[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 16.653428] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 17.636693] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 17.954357] random: sshd: uninitialized urandom read (32 bytes read) [ 18.648342] random: sshd: uninitialized urandom read (32 bytes read) [ 54.240578] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.47' (ECDSA) to the list of known hosts. [ 59.733743] random: sshd: uninitialized urandom read (32 bytes read) net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 59.824443] IPVS: ftp: loaded support on port[0] = 21 [ 59.995174] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.002066] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.009648] device bridge_slave_0 entered promiscuous mode [ 60.026100] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.032574] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.039795] device bridge_slave_1 entered promiscuous mode [ 60.054333] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 60.070292] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 60.107982] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 60.125511] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 60.179102] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 60.186253] team0: Port device team_slave_0 added [ 60.200440] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 60.207491] team0: Port device team_slave_1 added [ 60.219646] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 60.233823] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 60.250343] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 60.267384] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 60.361344] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.367914] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.374607] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.381078] bridge0: port 1(bridge_slave_0) entered forwarding state RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 60.752614] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 60.758788] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.800345] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 60.837051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.845180] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 60.877346] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 60.883481] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.944171] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready executing program [ 61.165014] ================================================================== [ 61.172450] BUG: KASAN: use-after-scope in debug_object_deactivate+0x425/0x450 [ 61.179801] Read of size 8 at addr ffff8801b8c1b750 by task syz-executor121/4719 [ 61.187319] [ 61.188944] CPU: 0 PID: 4719 Comm: syz-executor121 Not tainted 4.18.0-rc3+ #48 [ 61.196280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.205612] Call Trace: [ 61.208174] [ 61.210329] dump_stack+0x1c9/0x2b4 [ 61.213947] ? dump_stack_print_info.cold.2+0x52/0x52 [ 61.219482] ? printk+0xa7/0xcf [ 61.222765] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 61.227519] ? debug_object_deactivate+0x425/0x450 [ 61.232436] print_address_description+0x6c/0x20b [ 61.237273] ? debug_object_deactivate+0x425/0x450 [ 61.242190] kasan_report.cold.7+0x242/0x2fe [ 61.246587] __asan_report_load8_noabort+0x14/0x20 [ 61.251502] debug_object_deactivate+0x425/0x450 [ 61.256249] ? debug_stats_show+0x100/0x100 [ 61.260570] ? perf_trace_lock_acquire+0xeb/0x9a0 [ 61.265409] __hrtimer_run_queues+0x2bf/0x10c0 [ 61.269981] ? hrtimer_start_range_ns+0xd20/0xd20 [ 61.274834] ? pvclock_read_flags+0x160/0x160 [ 61.279325] ? kvm_clock_read+0x25/0x30 [ 61.283299] ? kvm_clock_read+0x25/0x30 [ 61.287273] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 61.292281] ? ktime_get_update_offsets_now+0x3db/0x5d0 [ 61.297649] ? do_timer+0x50/0x50 [ 61.301092] ? kasan_check_read+0x11/0x20 [ 61.305231] ? rcu_nmi_exit+0xe0/0x2d0 [ 61.309136] ? do_raw_spin_lock+0xc1/0x200 [ 61.313356] hrtimer_interrupt+0x2f3/0x750 [ 61.317583] smp_apic_timer_interrupt+0x165/0x730 [ 61.322416] ? smp_call_function_single_interrupt+0x660/0x660 [ 61.328307] ? _raw_spin_unlock+0x22/0x30 [ 61.332458] ? handle_edge_irq+0x330/0x870 [ 61.336680] ? task_prio+0x50/0x50 [ 61.340210] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 61.345069] apic_timer_interrupt+0xf/0x20 [ 61.349285] [ 61.351498] [ 61.353108] Allocated by task 917528: [ 61.356897] save_stack+0x43/0xd0 [ 61.360336] kasan_kmalloc+0xc4/0xe0 [ 61.364037] kasan_slab_alloc+0x12/0x20 [ 61.368017] kmem_cache_alloc+0x12e/0x760 [ 61.372154] __debug_object_init+0xbe1/0x12e0 [ 61.376656] debug_object_activate+0x32e/0x690 [ 61.381225] __call_rcu.constprop.68+0xc8/0xc00 [ 61.385900] call_rcu_sched+0x12/0x20 [ 61.389689] put_filp+0xa1/0xb2 [ 61.392987] path_openat+0x38f2/0x4e10 [ 61.396862] do_filp_open+0x255/0x380 [ 61.400645] do_sys_open+0x584/0x760 [ 61.404354] __x64_sys_open+0x7e/0xc0 [ 61.408149] do_syscall_64+0x1b9/0x820 [ 61.412030] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 61.417376] [ 61.418990] Freed by task 0: [ 61.421982] (stack is not available) [ 61.425669] [ 61.427276] The buggy address belongs to the object at ffff8801b8c1b738 [ 61.427276] which belongs to the cache debug_objects_cache of size 40 [ 61.440715] The buggy address is located 24 bytes inside of [ 61.440715] 40-byte region [ffff8801b8c1b738, ffff8801b8c1b760) [ 61.452406] The buggy address belongs to the page: [ 61.457334] page:ffffea0006e306c0 count:1 mapcount:0 mapping:ffff8801da810dc0 index:0xffff8801b8c1bfb9 [ 61.467543] flags: 0x2fffc0000000100(slab) [ 61.471765] raw: 02fffc0000000100 ffffea0006e85b08 ffffea0006df5fc8 ffff8801da810dc0 [ 61.479629] raw: ffff8801b8c1bfb9 ffff8801b8c1b000 0000000100000047 0000000000000000 [ 61.487497] page dumped because: kasan: bad access detected [ 61.493186] [ 61.494794] Memory state around the buggy address: [ 61.499705] ffff8801b8c1b600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 61.507045] ffff8801b8c1b680: f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 [ 61.514388] >ffff8801b8c1b700: f2 f2 00 f2 f2 f2 f2 f2 f2 f2 f8 f2 f2 f2 f2 f2 [ 61.521735] ^ [ 61.527692] ffff8801b8c1b780: f2 f2 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 [ 61.535065] ffff8801b8c1b800: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 [ 61.542420] ================================================================== [ 61.549771] Kernel panic - not syncing: panic_on_warn set ... [ 61.549771] [ 61.560598] CPU: 0 PID: 4719 Comm: syz-executor121 Tainted: G B 4.18.0-rc3+ #48 [ 61.569326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.578671] Call Trace: [ 61.581245] [ 61.583486] dump_stack+0x1c9/0x2b4 [ 61.587102] ? dump_stack_print_info.cold.2+0x52/0x52 [ 61.592402] ? lock_downgrade+0x8f0/0x8f0 [ 61.596546] ? debug_object_deactivate+0x425/0x450 [ 61.601462] panic+0x238/0x4e7 [ 61.604648] ? add_taint.cold.5+0x16/0x16 [ 61.608783] ? print_shadow_for_address+0xba/0x116 [ 61.613788] ? do_raw_spin_unlock+0xa7/0x2f0 [ 61.618185] ? debug_object_deactivate+0x425/0x450 [ 61.623504] kasan_end_report+0x47/0x4f [ 61.627470] kasan_report.cold.7+0x76/0x2fe [ 61.631783] __asan_report_load8_noabort+0x14/0x20 [ 61.636695] debug_object_deactivate+0x425/0x450 [ 61.641430] ? debug_stats_show+0x100/0x100 [ 61.645734] ? perf_trace_lock_acquire+0xeb/0x9a0 [ 61.650576] __hrtimer_run_queues+0x2bf/0x10c0 [ 61.655168] ? hrtimer_start_range_ns+0xd20/0xd20 [ 61.659996] ? pvclock_read_flags+0x160/0x160 [ 61.664493] ? kvm_clock_read+0x25/0x30 [ 61.668449] ? kvm_clock_read+0x25/0x30 [ 61.672407] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 61.677409] ? ktime_get_update_offsets_now+0x3db/0x5d0 [ 61.682771] ? do_timer+0x50/0x50 [ 61.686209] ? kasan_check_read+0x11/0x20 [ 61.690356] ? rcu_nmi_exit+0xe0/0x2d0 [ 61.694233] ? do_raw_spin_lock+0xc1/0x200 [ 61.698457] hrtimer_interrupt+0x2f3/0x750 [ 61.702682] smp_apic_timer_interrupt+0x165/0x730 [ 61.707769] ? smp_call_function_single_interrupt+0x660/0x660 [ 61.713752] ? _raw_spin_unlock+0x22/0x30 [ 61.717888] ? handle_edge_irq+0x330/0x870 [ 61.722208] ? task_prio+0x50/0x50 [ 61.725746] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 61.730575] apic_timer_interrupt+0xf/0x20 [ 61.734813] [ 61.737583] Dumping ftrace buffer: [ 61.741103] (ftrace buffer empty) [ 61.744796] Kernel Offset: disabled [ 61.748405] Rebooting in 86400 seconds..