[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 16.857474] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.418911] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 22.742739] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 23.789109] random: nonblocking pool is initialized Warning: Permanently added '10.128.15.238' (ECDSA) to the list of known hosts. 2018/01/13 03:59:16 fuzzer started 2018/01/13 03:59:16 dialing manager at 10.128.0.26:37689 2018/01/13 03:59:20 kcov=true, comps=false 2018/01/13 03:59:21 executing program 0: 2018/01/13 03:59:21 executing program 1: 2018/01/13 03:59:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) bind$inet6(r0, &(0x7f00001c1000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000df3000-0xc)=@sack_info={0x0, 0x0, 0x200}, 0xc) sendto$inet6(r0, &(0x7f0000b71000-0x2)='G', 0x1, 0x0, &(0x7f0000109000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) sendmmsg(r0, &(0x7f0000acf000-0x78)=[{{0x0, 0x0, &(0x7f000022a000)=[{&(0x7f0000a44000-0xac5)='d', 0x1}], 0x1, &(0x7f0000783000)=[], 0x0, 0x0}, 0x0}], 0x1, 0x0) 2018/01/13 03:59:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000011000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10000000010, 0x2, 0xc) write(r0, &(0x7f0000bdb000)="1f0000000601ffff2af80000000000000001100609042100011679ff080000", 0x1f) 2018/01/13 03:59:21 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f000067f000-0x1c)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) sendto$inet6(r0, &(0x7f0000352000)='8', 0x1, 0x0, &(0x7f00007bd000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000ec2000)={0x0, 0x4, 0x0, 0x0, 0x0, 0x0}, 0x14) 2018/01/13 03:59:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f00001e2000)={0x20080522, 0x0}, &(0x7f0000852000-0x18)={0x0, 0x0, 0x0, 0x0, 0x4, 0x0}) prctl$intptr(0x26, 0x1) open(&(0x7f00002c4000)='./file0\x00', 0x440, 0x44) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000060000)={0x0, 0x97d8, 0x0}, &(0x7f0000be9000-0x4)=0xc) execve(&(0x7f000005e000-0x8)='./file0\x00', &(0x7f000000a000)=[], &(0x7f0000060000-0x18)=[&(0x7f0000213000)="71041e0270eeff9cbc47ac07a8c7b3daa93a11d16ecc06a73650dee90948c7a7679da5e64f827e4de309b12c272d091e13ab880b9788c1ff9c21b1c07d5c07c63a7aea38c400fca01ba6fc081c733c855ada0bf8cc42886133cd7621715ab9a2b707b785db9c9a8adf9e6cd08bcb0cb6c11823f17f111071ec21ec3687fb252f5c3ddcecca8a78973f8bffc053ce22", &(0x7f0000016000-0xd)='+wlan0md5sum\x00']) 2018/01/13 03:59:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f00007e4000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00001aa000+0x9be)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, @ifru_map={0x2, 0x0, 0x0, 0x0, 0x0, 0x0}}) 2018/01/13 03:59:21 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000dc8000-0xd)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000745000)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005000-0x14)=[@acquire_done={0x40486311, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000008000)=""}) ppoll(&(0x7f0000a07000-0x30)=[{r0, 0x0, 0x0}], 0x1, &(0x7f00002f1000-0x8)={0x0, 0x0}, &(0x7f0000c60000)={0x0}, 0x8) [ 34.718267] IPVS: Creating netns size=2552 id=1 2018/01/13 03:59:22 executing program 1: mmap(&(0x7f0000000000/0xfc5000)=nil, 0xfc5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x20) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000fbd000-0x28)={@syzn={0x73, 0x79, 0x7a, 0xffffffffffffffff, 0x0}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000f6f000-0x18)={@loopback={0x0, 0x1}, 0x0, r1}) [ 34.949845] IPVS: Creating netns size=2552 id=2 2018/01/13 03:59:22 executing program 1: 2018/01/13 03:59:22 executing program 1: 2018/01/13 03:59:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f00001e2000)={0x20080522, 0x0}, &(0x7f0000852000-0x18)={0x0, 0x0, 0x0, 0x0, 0x4, 0x0}) prctl$intptr(0x26, 0x1) open(&(0x7f00002c4000)='./file0\x00', 0x440, 0x44) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000060000)={0x0, 0x97d8, 0x0}, &(0x7f0000be9000-0x4)=0xc) execve(&(0x7f000005e000-0x8)='./file0\x00', &(0x7f000000a000)=[], &(0x7f0000060000-0x18)=[&(0x7f0000557000)="00762d495495e7c6e902af096c09ae8ee1caf52d43b89020f813849a36c6e760a35514cfb9d5304b8470ffab97fe7594b8c35e88b123440707f84240", &(0x7f0000213000)="71041e0270eeff9cbc47ac07a8c7b3daa93a11d16ecc06a73650dee90948c7a7679da5e64f827e4de309b12c272d091e13ab880b9788c1ff9c21b1c07d5c07c63a7aea38c400fca01ba6fc081c733c855ada0bf8cc42886133cd7621715ab9a2b707b785db9c9a8adf9e6cd08bcb0cb6c11823f17f111071ec21ec3687fb252f5c3ddcecca8a78973f8bffc053ce22", &(0x7f0000016000-0xd)='+wlan0md5sum\x00']) 2018/01/13 03:59:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xb, 0x0, 0x0) timer_create(0x0, &(0x7f0000cd5000)={0x0, 0x0, 0x0, @tid=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000235000-0x4)=0x0) 2018/01/13 03:59:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x802, 0x0) connect$inet6(r0, &(0x7f0000ce8000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) sendto$inet6(r0, &(0x7f0000607000-0xb0)="", 0x0, 0x0, &(0x7f0000371000)={0xa, 0x3, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x0}, 0x1c) 2018/01/13 03:59:22 executing program 1: mmap(&(0x7f0000000000/0x57e000)=nil, 0x57e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000578000-0x38)={&(0x7f000026d000-0xc)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000577000)={&(0x7f000057b000-0x28c)=@newsa={0x158, 0x10, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, @in6=@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in6=@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0xffffffffffffffff, 0x32}, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x0, 0x0, 0x0}, [@algo_aead={0x68, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xe0, 0x80, "aafb91bab2b12fab7fd25f3ca823dc353264aff479768ecb3cc2673f"}}]}, 0x158}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 35.059574] IPVS: Creating netns size=2552 id=3 2018/01/13 03:59:22 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) bind$inet(r0, &(0x7f0000739000-0x10)={0x2, 0x1, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000852000)="", 0x0, 0x20020003, &(0x7f0000386000-0x10)={0x2, 0x1, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000f44000-0x4)=0xfffffffffffffffc, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000f8e000)={0x0, 0x20000000012c6, 0x1000010004, 0x0, 0x0}, 0x14) sendto$inet(r0, &(0x7f0000d9c000)='O', 0x1, 0x40801, 0x0, 0x0) [ 35.123566] IPVS: Creating netns size=2552 id=4 [ 35.166896] ------------[ cut here ]------------ [ 35.171712] WARNING: CPU: 1 PID: 3600 at crypto/algapi.c:343 crypto_wait_for_test+0xbb/0xd0() [ 35.180703] Kernel panic - not syncing: panic_on_warn set ... [ 35.180703] [ 35.188056] CPU: 1 PID: 3600 Comm: syz-executor1 Not tainted 4.4.111-g7902639 #25 [ 35.195646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 35.204980] 0000000000000000 f2b55ca9323ae396 ffff8801d9686f00 ffffffff81d0509d [ 35.212938] ffffffff83842f60 ffff8801d9686fd8 ffffffff839dad00 0000000000000009 [ 35.220900] 0000000000000157 ffff8801d9686fc8 ffffffff81419a3a 0000000041b58ab3 [ 35.228865] Call Trace: [ 35.231426] [] dump_stack+0xc1/0x124 [ 35.236762] [] panic+0x1aa/0x388 [ 35.241779] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 35.248683] [] ? pm_qos_get_value.part.4+0xb/0xb [ 35.255067] [] ? warn_slowpath_common+0x10a/0x140 [ 35.261549] [] warn_slowpath_common+0x125/0x140 [ 35.267837] [] ? crypto_wait_for_test+0xbb/0xd0 [ 35.274125] [] warn_slowpath_null+0x29/0x30 [ 35.280710] [] crypto_wait_for_test+0xbb/0xd0 [ 35.286837] [] crypto_register_instance+0x1f7/0x2d0 [ 35.293480] [] crypto_givcipher_default+0x483/0x5d0 [ 35.300114] [] ? setkey+0x260/0x260 [ 35.305356] [] ? crypto_larval_lookup.part.8+0x89/0x230 [ 35.312342] [] crypto_lookup_skcipher+0x1a9/0x2a0 [ 35.318802] [] crypto_alloc_ablkcipher+0x5e/0x190 [ 35.325265] [] common_rfc4106_set_key+0x118/0x630 [ 35.332247] [] ? kasan_unpoison_shadow+0x35/0x50 [ 35.338623] [] crypto_aead_setkey+0xaa/0x1c0 [ 35.344666] [] cryptd_aead_setkey+0x41/0x50 [ 35.350606] [] crypto_aead_setkey+0x162/0x1c0 [ 35.356722] [] rfc4106_set_key+0x41/0x50 [ 35.362406] [] crypto_aead_setkey+0xaa/0x1c0 [ 35.368439] [] ? crypto_larval_lookup+0x50/0x50 [ 35.374738] [] aead_geniv_setkey+0x47/0x60 [ 35.380605] [] crypto_aead_setkey+0xaa/0x1c0 [ 35.386635] [] esp6_init_state+0x20a/0xf50 [ 35.392487] [] ? esp6_destroy+0x60/0x60 [ 35.398083] [] ? __xfrm_init_state+0x363/0xb30 [ 35.404281] [] __xfrm_init_state+0x3e7/0xb30 [ 35.410308] [] xfrm_add_sa+0x1916/0x2e40 [ 35.415986] [] ? xfrm_send_state_notify+0x17d0/0x17d0 [ 35.422793] [] ? nla_parse+0x213/0x260 [ 35.428309] [] ? xfrm_send_state_notify+0x17d0/0x17d0 [ 35.435127] [] xfrm_user_rcv_msg+0x41c/0x6b0 [ 35.441152] [] ? xfrm_dump_sa_done+0xa0/0xa0 [ 35.447190] [] ? __lock_acquire+0xb5f/0x4b50 [ 35.453221] [] ? avc_has_perm_noaudit+0x460/0x460 [ 35.459689] [] netlink_rcv_skb+0x13e/0x370 [ 35.465545] [] ? xfrm_dump_sa_done+0xa0/0xa0 [ 35.471569] [] xfrm_netlink_rcv+0x6f/0x90 [ 35.477335] [] netlink_unicast+0x522/0x760 [ 35.483186] [] ? netlink_unicast+0x44f/0x760 [ 35.489211] [] ? netlink_attachskb+0x6c0/0x6c0 [ 35.495408] [] netlink_sendmsg+0x8e8/0xc50 [ 35.501260] [] ? netlink_unicast+0x760/0x760 [ 35.507296] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 35.513755] [] ? security_socket_sendmsg+0x89/0xb0 [ 35.520308] [] ? netlink_unicast+0x760/0x760 [ 35.526346] [] sock_sendmsg+0xca/0x110 [ 35.531857] [] ___sys_sendmsg+0x6c1/0x7c0 [ 35.537621] [] ? copy_msghdr_from_user+0x550/0x550 [ 35.544168] [] ? do_futex+0x3e3/0x1670 [ 35.549672] [] ? __fget+0x232/0x3b0 [ 35.554915] [] ? __fget+0x47/0x3b0 [ 35.560078] [] ? __fget_light+0xa1/0x1e0 [ 35.565756] [] ? __fdget+0x18/0x20 [ 35.570913] [] __sys_sendmsg+0xd3/0x190 [ 35.576512] [] ? SyS_shutdown+0x1b0/0x1b0 [ 35.582278] [] ? SyS_futex+0x210/0x2c0 [ 35.587789] [] ? fd_install+0x4d/0x60 [ 35.593216] [] ? move_addr_to_kernel+0x50/0x50 [ 35.599415] [] SyS_sendmsg+0x2d/0x50 [ 35.604747] [] entry_SYSCALL_64_fastpath+0x16/0x92 [ 35.611452] Dumping ftrace buffer: [ 35.615019] (ftrace buffer empty) [ 35.618708] Kernel Offset: disabled [ 35.622330] Rebooting in 86400 seconds..