[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.734257] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 25.702202] random: sshd: uninitialized urandom read (32 bytes read, 41 bits of entropy available) [ 26.261138] random: sshd: uninitialized urandom read (32 bytes read, 41 bits of entropy available) [ 27.200955] random: sshd: uninitialized urandom read (32 bytes read, 116 bits of entropy available) [ 27.395751] random: sshd: uninitialized urandom read (32 bytes read, 120 bits of entropy available) Warning: Permanently added '10.128.0.41' (ECDSA) to the list of known hosts. [ 32.787193] random: sshd: uninitialized urandom read (32 bytes read, 128 bits of entropy available) executing program [ 32.881724] ================================================================== [ 32.889097] BUG: KASAN: use-after-free in ip6_xmit+0x1a2c/0x1a70 [ 32.895211] Read of size 8 at addr ffff8800b774e658 by task syzkaller141870/3753 [ 32.902707] [ 32.904306] CPU: 1 PID: 3753 Comm: syzkaller141870 Not tainted 4.4.120-gd63fdf6 #28 [ 32.912064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.921385] 0000000000000000 ae83b1d13a004493 ffff8801ca0377e0 ffffffff81d0408d [ 32.929347] ffffea0002ddd380 ffff8800b774e658 0000000000000000 ffff8800b774e658 [ 32.937304] 0000000000000040 ffff8801ca037818 ffffffff814fe143 ffff8800b774e658 [ 32.945279] Call Trace: [ 32.947839] [] dump_stack+0xc1/0x124 [ 32.953172] [] print_address_description+0x73/0x260 [ 32.959803] [] kasan_report+0x285/0x370 [ 32.965396] [] ? ip6_xmit+0x1a2c/0x1a70 [ 32.970990] [] __asan_report_load8_noabort+0x14/0x20 [ 32.977710] [] ip6_xmit+0x1a2c/0x1a70 [ 32.983128] [] ? kfree+0xfc/0x300 [ 32.988198] [] ? pskb_expand_head+0x28b/0x980 [ 32.994310] [] ? l2tp_xmit_skb+0xa5e/0xea0 [ 33.000163] [] ? ip6_finish_output2+0x1c60/0x1c60 [ 33.006624] [] ? __lock_is_held+0xa1/0xf0 [ 33.012389] [] ? ipv4_dst_check+0x111/0x160 [ 33.018325] [] ? __sk_dst_check+0x148/0x260 [ 33.024263] [] inet6_csk_xmit+0x246/0x480 [ 33.030036] [] ? inet6_csk_xmit+0x100/0x480 [ 33.035974] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 33.042521] [] ? udp6_set_csum+0x336/0xa80 [ 33.048370] [] l2tp_xmit_skb+0xc2f/0xea0 [ 33.054047] [] pppol2tp_sendmsg+0x584/0x7f0 [ 33.059986] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 33.066447] [] ? pppol2tp_release+0x310/0x310 [ 33.072562] [] sock_sendmsg+0xca/0x110 [ 33.078065] [] SYSC_sendto+0x2c8/0x340 [ 33.083566] [] ? SYSC_connect+0x310/0x310 [ 33.089335] [] ? lock_sock_nested+0xdc/0x120 [ 33.095359] [] ? ip6_datagram_connect+0x3a/0x50 [ 33.101647] [] ? inet_dgram_connect+0x172/0x1f0 [ 33.107931] [] ? SYSC_connect+0x212/0x310 [ 33.113698] [] ? retint_user+0x18/0x3c [ 33.119203] [] SyS_sendto+0x40/0x50 [ 33.124448] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 33.130994] [ 33.132594] Allocated by task 3734: [ 33.136188] [] save_stack_trace+0x26/0x50 [ 33.142071] [] save_stack+0x43/0xd0 [ 33.147433] [] kasan_kmalloc+0xad/0xe0 [ 33.153055] [] kasan_slab_alloc+0x12/0x20 [ 33.158936] [] kmem_cache_alloc+0xba/0x290 [ 33.164904] [] dst_alloc+0x11f/0x1a0 [ 33.170351] [] rt_dst_alloc+0x78/0x430 [ 33.175978] [] __ip_route_output_key_hash+0xa4e/0x2390 [ 33.182987] [] __ip4_datagram_connect+0xa15/0x1150 [ 33.189648] [] __ip6_datagram_connect+0x4d9/0x1950 [ 33.196309] [] ip6_datagram_connect+0x2f/0x50 [ 33.202533] [] inet_dgram_connect+0x16b/0x1f0 [ 33.208757] [] SYSC_connect+0x1b6/0x310 [ 33.214461] [] SyS_connect+0x24/0x30 [ 33.219910] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 33.226579] [ 33.228173] Freed by task 0: [ 33.231156] [] save_stack_trace+0x26/0x50 [ 33.237038] [] save_stack+0x43/0xd0 [ 33.242393] [] kasan_slab_free+0x72/0xc0 [ 33.248186] [] kmem_cache_free+0xc7/0x320 [ 33.254063] [] dst_destroy+0x20e/0x330 [ 33.259683] [] dst_destroy_rcu+0x15/0x40 [ 33.265476] [] rcu_process_callbacks+0x7f4/0x14a0 [ 33.272053] [] __do_softirq+0x227/0xa38 [ 33.277762] [ 33.279360] The buggy address belongs to the object at ffff8800b774e640 [ 33.279360] which belongs to the cache ip_dst_cache of size 208 [ 33.292078] The buggy address is located 24 bytes inside of [ 33.292078] 208-byte region [ffff8800b774e640, ffff8800b774e710) [ 33.303840] The buggy address belongs to the page: [ 34.738830] ------------[ cut here ]------------ [ 34.743608] WARNING: CPU: 1 PID: -951831168 at kernel/locking/lockdep.c:3123 __lock_acquire+0x1625/0x4b50() [ 34.753451] DEBUG_LOCKS_WARN_ON(depth >= MAX_LOCK_DEPTH) [ 34.758692] Kernel panic - not syncing: panic_on_warn set ... [ 34.758692] [ 34.766311] CPU: 1 PID: -951831168 Comm: `Šƒÿÿÿÿ Not tainted 4.4.120-gd63fdf6 #28 [ 34.773983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.783312] 0000000000000000 ae83b1d13a004493 ffff8801db30c940 ffffffff81d0408d [ 34.791275] ffffffff83843b40 ffff8801db30ca18 ffffffff83855920 0000000000000009 [ 34.799237] 0000000000000c33 ffff8801db30ca08 ffffffff8141ab2a 0000000041b58ab3 [ 34.807194] Call Trace: [ 34.809751] <#DF> [] dump_stack+0xc1/0x124 [ 34.815815] [] panic+0x1aa/0x388 [ 34.820798] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 34.827691] [] ? warn_slowpath_common+0x10a/0x140 [ 34.834149] [] warn_slowpath_common+0x125/0x140 [ 34.840439] [] ? __lock_acquire+0x1625/0x4b50 [ 34.846555] [] warn_slowpath_fmt+0xc1/0x110 [ 34.852491] [] ? warn_slowpath_common+0x140/0x140 [ 34.858948] [] __lock_acquire+0x1625/0x4b50 [ 34.864886] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 34.871865] [] lock_acquire+0x15e/0x460 [ 34.877455] [] ? vprintk_emit+0xa5/0x850 [ 34.883134] [] _raw_spin_lock+0x36/0x50 [ 34.888724] [] ? vprintk_emit+0xa5/0x850 [ 34.894400] [] vprintk_emit+0xa5/0x850 [ 34.899905] [] ? kprobe_exceptions_notify+0x80/0x160 [ 34.906630] [] ? kasan_die_handler+0x18/0x40 [ 34.912655] [] vprintk+0x28/0x30 [ 34.917636] [] vprintk_default+0x1d/0x30 [ 34.923315] [] printk+0xb7/0xe2 [ 34.928210] [] ? pm_qos_get_value.part.4+0xb/0xb [ 34.934588] [] df_debug+0x14/0x30 [ 34.939660] [] do_double_fault+0x10b/0x210 [ 34.945525] [] double_fault+0x2d/0x40 [ 34.950950] [] ? dump_page_badflags+0x180/0x250 [ 34.957238] [] ? dump_page_badflags+0x4/0x250 [ 34.963346] <> [ 34.966810] Dumping ftrace buffer: [ 34.970615] (ftrace buffer empty) [ 34.974293] Kernel Offset: disabled [ 34.977887] Rebooting in 86400 seconds..