[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 13.311484] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 15.466431] random: sshd: uninitialized urandom read (32 bytes read) [ 15.686571] random: sshd: uninitialized urandom read (32 bytes read) [ 16.167495] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.15.209' (ECDSA) to the list of known hosts. [ 21.814879] urandom_read: 1 callbacks suppressed [ 21.814883] random: sshd: uninitialized urandom read (32 bytes read) 2018/09/01 01:38:56 parsed 1 programs [ 23.155251] random: cc1: uninitialized urandom read (8 bytes read) 2018/09/01 01:38:58 executed programs: 0 [ 27.073780] ip (3171) used greatest stack depth: 23608 bytes left 2018/09/01 01:39:06 executed programs: 8 [ 34.864767] ================================================================== [ 34.872236] BUG: KASAN: use-after-free in _copy_to_user+0x9a/0xc0 [ 34.878468] Read of size 1435 at addr ffff8801c67ffffc by task syz-executor3/5563 [ 34.886081] [ 34.887702] CPU: 0 PID: 5563 Comm: syz-executor3 Not tainted 4.14.67+ #1 [ 34.894540] Call Trace: [ 34.897130] dump_stack+0xb9/0x11b [ 34.900695] print_address_description+0x60/0x22b [ 34.905536] kasan_report.cold.6+0x11b/0x2dd [ 34.909936] ? _copy_to_user+0x9a/0xc0 [ 34.913818] _copy_to_user+0x9a/0xc0 [ 34.917537] bpf_test_finish.isra.0+0xc8/0x190 [ 34.922123] ? bpf_test_run+0x350/0x350 [ 34.926094] ? kvm_clock_read+0x1f/0x30 [ 34.930062] ? ktime_get+0x17f/0x1c0 [ 34.933774] ? bpf_test_run+0x280/0x350 [ 34.937752] bpf_prog_test_run_skb+0x4d0/0x8c0 [ 34.942340] ? bpf_test_init.isra.1+0xc0/0xc0 [ 34.946866] ? __fget_light+0x192/0x1f0 [ 34.950829] ? bpf_prog_add+0x42/0xa0 [ 34.954628] ? fput+0xa/0x130 [ 34.957735] ? bpf_test_init.isra.1+0xc0/0xc0 [ 34.962406] SyS_bpf+0x79d/0x3640 [ 34.965879] ? bpf_prog_get+0x20/0x20 [ 34.969687] ? SyS_futex+0x1b7/0x2b5 [ 34.973424] ? SyS_futex+0x1c0/0x2b5 [ 34.977168] ? do_futex+0x17b0/0x17b0 [ 34.980975] ? up_read+0x17/0x30 [ 34.984365] ? __do_page_fault+0x64c/0xb60 [ 34.988612] ? do_syscall_64+0x43/0x4b0 [ 34.992607] ? bpf_prog_get+0x20/0x20 [ 34.996411] do_syscall_64+0x19b/0x4b0 [ 35.000319] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 35.005522] RIP: 0033:0x457099 [ 35.008704] RSP: 002b:00007f85c212ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 35.016415] RAX: ffffffffffffffda RBX: 00007f85c212f6d4 RCX: 0000000000457099 [ 35.023695] RDX: 0000000000000028 RSI: 0000000020000080 RDI: 000000000000000a [ 35.030977] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 [ 35.038247] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 35.045516] R13: 00000000004cb680 R14: 00000000004c3071 R15: 0000000000000000 [ 35.052799] [ 35.054416] The buggy address belongs to the page: [ 35.059354] page:ffffea000719ffc0 count:0 mapcount:0 mapping: (null) index:0x1 [ 35.067500] flags: 0x4000000000000000() [ 35.071471] raw: 4000000000000000 0000000000000000 0000000000000001 00000000ffffffff [ 35.079354] raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000 [ 35.087236] page dumped because: kasan: bad access detected [ 35.092941] [ 35.094559] Memory state around the buggy address: [ 35.099517] ffff8801c67ffe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.106883] ffff8801c67fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.114238] >ffff8801c67fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.121597] ^ [ 35.128872] ffff8801c6800000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.136230] ffff8801c6800080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.143612] ================================================================== [ 35.150981] Disabling lock debugging due to kernel taint [ 35.157866] Kernel panic - not syncing: panic_on_warn set ... [ 35.157866] [ 35.165262] CPU: 0 PID: 5563 Comm: syz-executor3 Tainted: G B 4.14.67+ #1 [ 35.173308] Call Trace: [ 35.175899] dump_stack+0xb9/0x11b [ 35.179429] panic+0x1bf/0x3a4 [ 35.182628] ? add_taint.cold.4+0x16/0x16 [ 35.186768] ? ___preempt_schedule+0x16/0x18 [ 35.191181] kasan_end_report+0x43/0x49 [ 35.195156] kasan_report.cold.6+0x77/0x2dd [ 35.199470] ? _copy_to_user+0x9a/0xc0 [ 35.203348] _copy_to_user+0x9a/0xc0 [ 35.207058] bpf_test_finish.isra.0+0xc8/0x190 [ 35.211674] ? bpf_test_run+0x350/0x350 [ 35.215653] ? kvm_clock_read+0x1f/0x30 [ 35.219630] ? ktime_get+0x17f/0x1c0 [ 35.223346] ? bpf_test_run+0x280/0x350 [ 35.227320] bpf_prog_test_run_skb+0x4d0/0x8c0 [ 35.231902] ? bpf_test_init.isra.1+0xc0/0xc0 [ 35.236397] ? __fget_light+0x192/0x1f0 [ 35.240365] ? bpf_prog_add+0x42/0xa0 [ 35.244157] ? fput+0xa/0x130 [ 35.247270] ? bpf_test_init.isra.1+0xc0/0xc0 [ 35.251762] SyS_bpf+0x79d/0x3640 [ 35.255226] ? bpf_prog_get+0x20/0x20 [ 35.259021] ? SyS_futex+0x1b7/0x2b5 [ 35.262728] ? SyS_futex+0x1c0/0x2b5 [ 35.266436] ? do_futex+0x17b0/0x17b0 [ 35.270230] ? up_read+0x17/0x30 [ 35.273610] ? __do_page_fault+0x64c/0xb60 [ 35.277847] ? do_syscall_64+0x43/0x4b0 [ 35.281819] ? bpf_prog_get+0x20/0x20 [ 35.285626] do_syscall_64+0x19b/0x4b0 [ 35.289523] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 35.294715] RIP: 0033:0x457099 [ 35.297885] RSP: 002b:00007f85c212ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 35.305592] RAX: ffffffffffffffda RBX: 00007f85c212f6d4 RCX: 0000000000457099 [ 35.312884] RDX: 0000000000000028 RSI: 0000000020000080 RDI: 000000000000000a [ 35.320158] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 [ 35.327427] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 35.334701] R13: 00000000004cb680 R14: 00000000004c3071 R15: 0000000000000000 [ 35.342325] Dumping ftrace buffer: [ 35.345858] (ftrace buffer empty) [ 35.349555] Kernel Offset: 0x31000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 35.360471] Rebooting in 86400 seconds..