[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 32.791700] random: sshd: uninitialized urandom read (32 bytes read) [ 33.026035] kauditd_printk_skb: 10 callbacks suppressed [ 33.026043] audit: type=1400 audit(1582522033.931:35): avc: denied { map } for pid=7221 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 33.083518] random: sshd: uninitialized urandom read (32 bytes read) [ 33.797155] random: sshd: uninitialized urandom read (32 bytes read) [ 40.193037] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.1.26' (ECDSA) to the list of known hosts. [ 45.738751] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 45.862968] audit: type=1400 audit(1582522046.771:36): avc: denied { map } for pid=7234 comm="syz-executor700" path="/root/syz-executor700685718" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 45.865764] ------------[ cut here ]------------ [ 45.894560] kernel BUG at arch/x86/mm/physaddr.c:27! [ 45.899666] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 45.905008] Modules linked in: [ 45.908229] CPU: 0 PID: 7234 Comm: syz-executor700 Not tainted 4.14.171-syzkaller #0 [ 45.916087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.925421] task: ffff8880976260c0 task.stack: ffff888096948000 [ 45.931462] RIP: 0010:__phys_addr+0x87/0xe0 [ 45.935763] RSP: 0018:ffff88809694f620 EFLAGS: 00010097 [ 45.941251] RAX: ffff8880976260c0 RBX: 0000000002777259 RCX: 0000000000000000 [ 45.948517] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000002777259 [ 45.955871] RBP: ffff88809694f638 R08: ffff8880976260c0 R09: ffff888097626960 [ 45.963174] R10: 0000000000000000 R11: 0000000000000000 R12: 0000778002777259 [ 45.970450] R13: 0000000082777259 R14: ffff88809ee3cdc0 R15: 0000000000000007 [ 45.977715] FS: 00000000014de880(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000 [ 45.985926] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.991789] CR2: 00000000200004c0 CR3: 000000009757b000 CR4: 00000000001406f0 [ 45.999129] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 46.006378] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 46.013629] Call Trace: [ 46.016207] ? audit_data_to_entry+0xa71/0x2170 [ 46.020863] kfree+0x7b/0x270 [ 46.023960] audit_data_to_entry+0xa71/0x2170 [ 46.028445] ? audit_unpack_string+0x1a0/0x1a0 [ 46.033018] ? selinux_capable+0x36/0x40 [ 46.037056] audit_rule_change+0x56d/0xdd0 [ 46.041286] ? ns_capable_common+0x12c/0x160 [ 46.045682] ? audit_del_rule+0x5a0/0x5a0 [ 46.049815] ? __netlink_ns_capable+0xe2/0x130 [ 46.054376] audit_receive_msg+0xdaa/0x21d0 [ 46.058678] ? audit_receive+0x85/0x1c0 [ 46.062631] ? audit_log_feature_change.part.0+0x100/0x100 [ 46.068234] ? mutex_trylock+0x1c0/0x1c0 [ 46.072370] ? netlink_deliver_tap+0x93/0x8f0 [ 46.076858] ? lock_downgrade+0x740/0x740 [ 46.080998] audit_receive+0xe1/0x1c0 [ 46.084775] netlink_unicast+0x44d/0x650 [ 46.088810] ? netlink_attachskb+0x6a0/0x6a0 [ 46.093199] ? security_netlink_send+0x81/0xb0 [ 46.097842] netlink_sendmsg+0x7c4/0xc60 [ 46.101901] ? netlink_unicast+0x650/0x650 [ 46.106137] ? security_socket_sendmsg+0x89/0xb0 [ 46.110875] ? netlink_unicast+0x650/0x650 [ 46.115091] sock_sendmsg+0xce/0x110 [ 46.118791] ___sys_sendmsg+0x70a/0x840 [ 46.122830] ? lock_downgrade+0x740/0x740 [ 46.126955] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 46.131701] ? do_raw_spin_unlock+0x174/0x260 [ 46.136192] ? _raw_spin_unlock+0x2d/0x50 [ 46.140336] ? do_huge_pmd_anonymous_page+0x2f9/0x1200 [ 46.145648] ? prep_transhuge_page+0xa0/0xa0 [ 46.150045] ? __handle_mm_fault+0x692/0x33d0 [ 46.154527] ? save_trace+0x290/0x290 [ 46.158335] ? copy_page_range+0x1de0/0x1de0 [ 46.162730] ? __do_page_fault+0x4e9/0xb80 [ 46.166958] ? __fget_light+0x172/0x1f0 [ 46.171073] ? __fdget+0x1b/0x20 [ 46.174459] ? sockfd_lookup_light+0xb4/0x160 [ 46.179076] __sys_sendmsg+0xb9/0x140 [ 46.182859] ? SyS_shutdown+0x170/0x170 [ 46.186868] SyS_sendmsg+0x2d/0x50 [ 46.190386] ? __sys_sendmsg+0x140/0x140 [ 46.194427] do_syscall_64+0x1e8/0x640 [ 46.198292] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.203115] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.208284] RIP: 0033:0x4401a9 [ 46.211451] RSP: 002b:00007ffe173236b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 46.219135] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004401a9 [ 46.226384] RDX: 0000000000000000 RSI: 00000000200004c0 RDI: 0000000000000003 [ 46.233632] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 46.240881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a30 [ 46.248128] R13: 0000000000401ac0 R14: 0000000000000000 R15: 0000000000000000 [ 46.255378] Code: 04 84 d2 75 28 0f b6 0d a1 12 87 07 4c 89 e0 48 d3 e8 48 85 c0 75 0f e8 e8 dd 31 00 4c 89 e0 5b 41 5c 41 5d 5d c3 e8 d9 dd 31 00 <0f> 0b 48 c7 c7 09 fd b1 88 e8 2b 6d 5c 00 eb ca e8 c4 dd 31 00 [ 46.274450] RIP: __phys_addr+0x87/0xe0 RSP: ffff88809694f620 [ 46.280230] ---[ end trace 25672fef3f7000ab ]--- [ 46.284973] Kernel panic - not syncing: Fatal exception [ 46.291668] Kernel Offset: disabled [ 46.295284] Rebooting in 86400 seconds..