[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 22.305875] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.261023] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available) [ 24.628631] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 25.768960] random: sshd: uninitialized urandom read (32 bytes read, 118 bits of entropy available) [ 40.665686] random: nonblocking pool is initialized Warning: Permanently added '10.128.0.17' (ECDSA) to the list of known hosts. 2018/05/09 20:34:54 parsed 1 programs 2018/05/09 20:34:54 executed programs: 0 [ 46.744716] IPVS: Creating netns size=2552 id=1 [ 46.816950] IPVS: Creating netns size=2552 id=2 [ 46.886994] IPVS: Creating netns size=2552 id=3 [ 46.951434] IPVS: Creating netns size=2552 id=4 [ 47.033654] IPVS: Creating netns size=2552 id=5 [ 47.109053] IPVS: Creating netns size=2552 id=6 [ 47.181214] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 47.234085] IPVS: Creating netns size=2552 id=7 [ 47.353572] IPVS: Creating netns size=2552 id=8 [ 47.780702] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 47.786916] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 47.924183] l2tp_core: tunl 4: sockfd_lookup(fd=10) returned -9 [ 47.965739] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 48.430777] l2tp_core: tunl 4: sockfd_lookup(fd=10) returned -9 [ 48.460103] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 48.649539] l2tp_core: tunl 4: sockfd_lookup(fd=10) returned -9 [ 48.658192] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 48.809557] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 48.878670] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 49.784015] l2tp_core: tunl 4: sockfd_lookup(fd=10) returned -9 [ 49.849092] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 49.873799] l2tp_core: tunl 4: sockfd_lookup(fd=10) returned -9 [ 49.939248] l2tp_core: tunl 4: sockfd_lookup(fd=10) returned -9 [ 50.193142] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 50.971632] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 51.055050] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 51.472677] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 2018/05/09 20:34:59 executed programs: 190 [ 52.183724] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 52.217616] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 52.313713] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 52.444731] l2tp_core: tunl 4: sockfd_lookup(fd=9) returned -9 [ 52.491187] l2tp_core: tunl 4: sockfd_lookup(fd=10) returned -9 [ 52.857329] ================================================================== [ 52.864745] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 52.872014] Read of size 4 at addr ffff8801d20a7900 by task syz-executor6/4840 [ 52.879476] [ 52.881099] CPU: 0 PID: 4840 Comm: syz-executor6 Not tainted 4.4.131-g033c952 #36 [ 52.888712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.898064] 0000000000000000 d0e88947381104b7 ffff8800b2217c78 ffffffff81e0df8d [ 52.906095] ffffea0007482980 ffff8801d20a7900 0000000000000000 ffff8801d20a7900 [ 52.914128] ffffffff82f18cb0 ffff8800b2217cb0 ffffffff8151520c ffff8801d20a7900 [ 52.922153] Call Trace: [ 52.924724] [] dump_stack+0xc1/0x124 [ 52.930073] [] ? sock_release+0x1c0/0x1c0 [ 52.935850] [] print_address_description+0x6c/0x216 [ 52.942510] [] ? sock_release+0x1c0/0x1c0 [ 52.948302] [] kasan_report.cold.7+0x175/0x2f7 [ 52.954522] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 52.961258] [] __asan_report_load4_noabort+0x14/0x20 [ 52.967995] [] l2tp_session_queue_purge+0xf4/0x100 [ 52.974558] [] ? sock_release+0x1c0/0x1c0 [ 52.980340] [] pppol2tp_release+0x1ff/0x310 [ 52.986290] [] sock_release+0x96/0x1c0 [ 52.991821] [] sock_close+0x16/0x20 [ 52.997074] [] __fput+0x235/0x6f0 [ 53.002154] [] ____fput+0x15/0x20 [ 53.007237] [] task_work_run+0x10f/0x190 [ 53.012936] [] exit_to_usermode_loop+0x13d/0x160 [ 53.019340] [] do_fast_syscall_32+0x620/0x8b0 [ 53.025478] [] sysenter_flags_fixed+0xd/0x17 [ 53.031513] [ 53.033123] Allocated by task 4840: [ 53.036722] [] save_stack_trace+0x26/0x50 [ 53.042620] [] save_stack+0x43/0xd0 [ 53.048019] [] kasan_kmalloc+0xc7/0xe0 [ 53.053660] [] __kmalloc+0x124/0x310 [ 53.059137] [] l2tp_session_create+0x39/0x1030 [ 53.065500] [] pppol2tp_connect+0x10f0/0x1910 [ 53.071757] [] SYSC_connect+0x1b8/0x300 [ 53.077511] [] SyS_connect+0x24/0x30 [ 53.083007] [] do_fast_syscall_32+0x326/0x8b0 [ 53.089291] [] sysenter_flags_fixed+0xd/0x17 [ 53.095461] [ 53.097069] Freed by task 4847: [ 53.100318] [] save_stack_trace+0x26/0x50 [ 53.106225] [] save_stack+0x43/0xd0 [ 53.111612] [] kasan_slab_free+0x72/0xc0 [ 53.117435] [] kfree+0xf4/0x310 [ 53.122476] [] l2tp_session_free+0x170/0x200 [ 53.128644] [] l2tp_tunnel_closeall+0x2b9/0x350 [ 53.135069] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 53.141487] [] udpv6_destroy_sock+0xb1/0xd0 [ 53.147567] [] sk_common_release+0x6d/0x300 [ 53.153644] [] udp_lib_close+0x15/0x20 [ 53.159297] [] inet_release+0xff/0x1d0 [ 53.164936] [] inet6_release+0x50/0x70 [ 53.170580] [] sock_release+0x96/0x1c0 [ 53.176236] [] sock_close+0x16/0x20 [ 53.181637] [] __fput+0x235/0x6f0 [ 53.186840] [] ____fput+0x15/0x20 [ 53.192043] [] task_work_run+0x10f/0x190 [ 53.197850] [] exit_to_usermode_loop+0x13d/0x160 [ 53.204355] [] do_fast_syscall_32+0x620/0x8b0 [ 53.210599] [] sysenter_flags_fixed+0xd/0x17 [ 53.216771] [ 53.218384] The buggy address belongs to the object at ffff8801d20a7900 [ 53.218384] which belongs to the cache kmalloc-512 of size 512 [ 53.231015] The buggy address is located 0 bytes inside of [ 53.231015] 512-byte region [ffff8801d20a7900, ffff8801d20a7b00) [ 53.242689] The buggy address belongs to the page: [ 53.248207] kasan: CONFIG_KASAN_INLINE enabled [ 53.252670] kasan: GPF could be caused by NULL-ptr deref or user memory access[ 53.260305] ------------[ cut here ]------------ [ 53.265069] WARNING: CPU: 1 PID: 3875 at kernel/sched/core.c:7950 __might_sleep+0x138/0x1a0() [ 53.273734] do not call blocking ops when !TASK_RUNNING; state=1 set at [] do_wait+0x26e/0xa30 [ 53.284110] Kernel panic - not syncing: panic_on_warn set ... [ 53.284110] [ 54.438756] Shutting down cpus with NMI [ 54.443823] Dumping ftrace buffer: [ 54.447352] (ftrace buffer empty) [ 54.451036] Kernel Offset: disabled [ 54.454651] Rebooting in 86400 seconds..