[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 12.993855] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.186569] random: sshd: uninitialized urandom read (32 bytes read) [ 21.735854] random: sshd: uninitialized urandom read (32 bytes read) [ 22.350211] random: sshd: uninitialized urandom read (32 bytes read) [ 68.398720] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.8' (ECDSA) to the list of known hosts. [ 73.818531] random: sshd: uninitialized urandom read (32 bytes read) 2018/05/12 11:09:44 parsed 1 programs 2018/05/12 11:09:44 executed programs: 0 [ 74.277450] IPVS: Creating netns size=2536 id=1 [ 74.298123] IPVS: Creating netns size=2536 id=2 [ 74.331554] IPVS: Creating netns size=2536 id=3 [ 74.362600] IPVS: Creating netns size=2536 id=4 [ 74.391192] IPVS: Creating netns size=2536 id=5 [ 74.402410] IPVS: Creating netns size=2536 id=6 [ 74.423800] IPVS: Creating netns size=2536 id=7 [ 74.452265] IPVS: Creating netns size=2536 id=8 [ 74.757397] ================================================================== [ 74.764812] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 74.771539] Read of size 8 at addr ffff8801d7ef73e0 by task blkid/3993 [ 74.778173] [ 74.779777] CPU: 0 PID: 3993 Comm: blkid Not tainted 4.9.99-gc2f9bce #25 [ 74.786584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 74.795913] ffff8801d78f76d8 ffffffff81eb0f09 ffffea00075fbc00 ffff8801d7ef73e0 [ 74.803898] 0000000000000000 ffff8801d7ef73e0 0000000000000000 ffff8801d78f7710 [ 74.811900] ffffffff815652eb ffff8801d7ef73e0 0000000000000008 0000000000000000 [ 74.819879] Call Trace: [ 74.822440] [] dump_stack+0xc1/0x128 [ 74.827776] [] print_address_description+0x6c/0x234 [ 74.834415] [] kasan_report.cold.6+0x242/0x2fe [ 74.840632] [] ? disk_unblock_events+0x51/0x60 [ 74.846835] [] __asan_report_load8_noabort+0x14/0x20 [ 74.853558] [] disk_unblock_events+0x51/0x60 [ 74.859589] [] __blkdev_get+0x6b6/0xd60 [ 74.865184] [] ? __blkdev_put+0x840/0x840 [ 74.870953] [] ? fsnotify+0x114/0x1100 [ 74.876462] [] blkdev_get+0x2da/0x920 [ 74.881886] [] ? bd_may_claim+0xd0/0xd0 [ 74.887485] [] ? bd_acquire+0x27/0x250 [ 74.892993] [] ? bd_acquire+0x88/0x250 [ 74.898507] [] ? _raw_spin_unlock+0x2c/0x50 [ 74.904449] [] blkdev_open+0x1a5/0x250 [ 74.909961] [] do_dentry_open+0x703/0xc80 [ 74.915730] [] ? blkdev_get_by_dev+0x70/0x70 [ 74.921760] [] vfs_open+0x11c/0x210 [ 74.927008] [] ? may_open.isra.57+0x14f/0x2a0 [ 74.933131] [] path_openat+0x758/0x3590 [ 74.938740] [] ? save_stack+0xa9/0xd0 [ 74.944336] [] ? path_lookupat.isra.41+0x410/0x410 [ 74.950888] [] ? __lock_is_held+0xa2/0xf0 [ 74.956655] [] do_filp_open+0x197/0x270 [ 74.962250] [] ? may_open_dev+0xe0/0xe0 [ 74.967845] [] ? _raw_spin_unlock+0x2c/0x50 [ 74.973799] [] ? __alloc_fd+0x1d7/0x4a0 [ 74.979394] [] do_sys_open+0x30d/0x5c0 [ 74.984924] [] ? filp_open+0x70/0x70 [ 74.990258] [] ? up_read+0x1a/0x40 [ 74.995423] [] ? __do_page_fault+0x183/0xd50 [ 75.001452] [] SyS_open+0x2d/0x40 [ 75.006529] [] ? do_sys_open+0x5c0/0x5c0 [ 75.012213] [] do_syscall_64+0x1a6/0x490 [ 75.017905] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 75.024799] [ 75.026401] Allocated by task 3983: [ 75.030000] save_stack_trace+0x16/0x20 [ 75.033943] save_stack+0x43/0xd0 [ 75.037366] kasan_kmalloc+0xc7/0xe0 [ 75.041051] kmem_cache_alloc_trace+0xfd/0x2b0 [ 75.045604] alloc_disk_node+0x54/0x3a0 [ 75.049560] alloc_disk+0x18/0x20 [ 75.052984] loop_add+0x33b/0x770 [ 75.056408] loop_probe+0x14f/0x180 [ 75.060009] kobj_lookup+0x223/0x410 [ 75.063692] get_gendisk+0x39/0x2d0 [ 75.067291] __blkdev_get+0x351/0xd60 [ 75.071062] blkdev_get+0x2da/0x920 [ 75.074661] blkdev_open+0x1a5/0x250 [ 75.078345] do_dentry_open+0x703/0xc80 [ 75.082303] vfs_open+0x11c/0x210 [ 75.085744] path_openat+0x758/0x3590 [ 75.089514] do_filp_open+0x197/0x270 [ 75.093285] do_sys_open+0x30d/0x5c0 [ 75.096981] compat_SyS_open+0x2a/0x40 [ 75.101233] do_fast_syscall_32+0x2f7/0x870 [ 75.105528] entry_SYSENTER_compat+0x90/0xa2 [ 75.109912] [ 75.111513] Freed by task 3993: [ 75.114766] save_stack_trace+0x16/0x20 [ 75.118711] save_stack+0x43/0xd0 [ 75.122136] kasan_slab_free+0x72/0xc0 [ 75.125994] kfree+0xfb/0x310 [ 75.129071] disk_release+0x259/0x330 [ 75.132844] device_release+0x7e/0x220 [ 75.136704] kobject_release+0x103/0x1b0 [ 75.140735] kobject_put+0x6d/0xd0 [ 75.144247] put_disk+0x23/0x30 [ 75.147500] __blkdev_get+0x616/0xd60 [ 75.151274] blkdev_get+0x2da/0x920 [ 75.154873] blkdev_open+0x1a5/0x250 [ 75.158559] do_dentry_open+0x703/0xc80 [ 75.162504] vfs_open+0x11c/0x210 [ 75.165928] path_openat+0x758/0x3590 [ 75.169699] do_filp_open+0x197/0x270 [ 75.173992] do_sys_open+0x30d/0x5c0 [ 75.177676] SyS_open+0x2d/0x40 [ 75.180928] do_syscall_64+0x1a6/0x490 [ 75.184786] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 75.189856] [ 75.191457] The buggy address belongs to the object at ffff8801d7ef6e80 [ 75.191457] which belongs to the cache kmalloc-2048 of size 2048 [ 75.204258] The buggy address is located 1376 bytes inside of [ 75.204258] 2048-byte region [ffff8801d7ef6e80, ffff8801d7ef7680) [ 75.216271] The buggy address belongs to the page: [ 75.221185] page:ffffea00075fbc00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 75.231372] flags: 0x8000000000004080(slab|head) [ 75.236094] page dumped because: kasan: bad access detected [ 75.241773] [ 75.243370] Memory state around the buggy address: [ 75.248281] ffff8801d7ef7280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.255610] ffff8801d7ef7300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.262939] >ffff8801d7ef7380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.270267] ^ [ 75.276727] ffff8801d7ef7400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.284057] ffff8801d7ef7480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.291394] ================================================================== [ 75.298721] Disabling lock debugging due to kernel taint [ 75.304324] Kernel panic - not syncing: panic_on_warn set ... [ 75.304324] [ 75.311674] CPU: 0 PID: 3993 Comm: blkid Tainted: G B 4.9.99-gc2f9bce #25 [ 75.319698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 75.329023] ffff8801d78f7638 ffffffff81eb0f09 ffffffff843c5065 00000000ffffffff [ 75.337001] 0000000000000000 0000000000000000 0000000000000000 ffff8801d78f76f8 [ 75.345005] ffffffff8141f855 0000000041b58ab3 ffffffff843b8768 ffffffff8141f696 [ 75.352994] Call Trace: [ 75.355558] [] dump_stack+0xc1/0x128 [ 75.360893] [] panic+0x1bf/0x3bc [ 75.365880] [] ? add_taint.cold.6+0x16/0x16 [ 75.371822] [] ? ___preempt_schedule+0x16/0x18 [ 75.378023] [] kasan_end_report+0x47/0x4f [ 75.383792] [] kasan_report.cold.6+0x76/0x2fe [ 75.389909] [] ? disk_unblock_events+0x51/0x60 [ 75.396113] [] __asan_report_load8_noabort+0x14/0x20 [ 75.402837] [] disk_unblock_events+0x51/0x60 [ 75.408868] [] __blkdev_get+0x6b6/0xd60 [ 75.414465] [] ? __blkdev_put+0x840/0x840 [ 75.420235] [] ? fsnotify+0x114/0x1100 [ 75.425743] [] blkdev_get+0x2da/0x920 [ 75.431163] [] ? bd_may_claim+0xd0/0xd0 [ 75.436758] [] ? bd_acquire+0x27/0x250 [ 75.442266] [] ? bd_acquire+0x88/0x250 [ 75.447777] [] ? _raw_spin_unlock+0x2c/0x50 [ 75.453718] [] blkdev_open+0x1a5/0x250 [ 75.459226] [] do_dentry_open+0x703/0xc80 [ 75.464994] [] ? blkdev_get_by_dev+0x70/0x70 [ 75.471023] [] vfs_open+0x11c/0x210 [ 75.476272] [] ? may_open.isra.57+0x14f/0x2a0 [ 75.482390] [] path_openat+0x758/0x3590 [ 75.487989] [] ? save_stack+0xa9/0xd0 [ 75.493424] [] ? path_lookupat.isra.41+0x410/0x410 [ 75.499980] [] ? __lock_is_held+0xa2/0xf0 [ 75.505749] [] do_filp_open+0x197/0x270 [ 75.511345] [] ? may_open_dev+0xe0/0xe0 [ 75.516945] [] ? _raw_spin_unlock+0x2c/0x50 [ 75.522896] [] ? __alloc_fd+0x1d7/0x4a0 [ 75.528493] [] do_sys_open+0x30d/0x5c0 [ 75.533999] [] ? filp_open+0x70/0x70 [ 75.539333] [] ? up_read+0x1a/0x40 [ 75.544496] [] ? __do_page_fault+0x183/0xd50 [ 75.550538] [] SyS_open+0x2d/0x40 [ 75.555699] [] ? do_sys_open+0x5c0/0x5c0 [ 75.561396] [] do_syscall_64+0x1a6/0x490 [ 75.567080] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 75.574418] Dumping ftrace buffer: [ 75.577933] (ftrace buffer empty) [ 75.581617] Kernel Offset: disabled [ 75.585219] Rebooting in 86400 seconds..