[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 33.166278] random: sshd: uninitialized urandom read (32 bytes read) [ 33.454116] kauditd_printk_skb: 9 callbacks suppressed [ 33.454125] audit: type=1400 audit(1567137466.709:35): avc: denied { map } for pid=6856 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 33.496411] random: sshd: uninitialized urandom read (32 bytes read) [ 34.024220] random: sshd: uninitialized urandom read (32 bytes read) [ 58.534392] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.199' (ECDSA) to the list of known hosts. [ 64.037425] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 64.155045] audit: type=1400 audit(1567137497.409:36): avc: denied { map } for pid=6869 comm="syz-executor125" path="/root/syz-executor125686798" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 64.162500] FAULT_INJECTION: forcing a failure. [ 64.162500] name failslab, interval 1, probability 0, space 0, times 1 [ 64.194638] CPU: 0 PID: 6869 Comm: syz-executor125 Not tainted 4.14.141 #37 [ 64.201756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.211308] Call Trace: [ 64.213901] dump_stack+0x138/0x197 [ 64.217519] should_fail.cold+0x10f/0x159 [ 64.221675] should_failslab+0xdb/0x130 [ 64.225651] kmem_cache_alloc+0x2d7/0x780 [ 64.229917] ? check_preemption_disabled+0x3c/0x250 [ 64.234950] ? alloc_inode+0xa9/0x180 [ 64.238831] selinux_inode_alloc_security+0xb6/0x2a0 [ 64.244014] security_inode_alloc+0x94/0xd0 [ 64.248457] inode_init_always+0x552/0xaf0 [ 64.252826] alloc_inode+0x81/0x180 [ 64.256559] iget_locked+0x161/0x440 [ 64.260331] kernfs_get_inode+0x4c/0x550 [ 64.264498] kernfs_mount_ns+0x426/0x790 [ 64.271047] cgroup_do_mount+0x9e/0x270 [ 64.275284] ? init_cgroup_root+0x310/0x310 [ 64.279826] ? trace_hardirqs_on_caller+0x400/0x590 [ 64.285035] cgroup_mount+0x789/0x8b0 [ 64.288870] ? cgroup_attach_task+0x6c0/0x6c0 [ 64.293372] mount_fs+0x97/0x2a1 [ 64.296734] vfs_kern_mount.part.0+0x5e/0x3d0 [ 64.301416] do_mount+0x417/0x27d0 [ 64.305167] ? copy_mount_string+0x40/0x40 [ 64.309411] ? memdup_user+0x58/0xa0 [ 64.313220] ? copy_mount_options+0x1fe/0x2f0 [ 64.317715] SyS_mount+0xab/0x120 [ 64.321170] ? copy_mnt_ns+0x8c0/0x8c0 [ 64.325195] do_syscall_64+0x1e8/0x640 [ 64.329206] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 64.334065] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 64.339275] RIP: 0033:0x4404b9 [ 64.342573] RSP: 002b:00007ffda65c1498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 64.350444] RAX: ffffffffffffffda RBX: 00007ffda65c14a0 RCX: 00000000004404b9 [ 64.357828] RDX: 00000000200000c0 RSI: 0000000020000100 RDI: 0000000000000000 [ 64.365123] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007ffda6003331 [ 64.372558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401da0 [ 64.380061] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 64.388445] kasan: CONFIG_KASAN_INLINE enabled [ 64.393292] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 64.400880] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 64.407110] Modules linked in: [ 64.410434] CPU: 0 PID: 6869 Comm: syz-executor125 Not tainted 4.14.141 #37 [ 64.417773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.427119] task: ffff8880a8172500 task.stack: ffff88808d158000 [ 64.433181] RIP: 0010:__list_del_entry_valid+0x85/0xf5 [ 64.438680] RSP: 0018:ffff88808d15fae8 EFLAGS: 00010246 [ 64.444143] RAX: dffffc0000000000 RBX: ffffffff891b0260 RCX: 0000000000000000 [ 64.451523] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a48e6d20 [ 64.458786] RBP: ffff88808d15fb00 R08: dffffc0000000000 R09: ffffffff88cac1c0 [ 64.466203] R10: ffff88808d15fb00 R11: ffff8880a8172500 R12: 0000000000000000 [ 64.473760] R13: 0000000000000000 R14: ffff8880a48e6d18 R15: ffff8880a48e6d20 [ 64.481230] FS: 00000000006e1880(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000 [ 64.489659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 64.495747] CR2: 000055d1f19e41b0 CR3: 000000008a9e9000 CR4: 00000000001406f0 [ 64.503012] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 64.510375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 64.517638] Call Trace: [ 64.520228] kernfs_kill_sb+0x62/0x1e0 [ 64.524209] cgroup_kill_sb+0xfb/0x330 [ 64.528094] deactivate_locked_super+0x74/0xe0 [ 64.532981] kernfs_mount_ns+0x629/0x790 [ 64.537030] cgroup_do_mount+0x9e/0x270 [ 64.541001] ? init_cgroup_root+0x310/0x310 [ 64.545407] ? trace_hardirqs_on_caller+0x400/0x590 [ 64.550694] cgroup_mount+0x789/0x8b0 [ 64.554585] ? cgroup_attach_task+0x6c0/0x6c0 [ 64.559204] mount_fs+0x97/0x2a1 [ 64.562586] vfs_kern_mount.part.0+0x5e/0x3d0 [ 64.567475] do_mount+0x417/0x27d0 [ 64.571005] ? copy_mount_string+0x40/0x40 [ 64.575683] ? memdup_user+0x58/0xa0 [ 64.579530] ? copy_mount_options+0x1fe/0x2f0 [ 64.584195] SyS_mount+0xab/0x120 [ 64.587815] ? copy_mnt_ns+0x8c0/0x8c0 [ 64.591992] do_syscall_64+0x1e8/0x640 [ 64.596137] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 64.601038] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 64.606230] RIP: 0033:0x4404b9 [ 64.609414] RSP: 002b:00007ffda65c1498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 64.617310] RAX: ffffffffffffffda RBX: 00007ffda65c14a0 RCX: 00000000004404b9 [ 64.624588] RDX: 00000000200000c0 RSI: 0000000020000100 RDI: 0000000000000000 [ 64.631982] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007ffda6003331 [ 64.639245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401da0 [ 64.646693] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 64.654136] Code: c5 0f 84 e1 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 e2 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 53 49 8b 14 24 4c 39 f2 0f 85 99 00 00 00 49 8d [ 64.673410] RIP: __list_del_entry_valid+0x85/0xf5 RSP: ffff88808d15fae8 [ 64.680771] ---[ end trace b59e3494f72c5b0f ]--- [ 64.685885] Kernel panic - not syncing: Fatal exception [ 64.692907] Kernel Offset: disabled [ 64.698207] Rebooting in 86400 seconds..