[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.797967] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 20.775373] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.071776] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [ 22.171650] random: sshd: uninitialized urandom read (32 bytes read, 120 bits of entropy available) [ 22.320857] random: sshd: uninitialized urandom read (32 bytes read, 124 bits of entropy available) Warning: Permanently added '10.128.0.7' (ECDSA) to the list of known hosts. [ 27.719546] random: sshd: uninitialized urandom read (32 bytes read, 128 bits of entropy available) 2018/05/26 23:34:41 parsed 1 programs 2018/05/26 23:34:41 executed programs: 0 [ 28.207115] IPVS: Creating netns size=2552 id=1 [ 28.369087] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 28.383418] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 28.458250] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 28.473571] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 28.549324] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 28.563547] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 28.577977] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.594411] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.201864] random: nonblocking pool is initialized [ 29.272109] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 29.306431] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/05/26 23:34:46 executed programs: 97 [ 33.749851] ================================================================== [ 33.757255] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 33.764505] Read of size 4 at addr ffff8800b672ef00 by task syz-executor0/4789 [ 33.771833] [ 33.773435] CPU: 1 PID: 4789 Comm: syz-executor0 Not tainted 4.4.133-g3f51ea2 #49 [ 33.781029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.790356] 0000000000000000 d13ac9aebdfb07d7 ffff8801d2807868 ffffffff81e0e4cd [ 33.798338] ffffea0002d9cb80 ffff8800b672ef00 0000000000000000 ffff8800b672ef00 [ 33.806330] ffffffff82f191d0 ffff8801d28078a0 ffffffff815154cc ffff8800b672ef00 [ 33.814343] Call Trace: [ 33.816905] [] dump_stack+0xc1/0x124 [ 33.822241] [] ? sock_release+0x1c0/0x1c0 [ 33.828015] [] print_address_description+0x6c/0x216 [ 33.834652] [] ? sock_release+0x1c0/0x1c0 [ 33.840430] [] kasan_report.cold.7+0x175/0x2f7 [ 33.846635] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 33.853371] [] __asan_report_load4_noabort+0x14/0x20 [ 33.860101] [] l2tp_session_queue_purge+0xf4/0x100 [ 33.866666] [] ? sock_release+0x1c0/0x1c0 [ 33.872435] [] pppol2tp_release+0x1ff/0x310 [ 33.878377] [] sock_release+0x96/0x1c0 [ 33.883886] [] sock_close+0x16/0x20 [ 33.889136] [] __fput+0x235/0x6f0 [ 33.894209] [] ____fput+0x15/0x20 [ 33.899284] [] task_work_run+0x10f/0x190 [ 33.904964] [] do_exit+0x9e5/0x26b0 [ 33.910212] [] ? release_task.part.17+0x1200/0x1200 [ 33.916849] [] ? recalc_sigpending+0x76/0xa0 [ 33.922877] [] do_group_exit+0x111/0x330 [ 33.928561] [] get_signal+0x4ec/0x14b0 [ 33.934074] [] ? __lock_is_held+0xa2/0xf0 [ 33.939845] [] do_signal+0x8b/0x1d30 [ 33.945182] [] ? __fd_install+0x255/0x600 [ 33.950952] [] ? get_unused_fd_flags+0xd0/0xd0 [ 33.957175] [] ? setup_sigcontext+0x780/0x780 [ 33.963292] [] ? get_unused_fd_flags+0xd0/0xd0 [ 33.969504] [] ? kernel_sock_shutdown+0x80/0x80 [ 33.975802] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 33.981922] [] ? fd_install+0x4d/0x60 [ 33.987345] [] ? compat_SyS_get_robust_list+0x310/0x310 [ 33.994340] [] ? SyS_socket+0x121/0x1b0 [ 33.999936] [] ? exit_to_usermode_loop+0xe4/0x160 [ 34.006398] [] exit_to_usermode_loop+0x11a/0x160 [ 34.012774] [] do_fast_syscall_32+0x620/0x8b0 [ 34.018895] [] sysenter_flags_fixed+0xd/0x17 [ 34.024923] [ 34.026523] Allocated by task 4785: [ 34.030125] [] save_stack_trace+0x26/0x50 [ 34.036024] [] save_stack+0x43/0xd0 [ 34.041392] [] kasan_kmalloc+0xc7/0xe0 [ 34.047019] [] __kmalloc+0x124/0x310 [ 34.052473] [] l2tp_session_create+0x39/0x1030 [ 34.058797] [] pppol2tp_connect+0x10f0/0x1910 [ 34.065038] [] SYSC_connect+0x1b8/0x300 [ 34.070753] [] SyS_connect+0x24/0x30 [ 34.076204] [] do_fast_syscall_32+0x326/0x8b0 [ 34.082441] [] sysenter_flags_fixed+0xd/0x17 [ 34.088593] [ 34.090193] Freed by task 4777: [ 34.093451] [] save_stack_trace+0x26/0x50 [ 34.099341] [] save_stack+0x43/0xd0 [ 34.104716] [] kasan_slab_free+0x72/0xc0 [ 34.110533] [] kfree+0xf4/0x310 [ 34.115553] [] l2tp_session_free+0x170/0x200 [ 34.121720] [] l2tp_tunnel_closeall+0x2b9/0x350 [ 34.128145] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 34.134564] [] udpv6_destroy_sock+0xb1/0xd0 [ 34.140641] [] sk_common_release+0x6d/0x300 [ 34.146703] [] udp_lib_close+0x15/0x20 [ 34.152328] [] inet_release+0xff/0x1d0 [ 34.157964] [] inet6_release+0x50/0x70 [ 34.163603] [] sock_release+0x96/0x1c0 [ 34.169230] [] sock_close+0x16/0x20 [ 34.174596] [] __fput+0x235/0x6f0 [ 34.179804] [] ____fput+0x15/0x20 [ 34.184999] [] task_work_run+0x10f/0x190 [ 34.190803] [] do_exit+0x9e5/0x26b0 [ 34.196171] [] do_group_exit+0x111/0x330 [ 34.201973] [] SyS_exit_group+0x1d/0x20 [ 34.207688] [] do_fast_syscall_32+0x326/0x8b0 [ 34.213946] [] sysenter_flags_fixed+0xd/0x17 [ 34.220104] [ 34.221707] The buggy address belongs to the object at ffff8800b672ef00 [ 34.221707] which belongs to the cache kmalloc-512 of size 512 [ 34.234336] The buggy address is located 0 bytes inside of [ 34.234336] 512-byte region [ffff8800b672ef00, ffff8800b672f100) [ 34.246013] The buggy address belongs to the page: [ 35.678996] PANIC: double fault, error_code: 0x0 [ 35.683789] CPU: 1 PID: 4789 Comm: syz-executor0 Not tainted 4.4.133-g3f51ea2 #49 [ 35.691723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 35.701051] task: ffff8801d3a86000 task.stack: ffff8801d2800000 [ 35.707078] RIP: 0010:[] [] dump_page_badflags+0x6/0x70 [ 35.715750] RSP: 0018:ffff880100000000 EFLAGS: 00010046 [ 35.721167] RAX: ffff8801d3a86000 RBX: ffffea0002d9cb80 RCX: 0000000000000000 [ 35.728408] RDX: 0000000000000000 RSI: ffffffff83aa9be0 RDI: ffffea0002d9cb80 [ 35.735648] RBP: ffff880100000008 R08: 0000000000000001 R09: 0000000000000000 [ 35.742890] R10: 0000000000000001 R11: ffffffff858ed134 R12: 0000000000000000 [ 35.750133] R13: ffffffff83aa9be0 R14: ffff8800b672ef00 R15: ffff8800b672f100 [ 35.757383] FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 [ 35.765595] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 35.771449] CR2: ffff8800fffffff8 CR3: 00000000b1f21000 CR4: 00000000001606f0 [ 35.778690] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.785947] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.793196] Stack: [ 35.795314] [ 35.796912] Call Trace: [ 35.799467] [ 35.801499] Code: 48 69 c0 80 06 00 00 f0 48 ff 80 68 3e 9f 84 5b 5d c3 48 89 df e8 2b c7 06 00 eb dd 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 <41> 56 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec 08 e8 [ 35.828643] Kernel panic - not syncing: Machine halted. [ 35.833978] CPU: 1 PID: 4789 Comm: syz-executor0 Not tainted 4.4.133-g3f51ea2 #49 [ 35.841579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 35.850912] 0000000000000000 d13ac9aebdfb07d7 ffff8801db30ce40 ffffffff81e0e4cd [ 35.858892] ffffffff83a376e0 0000000000000000 ffffffff83a08060 ffff880100000000 [ 35.866868] ffff8800b672f100 ffff8801db30cf00 ffffffff81409f34 0000000041b58ab3 [ 35.874847] Call Trace: [ 35.877409] <#DF> [] dump_stack+0xc1/0x124 [ 35.883482] [] panic+0x19e/0x38d [ 35.888467] [] ? add_taint.cold.4+0x16/0x16 [ 35.894409] [] ? vprintk_emit+0x249/0x840 [ 35.900176] [] ? vprintk_emit+0x249/0x840 [ 35.905952] [] df_debug+0x2d/0x2d [ 35.911039] [] do_double_fault+0x113/0x230 [ 35.916895] [] double_fault+0x2d/0x40 [ 35.922318] [] ? dump_page_badflags+0x6/0x70 [ 35.928355] <> [ 35.931918] Dumping ftrace buffer: [ 35.935764] (ftrace buffer empty) [ 35.939448] Kernel Offset: disabled [ 35.943056] Rebooting in 86400 seconds..