[ 16.555164] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.276167] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 18.486930] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 19.327141] random: sshd: uninitialized urandom read (32 bytes read, 96 bits of entropy available) [ 19.493275] random: sshd: uninitialized urandom read (32 bytes read, 99 bits of entropy available) Warning: Permanently added '10.128.15.192' (ECDSA) to the list of known hosts. [ 24.817537] random: sshd: uninitialized urandom read (32 bytes read, 104 bits of entropy available) 2018/01/02 15:55:17 parsed 1 programs 2018/01/02 15:55:17 executed programs: 0 [ 25.083882] IPVS: Creating netns size=2552 id=1 [ 25.113654] IPVS: Creating netns size=2552 id=2 [ 25.135267] binder: 3348:3349 ioctl 40286608 5 returned -22 [ 25.141198] binder: 3348:3349 ioctl 40046205 3 returned -22 [ 25.148228] audit: type=1400 audit(1514908517.111:5): avc: denied { set_context_mgr } for pid=3348 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 25.172420] audit: type=1400 audit(1514908517.151:6): avc: denied { call } for pid=3348 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 25.176274] IPVS: Creating netns size=2552 id=3 [ 25.203389] binder: 3348:3349 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.211094] binder: 3348:3349 BC_INCREFS_DONE node 2 has no pending increfs request [ 25.214396] binder: 3354:3355 ioctl 40286608 5 returned -22 [ 25.214439] binder: 3354:3355 ioctl 40046205 3 returned -22 [ 25.215325] binder: 3354:3355 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.215333] binder: 3354:3355 BC_INCREFS_DONE node 3 has no pending increfs request [ 25.222811] binder: send failed reply for transaction 4 to 3354:3355 [ 25.227486] binder: 3354:3355 ioctl 40286608 5 returned -22 [ 25.227530] binder: 3354:3356 ioctl 40046205 3 returned -22 [ 25.235753] binder: release 3354:3355 transaction 6 out, still active [ 25.235757] binder: undelivered TRANSACTION_COMPLETE [ 25.235772] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.235774] binder: undelivered TRANSACTION_COMPLETE [ 25.235973] binder: send failed reply for transaction 6, target dead [ 25.294016] binder: 3358:3361 ioctl 40286608 5 returned -22 [ 25.299346] IPVS: Creating netns size=2552 id=4 [ 25.310353] binder: 3358:3361 ioctl 40046205 3 returned -22 [ 25.319318] binder: 3359:3362 ioctl 40286608 5 returned -22 [ 25.328291] binder: send failed reply for transaction 1 to 3348:3352 [ 25.335233] binder: 3358:3361 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.338080] binder: 3364:3365 ioctl 40286608 5 returned -22 [ 25.338203] binder: 3364:3365 ioctl 40046205 3 returned -22 [ 25.338616] binder: BINDER_SET_CONTEXT_MGR already set [ 25.338621] binder: 3364:3365 ioctl 40046207 0 returned -16 [ 25.338823] binder_alloc: 3348: binder_alloc_buf, no vma [ 25.338865] binder: 3364:3365 transaction failed 29189/-3, size 0-0 line 3128 [ 25.339033] binder: 3364:3365 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.339040] binder: 3364:3365 BC_INCREFS_DONE u0000000000000000 no match [ 25.339770] binder: 3359:3362 ioctl 40046205 3 returned -22 [ 25.340919] binder: 3359:3362 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.340926] binder: 3359:3362 BC_INCREFS_DONE node 11 has no pending increfs request [ 25.344298] binder: undelivered TRANSACTION_COMPLETE [ 25.344311] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.350001] binder: send failed reply for transaction 12 to 3359:3362 [ 25.354422] binder: 3364:3365 ioctl 40286608 5 returned -22 [ 25.354465] binder: 3364:3366 ioctl 40046205 3 returned -22 [ 25.355753] binder: 3359:3362 ioctl 40286608 5 returned -22 [ 25.355793] binder: 3359:3367 ioctl 40046205 3 returned -22 [ 25.365875] binder: release 3364:3365 transaction 15 out, still active [ 25.365879] binder: undelivered TRANSACTION_COMPLETE [ 25.365928] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.365997] binder: send failed reply for transaction 15, target dead [ 25.373077] binder: release 3359:3362 transaction 16 out, still active [ 25.373080] binder: undelivered TRANSACTION_COMPLETE [ 25.373094] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.373096] binder: undelivered TRANSACTION_COMPLETE [ 25.374997] binder: send failed reply for transaction 16, target dead [ 25.380775] binder: 3368:3370 ioctl 40286608 5 returned -22 [ 25.380818] binder: 3368:3370 ioctl 40046205 3 returned -22 [ 25.381774] binder: 3368:3370 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.381782] binder: 3368:3370 BC_INCREFS_DONE node 17 has no pending increfs request [ 25.383800] binder: 3371:3372 ioctl 40286608 5 returned -22 [ 25.383856] binder: 3371:3372 ioctl 40046205 3 returned -22 [ 25.384771] binder: 3371:3372 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.384777] binder: 3371:3372 BC_INCREFS_DONE node 19 has no pending increfs request [ 25.388332] binder: 3369:3375 ioctl 40286608 5 returned -22 [ 25.388374] binder: 3369:3375 ioctl 40046205 3 returned -22 [ 25.389977] binder: 3369:3375 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.389984] binder: 3369:3375 BC_INCREFS_DONE node 21 has no pending increfs request [ 25.393290] binder: send failed reply for transaction 18 to 3368:3370 [ 25.398170] binder: send failed reply for transaction 20 to 3371:3372 [ 25.415372] binder: 3371:3372 ioctl 40286608 5 returned -22 [ 25.415433] binder: 3371:3374 ioctl 40046205 3 returned -22 [ 25.415478] binder: 3368:3370 ioctl 40286608 5 returned -22 [ 25.415516] binder: 3368:3373 ioctl 40046205 3 returned -22 [ 25.427031] binder: send failed reply for transaction 22 to 3369:3375 [ 25.434807] binder: 3369:3375 ioctl 40286608 5 returned -22 [ 25.434866] binder: 3369:3376 ioctl 40046205 3 returned -22 [ 25.443369] binder: release 3368:3370 transaction 25 out, still active [ 25.443373] binder: undelivered TRANSACTION_COMPLETE [ 25.443388] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.443390] binder: undelivered TRANSACTION_COMPLETE [ 25.443472] binder: send failed reply for transaction 25, target dead [ 25.444224] binder: release 3371:3372 transaction 26 out, still active [ 25.444227] binder: undelivered TRANSACTION_COMPLETE [ 25.444239] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.444242] binder: undelivered TRANSACTION_COMPLETE [ 25.444315] binder: send failed reply for transaction 26, target dead [ 25.457983] binder: release 3369:3375 transaction 28 out, still active [ 25.457987] binder: undelivered TRANSACTION_COMPLETE [ 25.458001] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.458004] binder: undelivered TRANSACTION_COMPLETE [ 25.458087] binder: send failed reply for transaction 28, target dead [ 25.474077] binder: 3358:3378 ioctl 40046205 3 returned -22 [ 25.474131] binder: 3358:3377 ioctl 40286608 5 returned -22 [ 25.475507] binder: 3380:3382 ioctl 40286608 5 returned -22 [ 25.475561] binder: 3379:3383 ioctl 40286608 5 returned -22 [ 25.475603] binder: 3379:3383 ioctl 40046205 3 returned -22 [ 25.475642] binder: 3380:3382 ioctl 40046205 3 returned -22 [ 25.477576] binder: BINDER_SET_CONTEXT_MGR already set [ 25.477581] binder: 3358:3377 ioctl 40046207 0 returned -16 [ 25.477837] binder: 3379:3383 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.477845] binder: 3379:3383 BC_INCREFS_DONE node 29 has no pending increfs request [ 25.477886] binder: 3380:3382 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.477892] binder: 3380:3382 BC_INCREFS_DONE node 30 has no pending increfs request [ 25.478919] binder_alloc: 3358: binder_alloc_buf, no vma [ 25.478959] binder: 3358:3377 transaction failed 29189/-3, size 0-0 line 3128 [ 25.483995] binder: 3381:3386 ioctl 40286608 5 returned -22 [ 25.484039] binder: 3381:3386 ioctl 40046205 3 returned -22 [ 25.484966] binder: 3381:3386 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.485470] binder: 3381:3386 BC_INCREFS_DONE node 34 has no pending increfs request [ 25.487190] binder: send failed reply for transaction 31 to 3380:3382 [ 25.491422] binder: send failed reply for transaction 32 to 3379:3383 [ 25.498188] binder: 3380:3382 ioctl 40286608 5 returned -22 [ 25.498233] binder: 3380:3385 ioctl 40046205 3 returned -22 [ 25.498277] binder: 3379:3383 ioctl 40286608 5 returned -22 [ 25.498315] binder: 3379:3384 ioctl 40046205 3 returned -22 [ 25.503254] binder: send failed reply for transaction 35 to 3381:3386 [ 25.514289] binder: release 3380:3382 transaction 38 out, still active [ 25.514293] binder: undelivered TRANSACTION_COMPLETE [ 25.514307] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.514309] binder: undelivered TRANSACTION_COMPLETE [ 25.514437] binder: send failed reply for transaction 38, target dead [ 25.523063] binder: 3381:3386 ioctl 40286608 5 returned -22 [ 25.523138] binder: 3381:3387 ioctl 40046205 3 returned -22 [ 25.523288] binder: release 3379:3383 transaction 39 out, still active [ 25.523291] binder: undelivered TRANSACTION_COMPLETE [ 25.523304] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.523306] binder: undelivered TRANSACTION_COMPLETE [ 25.523452] binder: send failed reply for transaction 39, target dead [ 25.530210] binder: 3388:3390 ioctl 40286608 5 returned -22 [ 25.530257] binder: 3388:3390 ioctl 40046205 3 returned -22 [ 25.534333] binder: release 3381:3386 transaction 41 out, still active [ 25.534336] binder: undelivered TRANSACTION_COMPLETE [ 25.534389] binder: undelivered TRANSACTION_ERROR: 29189 [ 25.534392] binder: undelivered TRANSACTION_COMPLETE [ 25.534472] binder: send failed reply for transaction 41, target dead [ 25.535452] binder: 3389:3391 ioctl 40286608 5 returned -22 [ 25.535495] binder: 3388:3390 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.535503] binder: 3388:3390 BC_INCREFS_DONE node 42 has no pending increfs request [ 25.535549] binder: 3389:3391 ioctl 40046205 3 returned -22 [ 25.536858] binder: 3389:3391 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 25.536864] binder: 3389:3391 BC_INCREFS_DONE node 44 has no pending increfs request [ 25.544820] binder: send failed reply for transaction 43 to 3388:3390 [ 25.546636] binder: send failed reply for transaction 45 to 3389:3391 [ 25.556951] binder: 3388:3390 ioctl 40286608 5 returned -22 [ 25.556987] binder: 3389:3391 ioctl 40286608 5 returned -22 [ 25.557029] binder: 3388:3392 ioctl 40046205 3 returned -22 [ 25.557090] binder: 3389:3393 ioctl 40046205 3 returned -22 [ 25.567722] binder: send failed reply for transaction 48 to 3388:3390 [ 25.567725] ------------[ cut here ]------------ [ 25.567743] WARNING: CPU: 1 PID: 568 at drivers/android/binder.c:2152 binder_send_failed_reply+0x147/0x3a0() [ 25.567745] Unexpected reply error: 29189 [ 25.567889] Kernel panic - not syncing: panic_on_warn set ... [ 25.567889] [ 25.567897] CPU: 1 PID: 568 Comm: kworker/u4:2 Not tainted 4.4.107-g610c835 #4 [ 25.567900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.567910] Workqueue: binder binder_deferred_func [ 25.567919] 0000000000000000 8e0c0ff24c88c0c7 ffff8801d93af910 ffffffff81d0457d [ 25.567926] ffffffff838429a0 ffff8801d93af9e8 ffffffff83c74a40 0000000000000009 [ 25.567933] 0000000000000868 ffff8801d93af9d8 ffffffff8141774a 0000000041b58ab3 [ 25.567935] Call Trace: [ 25.567947] [] dump_stack+0xc1/0x124 [ 25.567957] [] panic+0x1aa/0x388 [ 25.567964] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 25.567972] [] ? warn_slowpath_common+0x10a/0x140 [ 25.567979] [] warn_slowpath_common+0x125/0x140 [ 25.567985] [] ? binder_send_failed_reply+0x147/0x3a0 [ 25.567991] [] warn_slowpath_fmt+0xc1/0x110 [ 25.567996] [] ? warn_slowpath_common+0x140/0x140 [ 25.568003] [] ? _binder_inner_proc_lock+0x2c/0x50 [ 25.568010] [] binder_send_failed_reply+0x147/0x3a0 [ 25.568016] [] binder_cleanup_transaction+0xd2/0x140 [ 25.568022] [] binder_release_work+0x192/0x260 [ 25.568029] [] ? _raw_spin_unlock+0x2c/0x50 [ 25.568035] [] binder_deferred_func+0x9aa/0xd10 [ 25.568043] [] ? __lock_is_held+0xa1/0xf0 [ 25.568052] [] process_one_work+0x7d7/0x16e0 [ 25.568057] [] ? process_one_work+0x6f7/0x16e0 [ 25.568063] [] ? pwq_dec_nr_in_flight+0x280/0x280 [ 25.568069] [] ? worker_thread+0x284/0xfe0 [ 25.568075] [] worker_thread+0xdf/0xfe0 [ 25.568083] [] ? __schedule+0xa99/0x1c70 [ 25.568089] [] ? preempt_schedule+0x24/0x30 [ 25.568096] [] ? ___preempt_schedule+0x12/0x14 [ 25.568102] [] kthread+0x268/0x300 [ 25.568110] [] ? trace_sched_contrib_scale_f.constprop.91+0xd6/0x2f0 [ 25.568116] [] ? process_one_work+0x16e0/0x16e0 [ 25.568122] [] ? kthread_create_on_node+0x400/0x400 [ 25.568130] [] ? kthread_create_on_node+0x400/0x400 [ 25.568136] [] ret_from_fork+0x3f/0x70 [ 25.568142] [] ? kthread_create_on_node+0x400/0x400 [ 25.573532] Dumping ftrace buffer: [ 25.573561] (ftrace buffer empty) [ 25.573564] Kernel Offset: disabled [ 26.349519] Rebooting in 86400 seconds..