[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 34.856902] random: sshd: uninitialized urandom read (32 bytes read) [ 35.110770] kauditd_printk_skb: 9 callbacks suppressed [ 35.110778] audit: type=1400 audit(1568984176.313:35): avc: denied { map } for pid=6780 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 35.173392] random: sshd: uninitialized urandom read (32 bytes read) [ 35.684125] random: sshd: uninitialized urandom read (32 bytes read) [ 41.546012] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.228' (ECDSA) to the list of known hosts. [ 47.155258] random: sshd: uninitialized urandom read (32 bytes read) [ 47.269259] audit: type=1400 audit(1568984188.463:36): avc: denied { map } for pid=6794 comm="syz-executor191" path="/root/syz-executor191370669" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 47.520908] IPVS: ftp: loaded support on port[0] = 21 executing program [ 48.323307] FAULT_INJECTION: forcing a failure. [ 48.323307] name failslab, interval 1, probability 0, space 0, times 1 [ 48.334739] CPU: 0 PID: 6795 Comm: syz-executor191 Not tainted 4.14.145 #0 [ 48.341775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.351109] Call Trace: [ 48.353677] dump_stack+0x138/0x197 [ 48.357283] should_fail.cold+0x10f/0x159 [ 48.361413] should_failslab+0xdb/0x130 [ 48.365373] kmem_cache_alloc_trace+0x2e9/0x790 [ 48.370022] ? tcf_block_get+0x4b/0x160 [ 48.373978] ? rcu_read_lock_sched_held+0x110/0x130 [ 48.378972] ? kmem_cache_alloc_trace+0x623/0x790 [ 48.383789] tcf_chain_create+0x51/0x230 [ 48.387838] tcf_block_get+0xaa/0x160 [ 48.391622] ? sfb_change+0xaa0/0xaa0 [ 48.395396] sfb_init+0x2c/0x8f [ 48.398649] ? sfb_change+0xaa0/0xaa0 [ 48.402862] qdisc_create+0x290/0xe60 [ 48.406636] ? tc_get_qdisc+0x7f0/0x7f0 [ 48.410597] ? nla_parse+0x186/0x240 [ 48.414313] tc_modify_qdisc+0x494/0x1270 [ 48.418449] ? qdisc_create+0xe60/0xe60 [ 48.422399] ? rtnetlink_rcv_msg+0x305/0xb70 [ 48.426788] ? qdisc_create+0xe60/0xe60 [ 48.430746] rtnetlink_rcv_msg+0x3eb/0xb70 [ 48.434963] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 48.439523] ? netlink_deliver_tap+0x93/0x8f0 [ 48.443996] netlink_rcv_skb+0x14f/0x3c0 [ 48.448043] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 48.452601] ? lock_downgrade+0x6e0/0x6e0 [ 48.456745] ? netlink_ack+0x9a0/0x9a0 [ 48.460610] ? netlink_deliver_tap+0xba/0x8f0 [ 48.465084] rtnetlink_rcv+0x1d/0x30 [ 48.468774] netlink_unicast+0x45d/0x640 [ 48.472813] ? netlink_attachskb+0x6a0/0x6a0 [ 48.477199] ? security_netlink_send+0x81/0xb0 [ 48.481760] netlink_sendmsg+0x7c4/0xc60 [ 48.485798] ? netlink_unicast+0x640/0x640 [ 48.490009] ? security_socket_sendmsg+0x89/0xb0 [ 48.494739] ? netlink_unicast+0x640/0x640 [ 48.498951] sock_sendmsg+0xce/0x110 [ 48.502645] ___sys_sendmsg+0x70a/0x840 [ 48.506609] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 48.511364] ? lock_downgrade+0x6e0/0x6e0 [ 48.515498] ? get_pid_task+0xbf/0x140 [ 48.519371] ? proc_cwd_link+0x1b0/0x1b0 [ 48.523412] ? save_trace+0x290/0x290 [ 48.527190] ? vfs_write+0x25f/0x500 [ 48.530880] ? find_held_lock+0x35/0x130 [ 48.534918] ? vfs_write+0x25f/0x500 [ 48.538617] ? __fget_light+0x172/0x1f0 [ 48.542569] ? __fdget+0x1b/0x20 [ 48.545913] ? sockfd_lookup_light+0xb4/0x160 [ 48.550397] __sys_sendmsg+0xb9/0x140 [ 48.554176] ? SyS_shutdown+0x170/0x170 [ 48.558134] SyS_sendmsg+0x2d/0x50 [ 48.561655] ? __sys_sendmsg+0x140/0x140 [ 48.565696] do_syscall_64+0x1e8/0x640 [ 48.569559] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 48.574384] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 48.579569] RIP: 0033:0x441669 [ 48.582735] RSP: 002b:00007ffe42bc6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 48.590430] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441669 [ 48.597679] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 48.604934] RBP: 00007ffe42bc60a0 R08: 0000000000000001 R09: 00000000bb1414ac [ 48.612197] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff [ 48.619801] R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 [ 48.627707] kasan: CONFIG_KASAN_INLINE enabled [ 48.632438] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 48.639782] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 48.646434] Modules linked in: [ 48.649603] CPU: 0 PID: 6795 Comm: syz-executor191 Not tainted 4.14.145 #0 [ 48.656586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.665928] task: ffff88808d36c100 task.stack: ffff88809bda8000 [ 48.671975] RIP: 0010:qdisc_destroy+0x26/0x320 [ 48.676532] RSP: 0018:ffff88809bdaf590 EFLAGS: 00010202 [ 48.681871] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff11011a6d934 [ 48.689114] RDX: 0000000000000002 RSI: ffff88808d36c980 RDI: 0000000000000010 [ 48.696359] RBP: ffff88809bdaf5a8 R08: ffff88808d36c100 R09: ffff88808d36c9a0 [ 48.703603] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888089f7a0c0 [ 48.710849] R13: ffffffff84eaeb60 R14: 00000000fffffff4 R15: ffff888094ac7ce4 [ 48.718097] FS: 0000000001462880(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000 [ 48.726297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.732160] CR2: 0000000000000000 CR3: 00000000a5760000 CR4: 00000000001406f0 [ 48.739406] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.746652] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.753908] Call Trace: [ 48.756475] ? sfb_zero_all_buckets+0x20/0x20 [ 48.760943] sfb_destroy+0x61/0x80 [ 48.764458] qdisc_create+0x9e0/0xe60 [ 48.768244] ? tc_get_qdisc+0x7f0/0x7f0 [ 48.772204] ? nla_parse+0x186/0x240 [ 48.775894] tc_modify_qdisc+0x494/0x1270 [ 48.780043] ? qdisc_create+0xe60/0xe60 [ 48.784000] ? rtnetlink_rcv_msg+0x305/0xb70 [ 48.788385] ? qdisc_create+0xe60/0xe60 [ 48.792341] rtnetlink_rcv_msg+0x3eb/0xb70 [ 48.796552] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 48.801112] ? netlink_deliver_tap+0x93/0x8f0 [ 48.805583] netlink_rcv_skb+0x14f/0x3c0 [ 48.814609] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 48.819225] ? lock_downgrade+0x6e0/0x6e0 [ 48.823356] ? netlink_ack+0x9a0/0x9a0 [ 48.827300] ? netlink_deliver_tap+0xba/0x8f0 [ 48.831776] rtnetlink_rcv+0x1d/0x30 [ 48.835468] netlink_unicast+0x45d/0x640 [ 48.839505] ? netlink_attachskb+0x6a0/0x6a0 [ 48.843926] ? security_netlink_send+0x81/0xb0 [ 48.848605] netlink_sendmsg+0x7c4/0xc60 [ 48.852643] ? netlink_unicast+0x640/0x640 [ 48.856893] ? security_socket_sendmsg+0x89/0xb0 [ 48.861636] ? netlink_unicast+0x640/0x640 [ 48.865845] sock_sendmsg+0xce/0x110 [ 48.869533] ___sys_sendmsg+0x70a/0x840 [ 48.873484] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 48.878215] ? lock_downgrade+0x6e0/0x6e0 [ 48.882352] ? get_pid_task+0xbf/0x140 [ 48.886217] ? proc_cwd_link+0x1b0/0x1b0 [ 48.890252] ? save_trace+0x290/0x290 [ 48.894028] ? vfs_write+0x25f/0x500 [ 48.897717] ? find_held_lock+0x35/0x130 [ 48.901765] ? vfs_write+0x25f/0x500 [ 48.905454] ? __fget_light+0x172/0x1f0 [ 48.909404] ? __fdget+0x1b/0x20 [ 48.912747] ? sockfd_lookup_light+0xb4/0x160 [ 48.917219] __sys_sendmsg+0xb9/0x140 [ 48.921006] ? SyS_shutdown+0x170/0x170 [ 48.924970] SyS_sendmsg+0x2d/0x50 [ 48.928482] ? __sys_sendmsg+0x140/0x140 [ 48.932529] do_syscall_64+0x1e8/0x640 [ 48.936391] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 48.941212] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 48.946376] RIP: 0033:0x441669 [ 48.949544] RSP: 002b:00007ffe42bc6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 48.957225] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441669 [ 48.964494] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 48.971753] RBP: 00007ffe42bc60a0 R08: 0000000000000001 R09: 00000000bb1414ac [ 48.979085] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff [ 48.986345] R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 [ 48.993595] Code: 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 48 89 fb e8 2f f4 79 fc 48 8d 7b 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 70 02 00 00 f6 43 10 01 74 [ 49.012684] RIP: qdisc_destroy+0x26/0x320 RSP: ffff88809bdaf590 [ 49.018852] ---[ end trace 47d4e85bb3c07596 ]--- [ 49.023806] Kernel panic - not syncing: Fatal exception [ 49.030709] Kernel Offset: disabled [ 49.034348] Rebooting in 86400 seconds..