[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [ 33.475874] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 33.967542] kauditd_printk_skb: 10 callbacks suppressed [ 33.967549] audit: type=1400 audit(1574405617.934:35): avc: denied { map } for pid=6958 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 34.023748] random: sshd: uninitialized urandom read (32 bytes read) [ 34.559214] random: sshd: uninitialized urandom read (32 bytes read) [ 34.761795] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.20' (ECDSA) to the list of known hosts. [ 40.369751] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 40.493041] audit: type=1400 audit(1574405624.464:36): avc: denied { map } for pid=6971 comm="syz-executor544" path="/root/syz-executor544635821" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 40.496836] ifb0: Invalid MTU 47872 requested, hw max 1500 [ 40.536811] refcount_t: underflow; use-after-free. [ 40.542088] ------------[ cut here ]------------ [ 40.546844] WARNING: CPU: 1 PID: 6971 at lib/refcount.c:187 refcount_sub_and_test.cold+0x18/0x22 [ 40.555762] Kernel panic - not syncing: panic_on_warn set ... [ 40.555762] [ 40.563109] CPU: 1 PID: 6971 Comm: syz-executor544 Not tainted 4.14.155-syzkaller #0 [ 40.570970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.580312] Call Trace: [ 40.582890] dump_stack+0x142/0x197 [ 40.586498] panic+0x1f9/0x42d [ 40.589677] ? add_taint.cold+0x16/0x16 [ 40.593695] ? refcount_sub_and_test.cold+0x18/0x22 [ 40.598826] ? refcount_sub_and_test.cold+0x18/0x22 [ 40.603922] __warn.cold+0x2f/0x2f [ 40.607456] ? ist_end_non_atomic+0x10/0x10 [ 40.611764] ? refcount_sub_and_test.cold+0x18/0x22 [ 40.616855] report_bug+0x216/0x254 [ 40.620487] do_error_trap+0x1bb/0x310 [ 40.624353] ? math_error+0x360/0x360 [ 40.628144] ? vprintk_emit+0x171/0x600 [ 40.632123] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 40.636966] do_invalid_op+0x1b/0x20 [ 40.640669] invalid_op+0x1b/0x40 [ 40.644106] RIP: 0010:refcount_sub_and_test.cold+0x18/0x22 [ 40.649880] RSP: 0018:ffff888096d4f600 EFLAGS: 00010282 [ 40.655434] RAX: 0000000000000026 RBX: 0000000000008001 RCX: 0000000000000000 [ 40.662801] RDX: 0000000000000000 RSI: ffffffff866d07c0 RDI: ffffed1012da9eb6 [ 40.670334] RBP: ffff888096d4f628 R08: 0000000000000026 R09: ffff8880a8f7adc8 [ 40.677586] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888091512a3c [ 40.684836] R13: 0000000000008100 R14: 00000000ffffff01 R15: ffffffff88152e60 [ 40.692203] sock_wfree+0xa7/0x160 [ 40.695751] sctp_wfree+0x2a1/0x620 [ 40.699354] ? __sctp_write_space+0x5c0/0x5c0 [ 40.703832] skb_release_head_state+0x124/0x260 [ 40.708504] skb_release_all+0x16/0x60 [ 40.712378] consume_skb+0xaf/0x340 [ 40.716029] sctp_chunk_put+0x179/0x270 [ 40.720000] sctp_chunk_free+0x56/0x70 [ 40.723939] __sctp_outq_teardown+0x1c2/0xde0 [ 40.728508] sctp_outq_free+0x16/0x20 [ 40.732295] sctp_association_free+0x1ee/0x753 [ 40.736862] sctp_do_sm+0x3469/0x4ae0 [ 40.740645] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 40.746079] ? sctp_do_8_2_transport_strike.isra.0+0x880/0x880 [ 40.752047] ? __lock_is_held+0xb6/0x140 [ 40.756093] ? sctp_chunkify+0x4b/0x280 [ 40.760059] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 40.765496] ? rcu_read_lock_sched_held+0x110/0x130 [ 40.770493] ? kmem_cache_alloc+0x611/0x780 [ 40.774793] ? __alloc_skb+0x3ee/0x500 [ 40.778672] ? sctp_auth_send_cid+0x104/0x140 [ 40.783154] ? sctp_make_abort_user+0x145/0x1f0 [ 40.787835] sctp_primitive_ABORT+0xa0/0xd0 [ 40.792138] sctp_close+0x25e/0x730 [ 40.795749] ? sctp_init_sock+0x1230/0x1230 [ 40.800069] ? lock_acquire+0x16f/0x430 [ 40.804027] ? __sock_release+0x89/0x2b0 [ 40.808067] ? ip_mc_drop_socket+0x1d6/0x230 [ 40.812489] inet_release+0xec/0x1c0 [ 40.816186] __sock_release+0xce/0x2b0 [ 40.820062] ? __sock_release+0x2b0/0x2b0 [ 40.824200] sock_close+0x1b/0x30 [ 40.827631] __fput+0x275/0x7a0 [ 40.830893] ____fput+0x16/0x20 [ 40.834325] task_work_run+0x114/0x190 [ 40.838223] do_exit+0x7df/0x2c10 [ 40.841658] ? mm_update_next_owner+0x5d0/0x5d0 [ 40.846307] ? sock_common_getsockopt+0x94/0xd0 [ 40.850960] ? SyS_getsockopt+0x13c/0x1e0 [ 40.855089] do_group_exit+0x111/0x330 [ 40.859029] SyS_exit_group+0x1d/0x20 [ 40.862842] ? do_group_exit+0x330/0x330 [ 40.866905] do_syscall_64+0x1e8/0x640 [ 40.870776] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 40.875887] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 40.881454] RIP: 0033:0x43f268 [ 40.884631] RSP: 002b:00007ffe90422508 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 40.892319] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f268 [ 40.899570] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 40.906832] RBP: 00000000004bea68 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 40.914098] R10: 000000002059aff8 R11: 0000000000000246 R12: 0000000000000001 [ 40.921350] R13: 00000000006d01a0 R14: 0000000000000000 R15: 0000000000000000 [ 40.930482] Kernel Offset: disabled [ 40.934163] Rebooting in 86400 seconds..