] = 21 [ 33.264755] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.271228] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.278661] device bridge_slave_0 entered promiscuous mode [ 33.294441] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.300810] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.307844] device bridge_slave_1 entered promiscuous mode [ 33.323476] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 33.339266] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 33.379657] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 33.397720] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 33.463637] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 33.470851] team0: Port device team_slave_0 added [ 33.484803] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 33.491900] team0: Port device team_slave_1 added [ 33.506993] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 33.524409] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 33.541513] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 33.558376] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.673529] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.679997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.686946] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.693308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.105989] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 34.112150] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.155308] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 34.199170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.207330] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 34.247971] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.499733] BUG: unable to handle kernel paging request at ffffebe000000008 [ 34.506870] PGD 0 P4D 0 [ 34.509553] Oops: 0000 [#1] SMP KASAN [ 34.513337] CPU: 1 PID: 4809 Comm: syz-executor0 Not tainted 4.18.0-rc3+ #40 [ 34.521460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.530806] RIP: 0010:kfree+0xa0/0x260 [ 34.534678] Code: 82 cb 01 00 00 48 ba 00 00 00 80 ff 77 00 00 48 01 c2 48 89 df 48 b8 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 c2 <48> 8b 42 08 a8 01 48 8d 48 ff 48 0f 45 d1 4c 8b 6a 18 49 63 75 74 [ 34.553801] RSP: 0018:ffff8801d24974e0 EFLAGS: 00010086 [ 34.559147] RAX: ffffea0000000000 RBX: 0000000000000286 RCX: 0000000000000000 [ 34.566397] RDX: ffffebe000000000 RSI: 0000000000000000 RDI: 0000000000000286 [ 34.573648] RBP: ffff8801d2497500 R08: ffffed003b5e46d7 R09: ffffed003b5e46d6 [ 34.580901] R10: ffffed003b5e46d6 R11: ffff8801daf236b3 R12: 0000000000000286 [ 34.588158] R13: ffffffff8766d6c3 R14: ffff8801d2497650 R15: ffff8801cfc89680 [ 34.595419] FS: 0000000000000000(0000) GS:ffff8801daf00000(0063) knlGS:0000000008670900 [ 34.603625] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 34.609487] CR2: ffffebe000000008 CR3: 00000001adf17000 CR4: 00000000001406e0 [ 34.616745] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.624012] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.631266] Call Trace: [ 34.633839] p9_client_create+0xf43/0x16c9 [ 34.638054] ? p9_client_read+0xc60/0xc60 [ 34.642180] ? find_held_lock+0x36/0x1c0 [ 34.646226] ? __lockdep_init_map+0x105/0x590 [ 34.650711] ? kasan_check_write+0x14/0x20 [ 34.655035] ? __init_rwsem+0x1cc/0x2a0 [ 34.659005] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 34.664012] ? rcu_read_lock_sched_held+0x108/0x120 [ 34.669028] ? __kmalloc_track_caller+0x5f5/0x760 [ 34.673861] ? save_stack+0xa9/0xd0 [ 34.677485] ? save_stack+0x43/0xd0 [ 34.681091] ? kasan_kmalloc+0xc4/0xe0 [ 34.684963] ? memcpy+0x45/0x50 [ 34.688226] v9fs_session_init+0x21a/0x1a80 [ 34.692531] ? find_held_lock+0x36/0x1c0 [ 34.696574] ? v9fs_show_options+0x7e0/0x7e0 [ 34.700975] ? kasan_check_read+0x11/0x20 [ 34.705102] ? rcu_is_watching+0x8c/0x150 [ 34.709227] ? rcu_pm_notify+0xc0/0xc0 [ 34.713119] ? rcu_pm_notify+0xc0/0xc0 [ 34.717012] ? v9fs_mount+0x61/0x900 [ 34.720723] ? rcu_read_lock_sched_held+0x108/0x120 [ 34.725733] ? kmem_cache_alloc_trace+0x616/0x780 [ 34.730569] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 34.736101] v9fs_mount+0x7c/0x900 [ 34.739635] mount_fs+0xae/0x328 [ 34.742985] vfs_kern_mount.part.34+0xdc/0x4e0 [ 34.747566] ? may_umount+0xb0/0xb0 [ 34.751175] ? _raw_read_unlock+0x22/0x30 [ 34.755310] ? __get_fs_type+0x97/0xc0 [ 34.759181] do_mount+0x581/0x30e0 [ 34.762702] ? copy_mount_string+0x40/0x40 [ 34.766922] ? copy_mount_options+0x5f/0x380 [ 34.771321] ? rcu_read_lock_sched_held+0x108/0x120 [ 34.776329] ? kmem_cache_alloc_trace+0x616/0x780 [ 34.781162] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 34.786697] ? _copy_from_user+0xdf/0x150 [ 34.790832] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 34.796358] ? copy_mount_options+0x285/0x380 [ 34.800848] __ia32_compat_sys_mount+0x5d5/0x860 [ 34.805585] do_fast_syscall_32+0x34d/0xfb2 [ 34.809889] ? do_int80_syscall_32+0x890/0x890 [ 34.814450] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 34.819198] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 34.824717] ? syscall_return_slowpath+0x31d/0x5e0 [ 34.829630] ? sysret32_from_system_call+0x5/0x46 [ 34.834454] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 34.839284] entry_SYSENTER_compat+0x70/0x7f [ 34.843672] RIP: 0023:0xf7fbbcb9 [ 34.847016] Code: 55 08 8b 88 64 cd ff ff 8b 98 68 cd ff ff 89 c8 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 1c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 34.866160] RSP: 002b:00000000fff6832c EFLAGS: 00000286 ORIG_RAX: 0000000000000015 [ 34.873870] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000020000140 [ 34.881127] RDX: 0000000020000180 RSI: 0000000000000000 RDI: 0000000020000200 [ 34.888385] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 34.895636] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 34.902887] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 34.910136] Modules linked in: [ 34.913310] Dumping ftrace buffer: [ 34.916825] (ftrace buffer empty) [ 34.920515] CR2: ffffebe000000008 [ 34.924557] ---[ end trace d5d78806d7b18386 ]--- [ 34.929304] RIP: 0010:kfree+0xa0/0x260 [ 34.933175] Code: 82 cb 01 00 00 48 ba 00 00 00 80 ff 77 00 00 48 01 c2 48 89 df 48 b8 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 c2 <48> 8b 42 08 a8 01 48 8d 48 ff 48 0f 45 d1 4c 8b 6a 18 49 63 75 74 [ 34.952321] RSP: 0018:ffff8801d24974e0 EFLAGS: 00010086 [ 34.957664] RAX: ffffea0000000000 RBX: 0000000000000286 RCX: 0000000000000000 [ 34.964933] RDX: ffffebe000000000 RSI: 0000000000000000 RDI: 0000000000000286 [ 34.972185] RBP: ffff8801d2497500 R08: ffffed003b5e46d7 R09: ffffed003b5e46d6 [ 34.979532] R10: ffffed003b5e46d6 R11: ffff8801daf236b3 R12: 0000000000000286 [ 34.986794] R13: ffffffff8766d6c3 R14: ffff8801d2497650 R15: ffff8801cfc89680 [ 34.994048] FS: 0000000000000000(0000) GS:ffff8801daf00000(0063) knlGS:0000000008670900 [ 35.002253] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 35.008120] CR2: ffffebe000000008 CR3: 00000001adf17000 CR4: 00000000001406e0 [ 35.015372] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.022618] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.029864] Kernel panic - not syncing: Fatal exception [ 35.035658] Dumping ftrace buffer: [ 35.039180] (ftrace buffer empty) [ 35.042863] Kernel Offset: disabled [ 35.046466] Rebooting in 86400 seconds..