[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.381644] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.276398] random: sshd: uninitialized urandom read (32 bytes read) [ 21.720239] random: sshd: uninitialized urandom read (32 bytes read) [ 22.431589] random: sshd: uninitialized urandom read (32 bytes read) [ 22.588812] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.24' (ECDSA) to the list of known hosts. [ 28.041053] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 28.138311] ================================================================== [ 28.145750] BUG: KASAN: use-after-free in tls_sk_proto_close+0x8ab/0x9c0 [ 28.152569] Read of size 1 at addr ffff8801b4b4c258 by task syz-executor486/4512 [ 28.160081] [ 28.161704] CPU: 1 PID: 4512 Comm: syz-executor486 Not tainted 4.17.0-rc3+ #34 [ 28.169045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.178375] Call Trace: [ 28.180945] dump_stack+0x1b9/0x294 [ 28.184562] ? dump_stack_print_info.cold.2+0x52/0x52 [ 28.189729] ? printk+0x9e/0xba [ 28.192994] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 28.197740] ? kasan_check_write+0x14/0x20 [ 28.201963] print_address_description+0x6c/0x20b [ 28.206789] ? tls_sk_proto_close+0x8ab/0x9c0 [ 28.211265] kasan_report.cold.7+0x242/0x2fe [ 28.215655] __asan_report_load1_noabort+0x14/0x20 [ 28.220564] tls_sk_proto_close+0x8ab/0x9c0 [ 28.224864] ? unwind_get_return_address+0x61/0xa0 [ 28.229773] ? tcp_check_oom+0x520/0x520 [ 28.233815] ? tls_write_space+0x340/0x340 [ 28.238037] ? graph_lock+0x170/0x170 [ 28.241818] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 28.247335] ? ipv6_sock_ac_close+0x34e/0x480 [ 28.251812] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 28.257330] ? ipv6_sock_mc_close+0x161/0x1c0 [ 28.261802] ? ip_mc_drop_socket+0x20f/0x270 [ 28.266193] inet_release+0x104/0x1f0 [ 28.269973] inet6_release+0x50/0x70 [ 28.273669] sock_release+0x96/0x1b0 [ 28.277360] ? sock_alloc_file+0x4e0/0x4e0 [ 28.281571] sock_close+0x16/0x20 [ 28.285004] __fput+0x34d/0x890 [ 28.288285] ? fput+0x1a0/0x1a0 [ 28.291555] ? _raw_spin_unlock_irq+0x27/0x70 [ 28.296041] ____fput+0x15/0x20 [ 28.299305] task_work_run+0x1e4/0x290 [ 28.303172] ? task_work_cancel+0x240/0x240 [ 28.307475] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 28.312990] ? switch_task_namespaces+0xa2/0xd0 [ 28.317640] do_exit+0x1aee/0x2730 [ 28.321160] ? trace_hardirqs_off+0xd/0x10 [ 28.325375] ? mm_update_next_owner+0x980/0x980 [ 28.330039] ? mark_held_locks+0xc9/0x160 [ 28.334165] ? quarantine_put+0xeb/0x190 [ 28.338210] ? kfree+0x111/0x260 [ 28.341556] ? kzfree+0x28/0x30 [ 28.344817] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 28.349819] ? trace_hardirqs_on+0xd/0x10 [ 28.353950] ? kzfree+0x28/0x30 [ 28.357211] ? crypto_destroy_tfm+0x15d/0x300 [ 28.361692] ? graph_lock+0x170/0x170 [ 28.365473] ? graph_lock+0x170/0x170 [ 28.369257] ? find_held_lock+0x36/0x1c0 [ 28.373303] ? lock_downgrade+0x8e0/0x8e0 [ 28.377963] ? lock_downgrade+0x8e0/0x8e0 [ 28.382097] ? kasan_check_read+0x11/0x20 [ 28.386225] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.390614] ? __local_bh_enable_ip+0x161/0x230 [ 28.395261] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 28.400257] ? release_sock+0x1e2/0x2b0 [ 28.404210] ? trace_hardirqs_on+0xd/0x10 [ 28.408338] ? __local_bh_enable_ip+0x161/0x230 [ 28.412990] ? _raw_spin_unlock_bh+0x30/0x40 [ 28.417382] ? release_sock+0x1e2/0x2b0 [ 28.421334] ? __release_sock+0x3a0/0x3a0 [ 28.425465] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 28.430980] ? _copy_from_user+0xdf/0x150 [ 28.435111] ? sk_stream_wait_memory+0x1260/0x1260 [ 28.440030] ? tls_setsockopt+0xb2/0x780 [ 28.444093] ? sock_common_setsockopt+0x9a/0xe0 [ 28.448760] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 28.454279] ? __sys_setsockopt+0x24f/0x390 [ 28.458587] do_group_exit+0x16f/0x430 [ 28.462477] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 28.467994] ? __ia32_sys_exit+0x50/0x50 [ 28.472054] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 28.476884] ? do_syscall_64+0x92/0x800 [ 28.480840] __x64_sys_exit_group+0x3e/0x50 [ 28.485147] do_syscall_64+0x1b1/0x800 [ 28.489024] ? syscall_return_slowpath+0x5c0/0x5c0 [ 28.493939] ? syscall_return_slowpath+0x30f/0x5c0 [ 28.498851] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 28.504193] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.509026] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.514201] RIP: 0033:0x43eb58 [ 28.517369] RSP: 002b:00007ffe5de43c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 28.525055] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043eb58 [ 28.532312] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 28.539572] RBP: 00000000004be500 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 28.546832] R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000001 [ 28.554087] R13: 00000000006cc160 R14: 0000000000000000 R15: 0000000000000000 [ 28.561340] [ 28.562946] Allocated by task 4512: [ 28.566564] save_stack+0x43/0xd0 [ 28.569997] kasan_kmalloc+0xc4/0xe0 [ 28.573697] kmem_cache_alloc_trace+0x152/0x780 [ 28.578346] tls_init+0x1f9/0xb00 [ 28.581778] tcp_set_ulp+0x1bc/0x520 [ 28.585471] do_tcp_setsockopt.isra.39+0x44a/0x2600 [ 28.590465] tcp_setsockopt+0xc1/0xe0 [ 28.594244] sock_common_setsockopt+0x9a/0xe0 [ 28.598718] __sys_setsockopt+0x1bd/0x390 [ 28.602844] __x64_sys_setsockopt+0xbe/0x150 [ 28.607230] do_syscall_64+0x1b1/0x800 [ 28.611103] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.616272] [ 28.617876] Freed by task 4512: [ 28.621134] save_stack+0x43/0xd0 [ 28.624567] __kasan_slab_free+0x11a/0x170 [ 28.628780] kasan_slab_free+0xe/0x10 [ 28.632557] kfree+0xd9/0x260 [ 28.635643] tls_sw_free_resources+0x2a3/0x360 [ 28.640203] tls_sk_proto_close+0x67c/0x9c0 [ 28.644502] inet_release+0x104/0x1f0 [ 28.648281] inet6_release+0x50/0x70 [ 28.651971] sock_release+0x96/0x1b0 [ 28.655660] sock_close+0x16/0x20 [ 28.659092] __fput+0x34d/0x890 [ 28.662349] ____fput+0x15/0x20 [ 28.665609] task_work_run+0x1e4/0x290 [ 28.669472] do_exit+0x1aee/0x2730 [ 28.672989] do_group_exit+0x16f/0x430 [ 28.676859] __x64_sys_exit_group+0x3e/0x50 [ 28.681167] do_syscall_64+0x1b1/0x800 [ 28.685041] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.690205] [ 28.691813] The buggy address belongs to the object at ffff8801b4b4c200 [ 28.691813] which belongs to the cache kmalloc-256 of size 256 [ 28.704447] The buggy address is located 88 bytes inside of [ 28.704447] 256-byte region [ffff8801b4b4c200, ffff8801b4b4c300) [ 28.716207] The buggy address belongs to the page: [ 28.721113] page:ffffea0006d2d300 count:1 mapcount:0 mapping:ffff8801b4b4c0c0 index:0x0 [ 28.729233] flags: 0x2fffc0000000100(slab) [ 28.733447] raw: 02fffc0000000100 ffff8801b4b4c0c0 0000000000000000 000000010000000c [ 28.741307] raw: ffffea0006be3320 ffff8801da801648 ffff8801da8007c0 0000000000000000 [ 28.749159] page dumped because: kasan: bad access detected [ 28.754840] [ 28.756443] Memory state around the buggy address: [ 28.761348] ffff8801b4b4c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.768684] ffff8801b4b4c180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.776025] >ffff8801b4b4c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.783370] ^ [ 28.789575] ffff8801b4b4c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.796908] ffff8801b4b4c300: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 28.804240] ================================================================== [ 28.811570] Disabling lock debugging due to kernel taint [ 28.817081] Kernel panic - not syncing: panic_on_warn set ... [ 28.817081] [ 28.824448] CPU: 1 PID: 4512 Comm: syz-executor486 Tainted: G B 4.17.0-rc3+ #34 [ 28.833184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.842513] Call Trace: [ 28.845079] dump_stack+0x1b9/0x294 [ 28.848683] ? dump_stack_print_info.cold.2+0x52/0x52 [ 28.853849] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 28.858586] ? tls_sk_proto_close+0x7f0/0x9c0 [ 28.863064] panic+0x22f/0x4de [ 28.866232] ? add_taint.cold.5+0x16/0x16 [ 28.870357] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.874742] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.879128] ? tls_sk_proto_close+0x8ab/0x9c0 [ 28.883597] kasan_end_report+0x47/0x4f [ 28.887546] kasan_report.cold.7+0x76/0x2fe [ 28.891846] __asan_report_load1_noabort+0x14/0x20 [ 28.896751] tls_sk_proto_close+0x8ab/0x9c0 [ 28.901059] ? unwind_get_return_address+0x61/0xa0 [ 28.905968] ? tcp_check_oom+0x520/0x520 [ 28.910009] ? tls_write_space+0x340/0x340 [ 28.914230] ? graph_lock+0x170/0x170 [ 28.918012] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 28.923539] ? ipv6_sock_ac_close+0x34e/0x480 [ 28.928015] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 28.933539] ? ipv6_sock_mc_close+0x161/0x1c0 [ 28.938015] ? ip_mc_drop_socket+0x20f/0x270 [ 28.942423] inet_release+0x104/0x1f0 [ 28.946201] inet6_release+0x50/0x70 [ 28.949892] sock_release+0x96/0x1b0 [ 28.953584] ? sock_alloc_file+0x4e0/0x4e0 [ 28.957796] sock_close+0x16/0x20 [ 28.961225] __fput+0x34d/0x890 [ 28.964482] ? fput+0x1a0/0x1a0 [ 28.967759] ? _raw_spin_unlock_irq+0x27/0x70 [ 28.972229] ____fput+0x15/0x20 [ 28.975487] task_work_run+0x1e4/0x290 [ 28.979351] ? task_work_cancel+0x240/0x240 [ 28.983652] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 28.989167] ? switch_task_namespaces+0xa2/0xd0 [ 28.993814] do_exit+0x1aee/0x2730 [ 28.997331] ? trace_hardirqs_off+0xd/0x10 [ 29.001543] ? mm_update_next_owner+0x980/0x980 [ 29.006188] ? mark_held_locks+0xc9/0x160 [ 29.010320] ? quarantine_put+0xeb/0x190 [ 29.014359] ? kfree+0x111/0x260 [ 29.017700] ? kzfree+0x28/0x30 [ 29.020955] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.025945] ? trace_hardirqs_on+0xd/0x10 [ 29.030072] ? kzfree+0x28/0x30 [ 29.033331] ? crypto_destroy_tfm+0x15d/0x300 [ 29.037802] ? graph_lock+0x170/0x170 [ 29.041578] ? graph_lock+0x170/0x170 [ 29.045361] ? find_held_lock+0x36/0x1c0 [ 29.049400] ? lock_downgrade+0x8e0/0x8e0 [ 29.053523] ? lock_downgrade+0x8e0/0x8e0 [ 29.057649] ? kasan_check_read+0x11/0x20 [ 29.061774] ? do_raw_spin_unlock+0x9e/0x2e0 [ 29.066160] ? __local_bh_enable_ip+0x161/0x230 [ 29.070806] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.075799] ? release_sock+0x1e2/0x2b0 [ 29.079747] ? trace_hardirqs_on+0xd/0x10 [ 29.083872] ? __local_bh_enable_ip+0x161/0x230 [ 29.088520] ? _raw_spin_unlock_bh+0x30/0x40 [ 29.092903] ? release_sock+0x1e2/0x2b0 [ 29.096855] ? __release_sock+0x3a0/0x3a0 [ 29.100981] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 29.106494] ? _copy_from_user+0xdf/0x150 [ 29.110620] ? sk_stream_wait_memory+0x1260/0x1260 [ 29.115527] ? tls_setsockopt+0xb2/0x780 [ 29.119567] ? sock_common_setsockopt+0x9a/0xe0 [ 29.124211] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.129723] ? __sys_setsockopt+0x24f/0x390 [ 29.134034] do_group_exit+0x16f/0x430 [ 29.137900] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.143417] ? __ia32_sys_exit+0x50/0x50 [ 29.147456] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 29.152274] ? do_syscall_64+0x92/0x800 [ 29.156223] __x64_sys_exit_group+0x3e/0x50 [ 29.160523] do_syscall_64+0x1b1/0x800 [ 29.164396] ? syscall_return_slowpath+0x5c0/0x5c0 [ 29.169301] ? syscall_return_slowpath+0x30f/0x5c0 [ 29.174207] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 29.179546] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.184368] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.189556] RIP: 0033:0x43eb58 [ 29.192722] RSP: 002b:00007ffe5de43c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 29.200406] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043eb58 [ 29.207648] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 29.214894] RBP: 00000000004be500 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 29.222138] R10: 0000000020000100 R11: 0000000000000246 R12: 0000000000000001 [ 29.229381] R13: 00000000006cc160 R14: 0000000000000000 R15: 0000000000000000 [ 29.237181] Dumping ftrace buffer: [ 29.240692] (ftrace buffer empty) [ 29.244378] Kernel Offset: disabled [ 29.247984] Rebooting in 86400 seconds..