[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 16.952689] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.080793] random: sshd: uninitialized urandom read (32 bytes read) [ 23.497493] random: sshd: uninitialized urandom read (32 bytes read) [ 24.304451] random: sshd: uninitialized urandom read (32 bytes read) [ 24.435454] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts. [ 29.838302] random: sshd: uninitialized urandom read (32 bytes read) 2018/05/18 23:32:08 parsed 1 programs 2018/05/18 23:32:08 executed programs: 0 [ 30.333483] IPVS: Creating netns size=2536 id=1 [ 30.368440] IPVS: Creating netns size=2536 id=2 [ 30.409041] IPVS: Creating netns size=2536 id=3 [ 30.445114] IPVS: Creating netns size=2536 id=4 [ 30.489690] IPVS: Creating netns size=2536 id=5 [ 30.527001] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.540251] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.548254] IPVS: Creating netns size=2536 id=6 [ 30.559312] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.568374] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.614675] IPVS: Creating netns size=2536 id=7 [ 30.670104] IPVS: Creating netns size=2536 id=8 [ 30.727547] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.749980] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.762068] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.782938] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.798852] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.818510] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.827234] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.875740] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 30.960965] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.970142] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 30.981015] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.990912] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.006892] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.021354] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.037881] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.052635] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.061360] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.076319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.087924] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.104716] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.132376] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.145691] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.159511] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.174558] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.184207] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.204721] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.213050] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.241681] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.257194] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.273316] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.301896] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.316985] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.325385] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.334244] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.344818] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.360064] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.371145] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.387461] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.395884] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.411944] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.427157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.461108] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 31.476380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.485418] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.500729] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 31.545219] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.560680] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 31.579522] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.596935] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.617821] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 31.626235] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.636678] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.647738] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.662489] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 31.674691] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.683237] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.694433] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.702864] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.722053] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 31.732077] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.743791] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.756061] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 31.764776] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 31.776397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.790229] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.798905] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 31.806998] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 31.821313] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.831063] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.839330] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 31.860608] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.870310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.881022] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 31.895666] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 31.906151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.915041] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.922664] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.930262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.021966] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.148825] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.160766] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.168836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.291914] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.312418] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.390825] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.399055] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.406154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.441732] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.465517] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.471717] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.482492] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.547826] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.556521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.563246] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.635625] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.730833] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.747788] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.766219] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.775331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.782033] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.804081] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.867811] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.876539] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.883322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.917804] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.924404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.931058] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.941458] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 33.957161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.967429] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/05/18 23:32:13 executed programs: 65 [ 35.505170] ================================================================== [ 35.512715] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 35.520093] Read of size 4 at addr ffff8801d49c6c80 by task syz-executor4/6071 [ 35.527452] [ 35.529094] CPU: 0 PID: 6071 Comm: syz-executor4 Not tainted 4.9.100-ge14d1a3 #30 [ 35.536716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 35.546062] ffff8801d6c17878 ffffffff81eb0f09 ffffea0007527180 ffff8801d49c6c80 [ 35.554100] 0000000000000000 ffff8801d49c6c80 ffffffff8300fbe0 ffff8801d6c178b0 [ 35.562106] ffffffff8156532b ffff8801d49c6c80 0000000000000004 0000000000000000 [ 35.570107] Call Trace: [ 35.572677] [] dump_stack+0xc1/0x128 [ 35.578022] [] ? sock_release+0x1c0/0x1c0 [ 35.583799] [] print_address_description+0x6c/0x234 [ 35.590634] [] ? sock_release+0x1c0/0x1c0 [ 35.596424] [] kasan_report.cold.6+0x242/0x2fe [ 35.602650] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 35.609386] [] __asan_report_load4_noabort+0x14/0x20 [ 35.616121] [] l2tp_session_queue_purge+0xf4/0x100 [ 35.622681] [] ? sock_release+0x1c0/0x1c0 [ 35.628462] [] pppol2tp_release+0x1fb/0x2e0 [ 35.634417] [] sock_release+0x96/0x1c0 [ 35.639964] [] sock_close+0x16/0x20 [ 35.645283] [] __fput+0x263/0x700 [ 35.650371] [] ____fput+0x15/0x20 [ 35.655453] [] task_work_run+0x10c/0x180 [ 35.661143] [] do_exit+0x9e1/0x27c0 [ 35.666399] [] ? debug_check_no_locks_freed+0x210/0x210 [ 35.673392] [] ? release_task.part.19+0x1210/0x1210 [ 35.680050] [] ? save_stack_trace+0x16/0x20 [ 35.686017] [] ? save_stack+0x43/0xd0 [ 35.691457] [] ? kasan_slab_free+0x72/0xc0 [ 35.697323] [] ? recalc_sigpending+0x72/0x90 [ 35.703452] [] do_group_exit+0x111/0x340 [ 35.709148] [] get_signal+0x4cf/0x1450 [ 35.714665] [] do_signal+0x87/0x19f0 [ 35.720018] [] ? debug_check_no_locks_freed+0x210/0x210 [ 35.727015] [] ? putname+0xdb/0x110 [ 35.732286] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 35.739119] [] ? setup_sigcontext+0x7d0/0x7d0 [ 35.745345] [] ? putname+0xe0/0x110 [ 35.750608] [] ? do_futex+0x1770/0x1770 [ 35.756220] [] ? exit_to_usermode_loop+0xac/0x120 [ 35.762701] [] exit_to_usermode_loop+0xe1/0x120 [ 35.769014] [] do_syscall_64+0x364/0x490 [ 35.774706] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 35.781615] [ 35.783219] Allocated by task 6071: [ 35.786825] save_stack_trace+0x16/0x20 [ 35.790790] save_stack+0x43/0xd0 [ 35.794220] kasan_kmalloc+0xc7/0xe0 [ 35.797918] __kmalloc+0x11d/0x300 [ 35.801451] l2tp_session_create+0x38/0x16f0 [ 35.805852] pppol2tp_connect+0x10d7/0x18f0 [ 35.810155] SYSC_connect+0x1b8/0x300 [ 35.813938] SyS_connect+0x24/0x30 [ 35.817453] do_syscall_64+0x1a6/0x490 [ 35.821319] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 35.826393] [ 35.828005] Freed by task 6059: [ 35.831262] save_stack_trace+0x16/0x20 [ 35.835225] save_stack+0x43/0xd0 [ 35.838652] kasan_slab_free+0x72/0xc0 [ 35.842513] kfree+0xfb/0x310 [ 35.845595] l2tp_session_free+0x166/0x200 [ 35.849804] l2tp_tunnel_closeall+0x284/0x350 [ 35.854272] l2tp_udp_encap_destroy+0x87/0xe0 [ 35.858751] udpv6_destroy_sock+0xb1/0xd0 [ 35.862879] sk_common_release+0x6d/0x300 [ 35.867029] udp_lib_close+0x15/0x20 [ 35.870732] inet_release+0xff/0x1d0 [ 35.874425] inet6_release+0x50/0x70 [ 35.878117] sock_release+0x96/0x1c0 [ 35.881809] sock_close+0x16/0x20 [ 35.885242] __fput+0x263/0x700 [ 35.888597] ____fput+0x15/0x20 [ 35.891861] task_work_run+0x10c/0x180 [ 35.895724] do_exit+0x9e1/0x27c0 [ 35.899156] do_group_exit+0x111/0x340 [ 35.903038] SyS_exit_group+0x1d/0x20 [ 35.906817] do_syscall_64+0x1a6/0x490 [ 35.910684] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 35.915764] [ 35.917370] The buggy address belongs to the object at ffff8801d49c6c80 [ 35.917370] which belongs to the cache kmalloc-512 of size 512 [ 35.930009] The buggy address is located 0 bytes inside of [ 35.930009] 512-byte region [ffff8801d49c6c80, ffff8801d49c6e80) [ 35.941696] The buggy address belongs to the page: [ 35.946606] page:ffffea0007527180 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 35.956793] flags: 0x8000000000004080(slab|head) [ 35.961522] page dumped because: kasan: bad access detected [ 35.967219] [ 35.968832] Memory state around the buggy address: [ 35.973736] ffff8801d49c6b80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 35.981074] ffff8801d49c6c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.988419] >ffff8801d49c6c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.995757] ^ [ 35.999108] ffff8801d49c6d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.006445] ffff8801d49c6d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.013778] ================================================================== [ 36.021112] Disabling lock debugging due to kernel taint [ 36.031966] Kernel panic - not syncing: panic_on_warn set ... [ 36.031966] [ 36.039397] CPU: 0 PID: 6071 Comm: syz-executor4 Tainted: G B 4.9.100-ge14d1a3 #30 [ 36.048324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.057684] ffff8801d6c177d8 ffffffff81eb0f09 ffffffff843c50e5 00000000ffffffff [ 36.065839] 0000000000000000 0000000000000000 ffffffff8300fbe0 ffff8801d6c17898 [ 36.073894] ffffffff8141f895 0000000041b58ab3 ffffffff843b87e8 ffffffff8141f6d6 [ 36.081901] Call Trace: [ 36.084467] [] dump_stack+0xc1/0x128 [ 36.089812] [] ? sock_release+0x1c0/0x1c0 [ 36.095588] [] panic+0x1bf/0x3bc [ 36.100582] [] ? add_taint.cold.6+0x16/0x16 [ 36.106547] [] ? ___preempt_schedule+0x16/0x18 [ 36.112845] [] kasan_end_report+0x47/0x4f [ 36.118622] [] kasan_report.cold.6+0x76/0x2fe [ 36.124760] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 36.131504] [] __asan_report_load4_noabort+0x14/0x20 [ 36.138244] [] l2tp_session_queue_purge+0xf4/0x100 [ 36.144807] [] ? sock_release+0x1c0/0x1c0 [ 36.150584] [] pppol2tp_release+0x1fb/0x2e0 [ 36.156547] [] sock_release+0x96/0x1c0 [ 36.162075] [] sock_close+0x16/0x20 [ 36.167351] [] __fput+0x263/0x700 [ 36.172442] [] ____fput+0x15/0x20 [ 36.177539] [] task_work_run+0x10c/0x180 [ 36.183229] [] do_exit+0x9e1/0x27c0 [ 36.188484] [] ? debug_check_no_locks_freed+0x210/0x210 [ 36.195489] [] ? release_task.part.19+0x1210/0x1210 [ 36.202135] [] ? save_stack_trace+0x16/0x20 [ 36.208084] [] ? save_stack+0x43/0xd0 [ 36.213515] [] ? kasan_slab_free+0x72/0xc0 [ 36.219379] [] ? recalc_sigpending+0x72/0x90 [ 36.225418] [] do_group_exit+0x111/0x340 [ 36.231109] [] get_signal+0x4cf/0x1450 [ 36.236643] [] do_signal+0x87/0x19f0 [ 36.241994] [] ? debug_check_no_locks_freed+0x210/0x210 [ 36.249004] [] ? putname+0xdb/0x110 [ 36.254537] [] ? rcu_read_lock_sched_held+0x103/0x120 [ 36.261354] [] ? setup_sigcontext+0x7d0/0x7d0 [ 36.267493] [] ? putname+0xe0/0x110 [ 36.272758] [] ? do_futex+0x1770/0x1770 [ 36.278366] [] ? exit_to_usermode_loop+0xac/0x120 [ 36.284863] [] exit_to_usermode_loop+0xe1/0x120 [ 36.291165] [] do_syscall_64+0x364/0x490 [ 36.296861] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 36.304282] Dumping ftrace buffer: [ 36.307798] (ftrace buffer empty) [ 36.311483] Kernel Offset: disabled [ 36.315084] Rebooting in 86400 seconds..