[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 16.107696] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.912420] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 21.313031] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 22.124160] random: sshd: uninitialized urandom read (32 bytes read, 93 bits of entropy available) [ 22.296012] random: sshd: uninitialized urandom read (32 bytes read, 98 bits of entropy available) Warning: Permanently added '10.128.0.7' (ECDSA) to the list of known hosts. [ 27.676596] random: sshd: uninitialized urandom read (32 bytes read, 106 bits of entropy available) executing program [ 27.778403] ================================================================== [ 27.785781] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 [ 27.792764] Read of size 8 at addr ffff8801d1a58140 by task syzkaller252492/3313 [ 27.800263] [ 27.801861] CPU: 0 PID: 3313 Comm: syzkaller252492 Not tainted 4.4.112-gca0ebb4 #29 [ 27.809623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.818950] 0000000000000000 6915d7946e213a80 ffff8801d0d3fab0 ffffffff81d056fd [ 27.826908] ffffea0007469600 ffff8801d1a58140 0000000000000000 ffff8801d1a58140 [ 27.834868] ffff8801d0f14438 ffff8801d0d3fae8 ffffffff814fd953 ffff8801d1a58140 [ 27.842835] Call Trace: [ 27.845395] [] dump_stack+0xc1/0x124 [ 27.850730] [] print_address_description+0x73/0x260 [ 27.857363] [] kasan_report+0x285/0x370 [ 27.862955] [] ? sg_remove_request+0xf9/0x110 [ 27.869067] [] __asan_report_load8_noabort+0x14/0x20 [ 27.875790] [] sg_remove_request+0xf9/0x110 [ 27.881731] [] sg_finish_rem_req+0x295/0x340 [ 27.887766] [] sg_read+0xa21/0x1490 [ 27.893009] [] ? new_slab+0x24f/0x3b0 [ 27.898426] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 27.905061] [] ? __raw_spin_lock_init+0x1c/0x100 [ 27.911434] [] ? lockdep_init_map+0xeb/0x1690 [ 27.917547] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 27.924184] [] __vfs_read+0x103/0x440 [ 27.929618] [] ? vfs_iter_write+0x2d0/0x2d0 [ 27.935565] [] ? fsnotify+0x5ad/0xee0 [ 27.940983] [] ? fsnotify+0xee0/0xee0 [ 27.946404] [] ? fasync_helper+0x7a/0xb0 [ 27.952083] [] ? avc_policy_seqno+0x9/0x20 [ 27.957941] [] ? selinux_file_permission+0x348/0x460 [ 27.964672] [] ? security_file_permission+0x89/0x1e0 [ 27.971394] [] ? rw_verify_area+0x100/0x2f0 [ 27.977346] [] vfs_read+0x123/0x3a0 [ 27.982590] [] SyS_read+0xd9/0x1b0 [ 27.987747] [] ? do_sendfile+0xd30/0xd30 [ 27.993436] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 27.999913] [] entry_SYSCALL_64_fastpath+0x16/0x92 [ 28.006461] [ 28.008066] Allocated by task 0: [ 28.011395] (stack is not available) [ 28.015075] [ 28.016671] Freed by task 0: [ 28.019653] (stack is not available) [ 28.023332] [ 28.024934] The buggy address belongs to the object at ffff8801d1a58100 [ 28.024934] which belongs to the cache fasync_cache of size 96 [ 28.037558] The buggy address is located 64 bytes inside of [ 28.037558] 96-byte region [ffff8801d1a58100, ffff8801d1a58160) [ 28.049226] The buggy address belongs to the page: [ 28.192083] ------------[ cut here ]------------ [ 28.196863] WARNING: CPU: 1 PID: 0 at kernel/bpf/core.c:724 __bpf_prog_run+0x423c/0x5290() [ 28.205263] unknown opcode 00 [ 28.208403] Kernel panic - not syncing: panic_on_warn set ... [ 28.208403] [ 28.215747] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.112-gca0ebb4 #29 [ 28.222727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.232050] 0000000000000000 8edfa441c485c877 ffff8801db306dd0 ffffffff81d056fd [ 28.240019] ffffffff83843200 ffff8801db306ea8 ffffffff83896fa0 0000000000000009 [ 28.247984] 00000000000002d4 ffff8801db306e98 ffffffff81419dca 0000000041b58ab3 [ 28.255944] Call Trace: [ 28.258494] [] dump_stack+0xc1/0x124 [ 28.264561] [] panic+0x1aa/0x388 [ 28.269547] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 28.276442] [] ? warn_slowpath_common+0x10a/0x140 [ 28.282904] [] warn_slowpath_common+0x125/0x140 [ 28.289199] [] ? __bpf_prog_run+0x423c/0x5290 [ 28.295311] [] warn_slowpath_fmt+0xc1/0x110 [ 28.301248] [] ? warn_slowpath_common+0x140/0x140 [ 28.307709] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 28.314615] [] ? trace_hardirqs_on_caller+0x266/0x590 [ 28.321429] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 28.328324] [] ? ___ratelimit+0x53/0x3e0 [ 28.334004] [] __bpf_prog_run+0x423c/0x5290 [ 28.339943] [] ? bpf_prog_select_runtime+0x340/0x340 [ 28.346666] [] ? mark_held_locks+0xaf/0x100 [ 28.352619] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 28.359515] [] ? __lock_acquire+0xb5f/0x4b50 [ 28.365544] [] ? depot_save_stack+0x1c3/0x640 [ 28.371673] [] ? selinux_socket_sock_rcv_skb+0x2c5/0x690 [ 28.378742] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.385726] [] ? kmem_cache_alloc+0xba/0x290 [ 28.391755] [] ? skb_clone+0x142/0x2c0 [ 28.397260] [] ? dev_hard_start_xmit+0x32c/0x1220 [ 28.403730] [] ? sch_direct_xmit+0x2c1/0x760 [ 28.409762] [] ? __dev_queue_xmit+0x1368/0x1a70 [ 28.416058] [] ? dev_queue_xmit+0x17/0x20 [ 28.421825] [] ? ip_finish_output2+0xbe8/0x1060 [ 28.428110] [] ? ip_finish_output+0x784/0xb00 [ 28.434220] [] ? ip_output+0x1cf/0x4c0 [ 28.439734] [] ? ip_local_out+0x95/0x170 [ 28.445421] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.452403] [] ? __lock_is_held+0xa1/0xf0 [ 28.458255] [] sk_filter_trim_cap+0x249/0x6d0 [ 28.464368] [] ? sk_filter_trim_cap+0xf8/0x6d0 [ 28.470579] [] ? bpf_skb_set_tunnel_key+0x2e0/0x2e0 [ 28.477216] [] sock_queue_rcv_skb+0xa7/0xb70 [ 28.483243] [] ? strlcpy+0x9a/0x120 [ 28.488498] [] packet_rcv_spkt+0x3b3/0x4c0 [ 28.494351] [] ? packet_rcv_fanout+0x620/0x620 [ 28.500550] [] dev_hard_start_xmit+0x62b/0x1220 [ 28.506847] [] ? dev_hard_start_xmit+0xa6/0x1220 [ 28.513834] [] sch_direct_xmit+0x2c1/0x760 [ 28.519691] [] ? dev_deactivate_queue.constprop.34+0x150/0x150 [ 28.527294] [] __dev_queue_xmit+0x1368/0x1a70 [ 28.533405] [] ? __dev_queue_xmit+0x1a6/0x1a70 [ 28.539606] [] ? netdev_pick_tx+0x310/0x310 [ 28.545548] [] ? mark_held_locks+0xaf/0x100 [ 28.551490] [] ? ip_finish_output2+0xa64/0x1060 [ 28.557777] [] dev_queue_xmit+0x17/0x20 [ 28.563369] [] ip_finish_output2+0xbe8/0x1060 [ 28.569482] [] ? ip_finish_output+0x784/0xb00 [ 28.575596] [] ? dst_output+0x150/0x150 [ 28.581189] [] ? __lock_is_held+0xa1/0xf0 [ 28.586959] [] ip_finish_output+0x784/0xb00 [ 28.592914] [] ip_output+0x1cf/0x4c0 [ 28.598245] [] ? ip_mc_output+0x980/0x980 [ 28.604012] [] ? ip_fragment.constprop.49+0x200/0x200 [ 28.610824] [] ip_local_out+0x95/0x170 [ 28.616331] [] ip_queue_xmit+0x87b/0x16c0 [ 28.622097] [] ? ip_queue_xmit+0x3f/0x16c0 [ 28.627956] [] ? __tcp_v4_send_check+0x1bf/0x350 [ 28.634329] [] tcp_transmit_skb+0x17a8/0x2ce0 [ 28.640442] [] ? bictcp_cong_avoid+0xee0/0xee0 [ 28.646642] [] ? __tcp_select_window+0x520/0x520 [ 28.653020] [] ? ipip_gro_complete+0x100/0x100 [ 28.659234] [] ? kvm_clock_read+0x23/0x40 [ 28.665007] [] ? kvm_clock_get_cycles+0x9/0x10 [ 28.671207] [] __tcp_retransmit_skb+0x47f/0x17b0 [ 28.677579] [] tcp_retransmit_skb+0x23/0x2c0 [ 28.683604] [] tcp_retransmit_timer+0xa60/0x1f10 [ 28.689977] [] tcp_write_timer_handler+0x21e/0x6d0 [ 28.696525] [] tcp_write_timer+0xa1/0xd0 [ 28.702205] [] call_timer_fn+0x18b/0x860 [ 28.707881] [] ? call_timer_fn+0xdc/0x860 [ 28.713647] [] ? tcp_write_timer_handler+0x6d0/0x6d0 [ 28.720368] [] ? process_timeout+0x20/0x20 [ 28.726223] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 28.732513] [] ? tcp_write_timer_handler+0x6d0/0x6d0 [ 28.739234] [] ? trace_hardirqs_on_caller+0x266/0x590 [ 28.746050] [] ? tcp_write_timer_handler+0x6d0/0x6d0 [ 28.752772] [] run_timer_softirq+0x604/0xbb0 [ 28.758799] [] ? msleep+0xe0/0xe0 [ 28.763882] [] __do_softirq+0x24d/0xa59 [ 28.769477] [] irq_exit+0x119/0x140 [ 28.774722] [] smp_apic_timer_interrupt+0x7b/0xa0 [ 28.781181] [] apic_timer_interrupt+0xa0/0xb0 [ 28.787303] [] ? native_safe_halt+0x6/0x10 [ 28.793885] [] ? trace_hardirqs_on+0xd/0x10 [ 28.799826] [] default_idle+0x55/0x3c0 [ 28.805340] [] arch_cpu_idle+0xa/0x10 [ 28.810760] [] default_idle_call+0x48/0x70 [ 28.816613] [] cpu_startup_entry+0x605/0x820 [ 28.822649] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 28.829457] [] ? call_cpuidle+0xe0/0xe0 [ 28.835053] [] ? clockevents_register_device+0x122/0x230 [ 28.842131] [] start_secondary+0x304/0x3e0 [ 28.847998] [] ? set_cpu_sibling_map+0x1040/0x1040 [ 29.557383] PANIC: double fault, error_code: 0x0 [ 29.562158] CPU: 0 PID: 3313 Comm: syzkaller252492 Not tainted 4.4.112-gca0ebb4 #29 [ 29.569927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.579250] task: ffff8800b51fc740 task.stack: ffff8801d0d38000 [ 29.585281] RIP: 0010:[] [] dump_page_badflags+0x8/0x250 [ 29.594033] RSP: 0018:ffff880100000000 EFLAGS: 00010046 [ 29.599446] RAX: ffff8800b51fc740 RBX: ffffea0007469600 RCX: ffffffff8148fea0 [ 29.606683] RDX: 0000000000000000 RSI: ffffffff838a8620 RDI: ffffea0007469600 [ 29.613919] RBP: ffff880100000010 R08: 0000000000000001 R09: 0000000000000000 [ 29.621158] R10: 0000000000000002 R11: fffffbfff0ad7a1e R12: 0000000000000000 [ 29.628395] R13: ffffffff838a8620 R14: 0000000000000000 R15: 0000000000000000 [ 29.635633] FS: 0000000000a75880(0063) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 29.643825] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.649674] CR2: ffff8800fffffff8 CR3: 00000001d1a40000 CR4: 0000000000160670 [ 29.656915] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.664152] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.671386] Stack: [ 29.673498] [ 29.675096] Call Trace: [ 29.677648] [ 29.679674] Code: 00 e9 83 fd ff ff e8 a8 e2 06 00 e9 50 fd ff ff e8 9e e2 06 00 e9 1d fd ff ff 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 <41> 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec 08 e8 11 01 [ 29.985580] Shutting down cpus with NMI [ 29.989987] Dumping ftrace buffer: [ 29.993602] (ftrace buffer empty) [ 29.997281] Kernel Offset: disabled [ 30.000936] Rebooting in 86400 seconds..