[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 12.823589] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 14.831535] random: sshd: uninitialized urandom read (32 bytes read) [ 15.050077] random: sshd: uninitialized urandom read (32 bytes read) [ 15.879530] random: sshd: uninitialized urandom read (32 bytes read) [ 16.016622] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.2' (ECDSA) to the list of known hosts. [ 21.398986] random: sshd: uninitialized urandom read (32 bytes read) 2018/05/26 23:33:01 parsed 1 programs 2018/05/26 23:33:01 executed programs: 0 [ 21.884982] IPVS: Creating netns size=2536 id=1 [ 21.915100] IPVS: Creating netns size=2536 id=2 [ 21.940525] IPVS: Creating netns size=2536 id=3 [ 21.976983] IPVS: Creating netns size=2536 id=4 [ 22.014925] IPVS: Creating netns size=2536 id=5 [ 22.052762] IPVS: Creating netns size=2536 id=6 [ 22.097121] IPVS: Creating netns size=2536 id=7 [ 22.110928] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.159394] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.167419] IPVS: Creating netns size=2536 id=8 [ 22.282911] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.298913] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.315735] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 22.327355] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.345273] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 22.352292] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.430404] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.489114] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.498155] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.514364] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.571637] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 22.591544] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 22.606918] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.619536] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 22.631299] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 22.641068] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 22.654121] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.661841] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.678482] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 22.694826] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 22.702492] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.721062] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.742649] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 22.751647] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 22.760841] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 22.787233] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.795826] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 22.808447] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 22.847619] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 22.896445] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 22.937155] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 22.949553] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 22.961029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.978581] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 23.010839] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 23.026400] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 23.034017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.041516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.050590] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 23.066255] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 23.074354] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 23.087145] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 23.095999] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 23.103911] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 23.118645] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 23.132980] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 23.140590] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 23.150549] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 23.160992] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 23.170303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.179501] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.187325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.194994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.202538] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.209921] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.218622] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 23.236153] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 23.244269] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.251762] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.260837] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.268465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.278179] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 23.293304] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 23.304837] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 23.316613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.327852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.338278] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 23.351671] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 23.373063] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 23.384132] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.392241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.402865] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 23.415165] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 23.422486] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.430478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.438291] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.445813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.455601] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 23.468604] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 23.483136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.490621] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.502752] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 23.545118] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 23.552910] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.560344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.588443] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 23.604740] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.614123] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.871010] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.009055] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.019675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.027332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.143435] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.247471] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.276520] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.290383] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.297530] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.316152] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.324662] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.345255] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.389683] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.436426] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.451139] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.459143] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.466967] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.473293] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.479980] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.488460] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.497251] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.505452] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.512176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.522110] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.537342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.548402] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.573892] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.591708] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.605310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.649990] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 26.661778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.668678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/05/26 23:33:07 executed programs: 8 [ 27.454548] ================================================================== [ 27.461954] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 27.469218] Read of size 4 at addr ffff8801c8fe0780 by task syz-executor6/6653 [ 27.476566] [ 27.478188] CPU: 0 PID: 6653 Comm: syz-executor6 Not tainted 4.9.103-g0cecdf8 #38 [ 27.485790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.495129] ffff8801b634faf0 ffffffff81eb34a9 ffffea000723f800 ffff8801c8fe0780 [ 27.503208] 0000000000000000 ffff8801c8fe0780 ffffffff83012be0 ffff8801b634fb28 [ 27.511255] ffffffff815676bb ffff8801c8fe0780 0000000000000004 0000000000000000 [ 27.519303] Call Trace: [ 27.521887] [] dump_stack+0xc1/0x128 [ 27.527257] [] ? sock_release+0x1c0/0x1c0 [ 27.533047] [] print_address_description+0x6c/0x234 [ 27.539703] [] ? sock_release+0x1c0/0x1c0 [ 27.545492] [] kasan_report.cold.6+0x242/0x2fe [ 27.551718] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 27.558464] [] __asan_report_load4_noabort+0x14/0x20 [ 27.565210] [] l2tp_session_queue_purge+0xf4/0x100 [ 27.571891] [] ? sock_release+0x1c0/0x1c0 [ 27.577685] [] pppol2tp_release+0x1fb/0x2e0 [ 27.583660] [] sock_release+0x96/0x1c0 [ 27.589288] [] sock_close+0x16/0x20 [ 27.594560] [] __fput+0x263/0x700 [ 27.599677] [] ____fput+0x15/0x20 [ 27.604777] [] task_work_run+0x10c/0x180 [ 27.610492] [] do_exit+0x9e1/0x27c0 [ 27.615761] [] ? release_task.part.19+0x1210/0x1210 [ 27.622406] [] ? __do_page_fault+0x5dd/0xd50 [ 27.628461] [] ? up_read+0x1a/0x40 [ 27.633626] [] ? __do_page_fault+0x183/0xd50 [ 27.639658] [] do_group_exit+0x111/0x340 [ 27.645341] [] ? do_group_exit+0x340/0x340 [ 27.651199] [] SyS_exit_group+0x1d/0x20 [ 27.656796] [] do_fast_syscall_32+0x2f7/0x870 [ 27.662916] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.669555] [] entry_SYSENTER_compat+0x90/0xa2 [ 27.675769] [ 27.677370] Allocated by task 6646: [ 27.680967] save_stack_trace+0x16/0x20 [ 27.684914] save_stack+0x43/0xd0 [ 27.688339] kasan_kmalloc+0xc7/0xe0 [ 27.692024] __kmalloc+0x11d/0x300 [ 27.695545] l2tp_session_create+0x38/0x16f0 [ 27.699923] pppol2tp_connect+0x10d7/0x18f0 [ 27.704230] SYSC_connect+0x1b8/0x300 [ 27.708003] SyS_connect+0x24/0x30 [ 27.711513] do_fast_syscall_32+0x2f7/0x870 [ 27.715809] entry_SYSENTER_compat+0x90/0xa2 [ 27.720184] [ 27.721781] Freed by task 6631: [ 27.725041] save_stack_trace+0x16/0x20 [ 27.728985] save_stack+0x43/0xd0 [ 27.732408] kasan_slab_free+0x72/0xc0 [ 27.736268] kfree+0xfb/0x310 [ 27.739346] l2tp_session_free+0x166/0x200 [ 27.743555] l2tp_tunnel_closeall+0x284/0x350 [ 27.748022] l2tp_udp_encap_destroy+0x87/0xe0 [ 27.752492] udpv6_destroy_sock+0xb1/0xd0 [ 27.756613] sk_common_release+0x6d/0x300 [ 27.760732] udp_lib_close+0x15/0x20 [ 27.764419] inet_release+0xff/0x1d0 [ 27.768105] inet6_release+0x50/0x70 [ 27.771792] sock_release+0x96/0x1c0 [ 27.775476] sock_close+0x16/0x20 [ 27.778904] __fput+0x263/0x700 [ 27.782154] ____fput+0x15/0x20 [ 27.785405] task_work_run+0x10c/0x180 [ 27.789266] do_exit+0x9e1/0x27c0 [ 27.792691] do_group_exit+0x111/0x340 [ 27.796551] SyS_exit_group+0x1d/0x20 [ 27.800325] do_fast_syscall_32+0x2f7/0x870 [ 27.804619] entry_SYSENTER_compat+0x90/0xa2 [ 27.808997] [ 27.810599] The buggy address belongs to the object at ffff8801c8fe0780 [ 27.810599] which belongs to the cache kmalloc-512 of size 512 [ 27.823229] The buggy address is located 0 bytes inside of [ 27.823229] 512-byte region [ffff8801c8fe0780, ffff8801c8fe0980) [ 27.834902] The buggy address belongs to the page: [ 27.839803] page:ffffea000723f800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 27.849979] flags: 0x8000000000004080(slab|head) [ 27.854704] page dumped because: kasan: bad access detected [ 27.860380] [ 27.861978] Memory state around the buggy address: [ 27.866882] ffff8801c8fe0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.874214] ffff8801c8fe0700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.881545] >ffff8801c8fe0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.888872] ^ [ 27.892207] ffff8801c8fe0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.899537] ffff8801c8fe0880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.906868] ================================================================== [ 27.914205] Disabling lock debugging due to kernel taint [ 27.969186] Kernel panic - not syncing: panic_on_warn set ... [ 27.969186] [ 27.976592] CPU: 0 PID: 6653 Comm: syz-executor6 Tainted: G B 4.9.103-g0cecdf8 #38 [ 27.985411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.994748] ffff8801b634fa50 ffffffff81eb34a9 ffffffff843c5d75 00000000ffffffff [ 28.002729] 0000000000000000 0000000000000000 ffffffff83012be0 ffff8801b634fb10 [ 28.010720] ffffffff81421aa5 0000000041b58ab3 ffffffff843b94a8 ffffffff814218e6 [ 28.018714] Call Trace: [ 28.021276] [] dump_stack+0xc1/0x128 [ 28.026635] [] ? sock_release+0x1c0/0x1c0 [ 28.032406] [] panic+0x1bf/0x3bc [ 28.037393] [] ? add_taint.cold.6+0x16/0x16 [ 28.043340] [] ? ___preempt_schedule+0x16/0x18 [ 28.049543] [] kasan_end_report+0x47/0x4f [ 28.055308] [] kasan_report.cold.6+0x76/0x2fe [ 28.061427] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 28.068155] [] __asan_report_load4_noabort+0x14/0x20 [ 28.074878] [] l2tp_session_queue_purge+0xf4/0x100 [ 28.081429] [] ? sock_release+0x1c0/0x1c0 [ 28.087198] [] pppol2tp_release+0x1fb/0x2e0 [ 28.093139] [] sock_release+0x96/0x1c0 [ 28.098645] [] sock_close+0x16/0x20 [ 28.103893] [] __fput+0x263/0x700 [ 28.108967] [] ____fput+0x15/0x20 [ 28.114045] [] task_work_run+0x10c/0x180 [ 28.119728] [] do_exit+0x9e1/0x27c0 [ 28.124981] [] ? release_task.part.19+0x1210/0x1210 [ 28.131621] [] ? __do_page_fault+0x5dd/0xd50 [ 28.137652] [] ? up_read+0x1a/0x40 [ 28.142826] [] ? __do_page_fault+0x183/0xd50 [ 28.148858] [] do_group_exit+0x111/0x340 [ 28.154540] [] ? do_group_exit+0x340/0x340 [ 28.160396] [] SyS_exit_group+0x1d/0x20 [ 28.165992] [] do_fast_syscall_32+0x2f7/0x870 [ 28.172106] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.178743] [] entry_SYSENTER_compat+0x90/0xa2 [ 28.185407] Dumping ftrace buffer: [ 28.188923] (ftrace buffer empty) [ 28.192602] Kernel Offset: disabled [ 28.196197] Rebooting in 86400 seconds..