[ 15.533525] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.540213] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 19.801623] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 20.580209] random: sshd: uninitialized urandom read (32 bytes read, 83 bits of entropy available) [ 20.753740] random: sshd: uninitialized urandom read (32 bytes read, 88 bits of entropy available) Warning: Permanently added '10.128.15.228' (ECDSA) to the list of known hosts. [ 26.936624] random: sshd: uninitialized urandom read (32 bytes read, 96 bits of entropy available) executing program [ 27.034045] ================================================================== [ 27.041424] BUG: KASAN: slab-out-of-bounds in strnlen+0xc1/0xd0 [ 27.047449] Read of size 1 at addr ffff8801d1dfd490 by task syzkaller419834/3310 [ 27.054949] [ 27.056546] CPU: 1 PID: 3310 Comm: syzkaller419834 Not tainted 4.4.113-ge70c132 #27 [ 27.064305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.073628] 0000000000000000 3a0086785c7834f7 ffff8800b49ef5c0 ffffffff81d0278d [ 27.081590] ffffea0007477f40 ffff8801d1dfd490 0000000000000000 ffff8801d1dfd490 [ 27.089561] ffff8800b49ef890 ffff8800b49ef5f8 ffffffff814fd053 ffff8801d1dfd490 [ 27.097521] Call Trace: [ 27.100081] [] dump_stack+0xc1/0x124 [ 27.105414] [] print_address_description+0x73/0x260 [ 27.112061] [] kasan_report+0x285/0x370 [ 27.117658] [] ? strnlen+0xc1/0xd0 [ 27.122843] [] __asan_report_load1_noabort+0x14/0x20 [ 27.129561] [] strnlen+0xc1/0xd0 [ 27.134545] [] string.isra.4+0x4c/0x240 [ 27.140135] [] ? format_decode+0x118/0xa50 [ 27.145985] [] vsnprintf+0x766/0x15f0 [ 27.151404] [] ? pointer.isra.22+0xa00/0xa00 [ 27.157443] [] ? __mutex_unlock_slowpath+0x242/0x3b0 [ 27.164163] [] __request_module+0x14f/0x810 [ 27.170105] [] ? __ww_mutex_lock_interruptible+0x14d0/0x14d0 [ 27.177519] [] ? call_usermodehelper_setup+0x2c0/0x2c0 [ 27.184422] [] ? __mutex_unlock_slowpath+0x208/0x3b0 [ 27.191142] [] ? mutex_unlock+0x9/0x10 [ 27.196647] [] ? xt_find_target+0x17b/0x1e0 [ 27.202584] [] xt_request_find_target+0x8b/0xb0 [ 27.208871] [] translate_compat_table+0x568/0x1760 [ 27.215417] [] ? ipt_register_table+0x1f0/0x1f0 [ 27.221703] [] ? __might_fault+0xe4/0x1d0 [ 27.227471] [] ? check_stack_object+0x68/0x140 [ 27.233673] [] ? __check_object_size+0x154/0x35b [ 27.240047] [] ? 0xffffffff810002b8 [ 27.245291] [] compat_do_replace.isra.15+0x1f1/0x410 [ 27.252011] [] ? translate_compat_table+0x1760/0x1760 [ 27.258818] [] ? mark_held_locks+0xaf/0x100 [ 27.264757] [] ? ns_capable_common+0xcf/0x160 [ 27.271401] [] compat_do_ipt_set_ctl+0x106/0x150 [ 27.277778] [] compat_nf_setsockopt+0x88/0x130 [ 27.283977] [] ? compat_do_replace.isra.15+0x410/0x410 [ 27.290872] [] compat_ip_setsockopt+0x9d/0xf0 [ 27.296989] [] compat_udp_setsockopt+0x45/0x80 [ 27.303193] [] compat_sock_common_setsockopt+0xb2/0x140 [ 27.310177] [] ? udp_lib_setsockopt+0x560/0x560 [ 27.316466] [] compat_SyS_setsockopt+0x149/0x290 [ 27.322840] [] ? sock_common_setsockopt+0xd0/0xd0 [ 27.329300] [] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 27.335846] [] ? vmacache_update+0xfe/0x130 [ 27.341786] [] ? do_fast_syscall_32+0xd7/0x890 [ 27.347989] [] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 27.354538] [] do_fast_syscall_32+0x314/0x890 [ 27.360654] [] sysenter_flags_fixed+0xd/0x17 [ 27.366680] [ 27.368275] Allocated by task 3310: [ 27.371865] [] save_stack_trace+0x26/0x50 [ 27.377757] [] save_stack+0x43/0xd0 [ 27.383118] [] kasan_kmalloc+0xad/0xe0 [ 27.388741] [] __kmalloc+0x124/0x320 [ 27.394188] [] xt_alloc_table_info+0x71/0x100 [ 27.400418] [] compat_do_replace.isra.15+0x16b/0x410 [ 27.407254] [] compat_do_ipt_set_ctl+0x106/0x150 [ 27.413749] [] compat_nf_setsockopt+0x88/0x130 [ 27.420075] [] compat_ip_setsockopt+0x9d/0xf0 [ 27.426307] [] compat_udp_setsockopt+0x45/0x80 [ 27.432623] [] compat_sock_common_setsockopt+0xb2/0x140 [ 27.439726] [] compat_SyS_setsockopt+0x149/0x290 [ 27.446219] [] do_fast_syscall_32+0x314/0x890 [ 27.452448] [] sysenter_flags_fixed+0xd/0x17 [ 27.458592] [ 27.460190] Freed by task 1768: [ 27.463434] [] save_stack_trace+0x26/0x50 [ 27.469314] [] save_stack+0x43/0xd0 [ 27.474676] [] kasan_slab_free+0x72/0xc0 [ 27.480470] [] kfree+0xfc/0x300 [ 27.485487] [] kernfs_fop_release+0xff/0x140 [ 27.491628] [] __fput+0x233/0x6d0 [ 27.496812] [] ____fput+0x15/0x20 [ 27.501998] [] task_work_run+0x104/0x180 [ 27.507793] [] exit_to_usermode_loop+0x13d/0x160 [ 27.514286] [] syscall_return_slowpath+0x1b5/0x1f0 [ 27.520945] [] int_ret_from_sys_call+0x25/0xa3 [ 27.527259] [ 27.528860] The buggy address belongs to the object at ffff8801d1dfd3c0 [ 27.528860] which belongs to the cache kmalloc-256 of size 256 [ 27.541487] The buggy address is located 208 bytes inside of [ 27.541487] 256-byte region [ffff8801d1dfd3c0, ffff8801d1dfd4c0) [ 27.553338] The buggy address belongs to the page: [ 27.566986] page:ffffea0007477f40 count:1 mapcount:-2146697203 mapping: (null) index:0x0 [ 27.566995] kasan: CONFIG_KASAN_INLINE enabled [ 27.567002] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 27.567006] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 27.567010] Dumping ftrace buffer: [ 27.567013] (ftrace buffer empty) [ 27.567015] Modules linked in: [ 27.567021] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.113-ge70c132 #27 [ 27.567024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.567027] task: ffffffff84217840 task.stack: ffffffff84200000 [ 27.567040] RIP: 0010:[] [] rb_insert_color+0x1d0/0xcb0 [ 27.567043] RSP: 0018:ffff8801db207d18 EFLAGS: 00010806 [ 27.567047] RAX: ffff8801db219c40 RBX: ffffea0007477f40 RCX: 1000000000000012 [ 27.567051] RDX: dffffc0000000000 RSI: ffff8801db219710 RDI: ffffea0007477f50 [ 27.567054] RBP: ffff8801db207d60 R08: ffffffff8580af08 R09: 0000000000000001 [ 27.567057] R10: 0000000000000000 R11: 1ffff1003b640f62 R12: 8000000000000090 [ 27.567061] R13: 8000000000000080 R14: 8000000000000080 R15: ffff8801db219c48 [ 27.567066] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 27.567069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.567073] CR2: 000055557db83100 CR3: 00000000b5b2a000 CR4: 0000000000160670 [ 27.567079] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.567082] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.567084] Stack: [ 27.567091] ffffffff842bdb20 ffffffff842180b0 0000000000000000 ffff8801db207d70 [ 27.567098] ffff8801db219c40 dffffc0000000000 0000000000000000 ffff8801db219710 [ 27.567105] ffff8800b4887e00 ffff8801db207db0 ffffffff81d20067 ffff8801db219c58 [ 27.567106] Call Trace: [ 27.567116] [ 27.567116] [] timerqueue_add+0x157/0x2a0 [ 27.567125] [] enqueue_hrtimer+0x168/0x450 [ 27.567131] [] __hrtimer_run_queues+0x732/0xfe0 [ 27.567137] [] ? hrtimer_fixup_init+0x70/0x70 [ 27.567144] [] ? hrtimer_interrupt+0x131/0x440 [ 27.567150] [] hrtimer_interrupt+0x1a6/0x440 [ 27.567158] [] local_apic_timer_interrupt+0x6a/0xb0 [ 27.567182] [] smp_apic_timer_interrupt+0x76/0xa0 [ 27.567188] [] apic_timer_interrupt+0xa0/0xb0 [ 27.567198] [ 27.567198] [] ? native_safe_halt+0x6/0x10 [ 27.567205] [] default_idle+0x55/0x3c0 [ 27.567211] [] arch_cpu_idle+0xa/0x10 [ 27.567219] [] default_idle_call+0x48/0x70 [ 27.567225] [] cpu_startup_entry+0x5fd/0x8f0 [ 27.567231] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 27.567237] [] ? call_cpuidle+0xe0/0xe0 [ 27.567244] [] rest_init+0x189/0x190 [ 27.567251] [] start_kernel+0x6b9/0x6ee [ 27.567257] [] ? thread_stack_cache_init+0xb/0xb [ 27.567263] [] ? early_idt_handler_array+0x120/0x120 [ 27.567270] [] ? early_idt_handler_array+0x120/0x120 [ 27.567276] [] x86_64_start_reservations+0x2a/0x2c [ 27.567282] [] x86_64_start_kernel+0x140/0x163 [ 27.567366] Code: 48 c1 e9 03 80 3c 11 00 0f 85 83 06 00 00 4d 85 ed 48 89 03 74 5b 4d 8d 65 10 48 ba 00 00 00 00 00 fc ff df 4c 89 e1 48 c1 e9 03 <80> 3c 11 00 0f 85 19 07 00 00 49 3b 5d 10 0f 84 eb 04 00 00 49 [ 27.567372] RIP [] rb_insert_color+0x1d0/0xcb0 [ 27.567374] RSP [ 27.567380] ---[ end trace 8947dbf9570c1c35 ]--- [ 27.567384] Kernel panic - not syncing: Fatal exception in interrupt [ 27.924308] flags: 0xffff8801db219c40(active|reserved|private|private_2|swapcache|mappedtodisk|uncached) [ 27.934862] page dumped because: VM_BUG_ON_PAGE(PageSlab(page)) [ 27.940907] ------------[ cut here ]------------ [ 27.945637] kernel BUG at include/linux/mm.h:460! [ 27.950454] invalid opcode: 0000 [#2] PREEMPT SMP KASAN [ 27.956261] Dumping ftrace buffer: [ 27.959770] (ftrace buffer empty) [ 27.963456] Modules linked in: [ 27.966744] CPU: 1 PID: 3310 Comm: syzkaller419834 Tainted: G D 4.4.113-ge70c132 #27 [ 27.975726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.985144] task: ffff8800b55c5f00 task.stack: ffff8800b49e8000 [ 27.991173] RIP: 0010:[] [] dump_page_badflags+0x191/0x250 [ 28.000110] RSP: 0018:ffff8800b1eb3570 EFLAGS: 00010082 [ 28.005533] RAX: ffff8800b55c5f00 RBX: ffffea0007477f40 RCX: ffffffff8148f8bc [ 28.012778] RDX: 0000000000000000 RSI: ffffffff839fe320 RDI: ffff8800b55c676c [ 28.020025] RBP: ffff8800b1eb35a0 R08: 0000000000000001 R09: 0000000000000000 [ 28.027269] R10: 0000000000000002 R11: fffffbfff0ad7e28 R12: 0000000000000000 [ 28.034513] R13: ffffffff838a8de0 R14: 0000000000000000 R15: 0000000000000000 [ 28.041760] FS: 0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:0000000009c83840 [ 28.049958] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 28.055813] CR2: 0000000020f20000 CR3: 00000001d222e000 CR4: 0000000000160670 [ 28.063060] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.070305] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.077547] Stack: [ 28.079671] 0000000000000000 ffffea0007477f40 0000000000000000 ffffffff838a8de0 [ 28.087657] 0000000000000000 0000000000000000 ffff8800b1eb35e0 ffffffff8148f8e1 [ 28.095655] 0000000000000000 ffffea0007477f40 0000000000000000 ffffffff838a8de0 [ 28.103636] Call Trace: [ 28.106195] [ 28.108240] Code: [ 28.110482] usercopy: kernel memory overwrite attempt detected to ffff8800b1eb3297 (names_cache) (1 bytes) [ 28.120260] ------------[ cut here ]------------ [ 28.124992] kernel BUG at mm/usercopy.c:76! [ 28.129285] invalid opcode: 0000 [#3] PREEMPT SMP KASAN [ 28.135101] Dumping ftrace buffer: [ 28.138612] (ftrace buffer empty) [ 28.142299] Modules linked in: [ 28.145590] CPU: 1 PID: 3310 Comm: syzkaller419834 Tainted: G D 4.4.113-ge70c132 #27 [ 28.154568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.163896] task: ffff8800b55c5f00 task.stack: ffff8800b49e8000 [ 28.169923] RIP: 0010:[] [] __check_object_size+0x1e6/0x35b [ 28.178948] RSP: 0018:ffff8800b1eb3208 EFLAGS: 00010086 [ 28.184370] RAX: 000000000000005e RBX: ffff8800b1eb3297 RCX: ffffffff81269242 [ 28.191612] RDX: 0000000000000000 RSI: ffffffff839fe320 RDI: ffff8800b55c676c [ 28.198857] RBP: ffff8800b1eb3248 R08: 0000000000000001 R09: 0000000000000000 [ 28.206099] R10: 0000000000001100 R11: fffffbfff0ad7e2d R12: 0000000000000001 [ 28.213342] R13: ffffffff838b3a20 R14: 0000000000000000 R15: ffffffff838b39e0 [ 28.220586] FS: 0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:0000000009c83840 [ 28.228784] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 28.234640] CR2: 0000000020f20000 CR3: 00000001d222e000 CR4: 0000000000160670 [ 28.241888] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.249132] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.256376] Stack: [ 28.258498] ffff8801db2fffc0 ffff8800b1eb3298 ffffffff838b68a0 ffff8800b1eb3297 [ 28.266484] 0000000000000001 0000000000000000 ffffffff8148f8b6 ffff8800b55c5f00 [ 28.274478] ffff8800b1eb3280 ffffffff8142ac89 ffff8800b1eb34c8 ffffffff8148f8b6 [ 28.282462] Call Trace: [ 28.285016] [ 28.287048] Code: 3a 8b 83 4c 0f 44 ea e8 59 b6 e4 ff 48 8b 45 d0 4d 89 e1 48 89 d9 4c 89 fa 4c 89 ee 48 c7 c7 60 3a 8b 83 49 89 c0 e8 20 61 f0 ff <0f> 0b 48 89 55 c0 e8 2f b6 e4 ff 48 8b 55 c0 48 b8 ff ff ff 7f [ 28.314207] RIP [] __check_object_size+0x1e6/0x35b [ 28.320881] RSP [ 28.324483] ---[ end trace 8947dbf9570c1c36 ]--- [ 28.672451] Shutting down cpus with NMI [ 28.676994] Dumping ftrace buffer: [ 28.680512] (ftrace buffer empty) [ 28.684189] Kernel Offset: disabled [ 28.687783] Rebooting in 86400 seconds..