[....] Starting OpenBSD Secure Shell server: sshd[ 18.327979] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.974751] random: sshd: uninitialized urandom read (32 bytes read) [ 21.393144] random: sshd: uninitialized urandom read (32 bytes read) [ 22.137904] sshd (4434) used greatest stack depth: 17176 bytes left [ 22.154505] random: sshd: uninitialized urandom read (32 bytes read) [ 23.677276] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts. [ 29.118303] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program executing program executing program executing program executing program executing program [ 29.264882] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 [ 29.272245] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 [ 29.281348] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 [ 29.288667] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 [ 29.296067] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 [ 29.303327] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 executing program [ 29.310624] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 [ 29.318110] EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=64648 executing program executing program executing program [ 29.356943] ================================================================== [ 29.364513] BUG: KASAN: use-after-free in __ext4_expand_extra_isize+0x178/0x240 [ 29.371964] Write of size 64616 at addr ffff8801c3a660a0 by task syz-executor956/4449 [ 29.379932] [ 29.381572] CPU: 0 PID: 4449 Comm: syz-executor956 Not tainted 4.17.0-rc7+ #80 [ 29.388927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.398266] Call Trace: [ 29.400842] dump_stack+0x1b9/0x294 [ 29.404458] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.409633] ? printk+0x9e/0xba [ 29.412899] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 29.417639] ? kasan_check_write+0x14/0x20 [ 29.421861] print_address_description+0x6c/0x20b [ 29.426688] ? __ext4_expand_extra_isize+0x178/0x240 [ 29.431783] kasan_report.cold.7+0x242/0x2fe [ 29.436182] check_memory_region+0x13e/0x1b0 [ 29.440574] memset+0x23/0x40 [ 29.443667] __ext4_expand_extra_isize+0x178/0x240 [ 29.448583] ext4_mark_inode_dirty+0x72f/0xb20 [ 29.453155] ? ext4_expand_extra_isize+0x590/0x590 [ 29.458071] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.463606] ? __ext4_journal_start_sb+0x182/0x5e0 [ 29.468524] ? ext4_dirty_inode+0x62/0xc0 [ 29.472659] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 29.478357] ? __lock_is_held+0xb5/0x140 [ 29.482406] ? ext4_setattr+0x2ac0/0x2ac0 [ 29.486552] ext4_dirty_inode+0x97/0xc0 [ 29.490515] __mark_inode_dirty+0x811/0x1530 [ 29.494920] ? __inode_attach_wb+0x1310/0x1310 [ 29.499488] ? lock_downgrade+0x8e0/0x8e0 [ 29.503622] ? print_usage_bug+0xc0/0xc0 [ 29.507670] ? lock_downgrade+0x8e0/0x8e0 [ 29.511804] ? lock_release+0xa10/0xa10 [ 29.515765] ? mark_held_locks+0xc9/0x160 [ 29.519900] ? current_kernel_time64+0x242/0x2f0 [ 29.524643] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.529654] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 29.534654] ? current_kernel_time64+0x1f4/0x2f0 [ 29.539396] generic_update_time+0x255/0x420 [ 29.543793] ? put_itimerspec64+0x310/0x310 [ 29.548102] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 29.553725] touch_atime+0x292/0x310 [ 29.557423] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 29.563035] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 29.568644] ? __atime_needs_update+0xd10/0xd10 [ 29.573303] ? security_file_permission+0x1c6/0x240 [ 29.578309] iterate_dir+0x394/0x5d0 [ 29.582013] __x64_sys_getdents+0x293/0x4e0 [ 29.586322] ? __ia32_sys_old_readdir+0x2a0/0x2a0 [ 29.591150] ? fillonedir+0x2a0/0x2a0 [ 29.594939] ? do_syscall_64+0x92/0x800 [ 29.598905] do_syscall_64+0x1b1/0x800 [ 29.602778] ? syscall_return_slowpath+0x5c0/0x5c0 [ 29.607694] ? syscall_return_slowpath+0x30f/0x5c0 [ 29.612614] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.618137] ? retint_user+0x18/0x18 [ 29.621840] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.626670] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.631843] RIP: 0033:0x445ceb [ 29.635017] RSP: 002b:00007ffd5d921990 EFLAGS: 00000206 ORIG_RAX: 000000000000004e [ 29.642709] RAX: ffffffffffffffda RBX: 0000000002672990 RCX: 0000000000445ceb [ 29.649968] RDX: 0000000000008000 RSI: 0000000002672990 RDI: 0000000000000003 [ 29.657220] RBP: 0000000002672990 R08: 0000000000001161 R09: 0000000002671940 [ 29.664474] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffd4 [ 29.671726] R13: 0000000000000016 R14: 0000000000000000 R15: 0000000000000000 [ 29.678988] [ 29.680600] The buggy address belongs to the page: [ 29.685515] page:ffffea00070e9980 count:2 mapcount:0 mapping:ffff8801ce85e660 index:0x4a8 [ 29.693817] flags: 0x2fffc0000001064(referenced|lru|active|private) [ 29.700211] raw: 02fffc0000001064 ffff8801ce85e660 00000000000004a8 00000002ffffffff [ 29.708080] raw: ffffea00070e9960 ffffea00070e99e0 ffff8801aee00348 ffff8801d9a42c80 [ 29.715940] page dumped because: kasan: bad access detected [ 29.721633] page->mem_cgroup:ffff8801d9a42c80 [ 29.726105] [ 29.727713] Memory state around the buggy address: [ 29.732624] ffff8801c3a6cf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.739971] ffff8801c3a6cf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.747312] >ffff8801c3a6d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.754650] ^ executing program executing program executing program [ 29.757998] ffff8801c3a6d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.765342] ffff8801c3a6d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.772678] ================================================================== [ 29.780019] Disabling lock debugging due to kernel taint [ 29.785688] Kernel panic - not syncing: panic_on_warn set ... [ 29.785688] [ 29.793071] CPU: 0 PID: 4449 Comm: syz-executor956 Tainted: G B 4.17.0-rc7+ #80 [ 29.801812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.811158] Call Trace: [ 29.813729] dump_stack+0x1b9/0x294 [ 29.817338] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.822508] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 29.827243] ? __ext4_expand_extra_isize+0xe0/0x240 [ 29.832324] panic+0x22f/0x4de [ 29.835494] ? add_taint.cold.5+0x16/0x16 [ 29.839623] ? do_raw_spin_unlock+0x9e/0x2e0 [ 29.844028] ? do_raw_spin_unlock+0x9e/0x2e0 [ 29.848415] ? __ext4_expand_extra_isize+0x178/0x240 [ 29.853500] kasan_end_report+0x47/0x4f [ 29.857459] kasan_report.cold.7+0x76/0x2fe [ 29.861771] check_memory_region+0x13e/0x1b0 [ 29.866157] memset+0x23/0x40 [ 29.869736] __ext4_expand_extra_isize+0x178/0x240 [ 29.874647] ext4_mark_inode_dirty+0x72f/0xb20 [ 29.879210] ? ext4_expand_extra_isize+0x590/0x590 [ 29.884122] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.889640] ? __ext4_journal_start_sb+0x182/0x5e0 [ 29.894548] ? ext4_dirty_inode+0x62/0xc0 [ 29.898675] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 29.904367] ? __lock_is_held+0xb5/0x140 [ 29.908409] ? ext4_setattr+0x2ac0/0x2ac0 [ 29.912535] ext4_dirty_inode+0x97/0xc0 [ 29.916495] __mark_inode_dirty+0x811/0x1530 [ 29.920887] ? __inode_attach_wb+0x1310/0x1310 [ 29.925458] ? lock_downgrade+0x8e0/0x8e0 [ 29.929592] ? print_usage_bug+0xc0/0xc0 [ 29.933641] ? lock_downgrade+0x8e0/0x8e0 [ 29.937777] ? lock_release+0xa10/0xa10 [ 29.941735] ? mark_held_locks+0xc9/0x160 [ 29.945866] ? current_kernel_time64+0x242/0x2f0 [ 29.950602] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.955599] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 29.960594] ? current_kernel_time64+0x1f4/0x2f0 [ 29.965332] generic_update_time+0x255/0x420 [ 29.969716] ? put_itimerspec64+0x310/0x310 [ 29.974023] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 29.979628] touch_atime+0x292/0x310 [ 29.983318] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 29.988918] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 29.994519] ? __atime_needs_update+0xd10/0xd10 [ 29.999168] ? security_file_permission+0x1c6/0x240 [ 30.004161] iterate_dir+0x394/0x5d0 [ 30.007851] __x64_sys_getdents+0x293/0x4e0 [ 30.012148] ? __ia32_sys_old_readdir+0x2a0/0x2a0 [ 30.016966] ? fillonedir+0x2a0/0x2a0 [ 30.020744] ? do_syscall_64+0x92/0x800 [ 30.024697] do_syscall_64+0x1b1/0x800 [ 30.028564] ? syscall_return_slowpath+0x5c0/0x5c0 [ 30.033470] ? syscall_return_slowpath+0x30f/0x5c0 [ 30.038379] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 30.043892] ? retint_user+0x18/0x18 [ 30.047583] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 30.052403] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 30.057568] RIP: 0033:0x445ceb [ 30.060733] RSP: 002b:00007ffd5d921990 EFLAGS: 00000206 ORIG_RAX: 000000000000004e [ 30.068419] RAX: ffffffffffffffda RBX: 0000000002672990 RCX: 0000000000445ceb [ 30.075666] RDX: 0000000000008000 RSI: 0000000002672990 RDI: 0000000000000003 [ 30.082910] RBP: 0000000002672990 R08: 0000000000001161 R09: 0000000002671940 [ 30.090158] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffd4 [ 30.097404] R13: 0000000000000016 R14: 0000000000000000 R15: 0000000000000000 [ 30.105075] Dumping ftrace buffer: [ 30.108597] (ftrace buffer empty) [ 30.112284] Kernel Offset: disabled [ 30.115889] Rebooting in 86400 seconds..