[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 16.717080] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.667904] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 21.034739] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 21.833396] random: sshd: uninitialized urandom read (32 bytes read, 95 bits of entropy available) [ 22.003338] random: sshd: uninitialized urandom read (32 bytes read, 100 bits of entropy available) Warning: Permanently added '10.128.0.20' (ECDSA) to the list of known hosts. [ 27.396028] random: sshd: uninitialized urandom read (32 bytes read, 105 bits of entropy available) executing program [ 27.490683] ================================================================== [ 27.498061] BUG: KASAN: stack-out-of-bounds in strlcpy+0x101/0x120 [ 27.504343] Read of size 1 at addr ffff8801d742fb3c by task syzkaller406068/3321 [ 27.511837] [ 27.513432] CPU: 1 PID: 3321 Comm: syzkaller406068 Not tainted 4.4.110-g618a510 #15 [ 27.521186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.530509] 0000000000000000 1e45d3b5c2de3ff3 ffff8801d742fa18 ffffffff81d04e3d [ 27.538453] ffffea00075d0bc0 ffff8801d742fb3c 0000000000000000 ffff8801d742fb3c [ 27.546408] ffff8801d742fc20 ffff8801d742fa50 ffffffff814fd1f3 ffff8801d742fb3c [ 27.554346] Call Trace: [ 27.556901] [] dump_stack+0xc1/0x124 [ 27.562228] [] print_address_description+0x73/0x260 [ 27.568857] [] kasan_report+0x285/0x370 [ 27.574443] [] ? strlcpy+0x101/0x120 [ 27.579767] [] __asan_report_load1_noabort+0x14/0x20 [ 27.586481] [] strlcpy+0x101/0x120 [ 27.591634] [] xt_copy_counters_from_user+0x152/0x2c0 [ 27.598434] [] ? xt_compat_target_to_user+0x3a0/0x3a0 [ 27.605242] [] ? mark_held_locks+0xaf/0x100 [ 27.611180] [] ? mutex_lock_nested+0x5d4/0x850 [ 27.617384] [] do_add_counters+0x96/0x590 [ 27.623144] [] ? __do_replace+0x6d0/0x6d0 [ 27.628904] [] ? security_capable+0x8e/0xc0 [ 27.634839] [] ? ns_capable_common+0xcf/0x160 [ 27.640949] [] compat_do_ipt_set_ctl+0xbf/0x150 [ 27.647230] [] compat_nf_setsockopt+0x88/0x130 [ 27.653425] [] ? compat_do_replace.isra.15+0x410/0x410 [ 27.660315] [] compat_ip_setsockopt+0x9d/0xf0 [ 27.666425] [] inet_csk_compat_setsockopt+0x95/0x120 [ 27.673148] [] ? ip_setsockopt+0xb0/0xb0 [ 27.678823] [] compat_tcp_setsockopt+0x3d/0x70 [ 27.685019] [] compat_sock_common_setsockopt+0xb2/0x140 [ 27.691992] [] ? tcp_setsockopt+0xd0/0xd0 [ 27.697753] [] compat_SyS_setsockopt+0x149/0x290 [ 27.704120] [] ? sock_common_setsockopt+0xd0/0xd0 [ 27.710572] [] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 27.717116] [] ? vmacache_update+0xfe/0x130 [ 27.723050] [] ? do_fast_syscall_32+0xd7/0x890 [ 27.729245] [] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 27.735789] [] do_fast_syscall_32+0x314/0x890 [ 27.741899] [] sysenter_flags_fixed+0xd/0x17 [ 27.747916] [ 27.749507] The buggy address belongs to the page: [ 27.754398] page:ffffea00075d0bc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 27.762500] flags: 0x8000000000000000() [ 27.766546] page dumped because: kasan: bad access detected [ 27.772216] [ 27.773805] Memory state around the buggy address: [ 27.778695] ffff8801d742fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.786016] ffff8801d742fa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 [ 27.793336] >ffff8801d742fb00: f1 f1 f1 00 00 00 00 04 f2 f2 f2 00 00 00 00 00 [ 27.800661] ^ [ 27.805813] ffff8801d742fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.813134] ffff8801d742fc00: f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 00 00 00 00 [ 27.820458] ================================================================== [ 27.827780] Disabling lock debugging due to kernel taint [ 27.833281] Kernel panic - not syncing: panic_on_warn set ... [ 27.833281] [ 27.840624] CPU: 1 PID: 3321 Comm: syzkaller406068 Tainted: G B 4.4.110-g618a510 #15 [ 27.849596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.858920] 0000000000000000 1e45d3b5c2de3ff3 ffff8801d742f970 ffffffff81d04e3d [ 27.866868] ffffffff83fb3c85 ffff8801d742fa48 0000000000000000 ffff8801d742fb3c [ 27.874812] ffff8801d742fc20 ffff8801d742fa38 ffffffff814197fa 0000000041b58ab3 [ 27.882754] Call Trace: [ 27.885311] [] dump_stack+0xc1/0x124 [ 27.890645] [] panic+0x1aa/0x388 [ 27.895633] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 27.902537] [] ? preempt_schedule_common+0x42/0x70 [ 27.909091] [] ? preempt_schedule+0x24/0x30 [ 27.915031] [] ? ___preempt_schedule+0x12/0x14 [ 27.921246] [] kasan_end_report+0x50/0x50 [ 27.927020] [] kasan_report+0x15c/0x370 [ 27.932612] [] ? strlcpy+0x101/0x120 [ 27.937940] [] __asan_report_load1_noabort+0x14/0x20 [ 27.944655] [] strlcpy+0x101/0x120 [ 27.949809] [] xt_copy_counters_from_user+0x152/0x2c0 [ 27.956612] [] ? xt_compat_target_to_user+0x3a0/0x3a0 [ 27.963413] [] ? mark_held_locks+0xaf/0x100 [ 27.969348] [] ? mutex_lock_nested+0x5d4/0x850 [ 27.975542] [] do_add_counters+0x96/0x590 [ 27.981304] [] ? __do_replace+0x6d0/0x6d0 [ 27.987068] [] ? security_capable+0x8e/0xc0 [ 27.993006] [] ? ns_capable_common+0xcf/0x160 [ 27.999112] [] compat_do_ipt_set_ctl+0xbf/0x150 [ 28.005394] [] compat_nf_setsockopt+0x88/0x130 [ 28.011593] [] ? compat_do_replace.isra.15+0x410/0x410 [ 28.018483] [] compat_ip_setsockopt+0x9d/0xf0 [ 28.024590] [] inet_csk_compat_setsockopt+0x95/0x120 [ 28.031304] [] ? ip_setsockopt+0xb0/0xb0 [ 28.036980] [] compat_tcp_setsockopt+0x3d/0x70 [ 28.043178] [] compat_sock_common_setsockopt+0xb2/0x140 [ 28.050153] [] ? tcp_setsockopt+0xd0/0xd0 [ 28.055912] [] compat_SyS_setsockopt+0x149/0x290 [ 28.062278] [] ? sock_common_setsockopt+0xd0/0xd0 [ 28.068739] [] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 28.075283] [] ? vmacache_update+0xfe/0x130 [ 28.081218] [] ? do_fast_syscall_32+0xd7/0x890 [ 28.087410] [] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 28.093950] [] do_fast_syscall_32+0x314/0x890 [ 28.100057] [] sysenter_flags_fixed+0xd/0x17 [ 28.106114] Dumping ftrace buffer: [ 28.109619] (ftrace buffer empty) [ 28.113294] Kernel Offset: disabled [ 28.116885] Rebooting in 86400 seconds..