[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 13.135490] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 14.078643] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 14.361328] random: sshd: uninitialized urandom read (32 bytes read) [ 15.330764] random: sshd: uninitialized urandom read (32 bytes read) [ 15.470024] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.37' (ECDSA) to the list of known hosts. [ 20.972350] random: sshd: uninitialized urandom read (32 bytes read) 2018/06/21 00:50:39 parsed 1 programs [ 22.451647] random: cc1: uninitialized urandom read (8 bytes read) 2018/06/21 00:50:41 executed programs: 0 [ 23.334097] IPVS: Creating netns size=2536 id=1 [ 23.366469] IPVS: Creating netns size=2536 id=2 [ 23.399626] IPVS: Creating netns size=2536 id=3 [ 23.439631] IPVS: Creating netns size=2536 id=4 [ 23.486975] IPVS: Creating netns size=2536 id=5 [ 23.536939] IPVS: Creating netns size=2536 id=6 [ 23.593266] IPVS: Creating netns size=2536 id=7 [ 23.650237] IPVS: Creating netns size=2536 id=8 [ 23.684532] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 23.716821] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 23.824082] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 23.873150] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 23.947993] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 23.981521] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 23.994819] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 24.057514] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 24.073790] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 24.092857] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 24.108996] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 24.156766] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 24.217799] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 24.280113] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 24.290966] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 24.299612] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 24.309627] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 24.318230] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 24.333008] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 24.342151] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 24.350199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.374895] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 24.392833] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 24.406775] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.423478] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 24.437784] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 24.451276] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 24.463353] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 24.486454] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 24.495551] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 24.523709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.552289] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 24.559242] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.572132] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.592251] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 24.624065] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 24.635881] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 24.643808] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 24.656083] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 24.686587] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 24.694655] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 24.714115] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 24.738731] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 24.755922] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 24.766085] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 24.783631] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 24.792242] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 24.807885] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.817141] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.830590] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 24.846367] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 24.854613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.863269] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.870799] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.878323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.887364] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 24.905669] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 24.915689] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 24.933126] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 24.946786] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.958794] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.970540] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 24.979019] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 24.987567] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.998846] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.010141] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 25.021464] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 25.030205] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 25.039006] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 25.049183] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.057656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.067939] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 25.078409] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 25.090292] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.098756] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.115129] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 25.122942] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 25.132565] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 25.142105] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.150076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.160534] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.168310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.175882] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.183534] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.192610] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 25.200208] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.207868] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.224834] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 25.233531] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.241050] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.589952] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 27.721289] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 27.734345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.743903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.801095] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 27.934072] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 27.940242] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.952256] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.029038] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 28.045528] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 28.120998] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 28.141300] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 28.156083] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 28.168000] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 28.176403] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.184686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.193140] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 28.199524] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.206544] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.290014] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 28.299541] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 28.308577] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 28.315965] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.323283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.329954] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.336701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.344993] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 28.352591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.359346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.468545] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 28.474778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.481410] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/06/21 00:50:47 executed programs: 8 [ 29.142886] ================================================================== [ 29.150293] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 29.157560] Read of size 4 at addr ffff8801c67a6c80 by task syz-executor3/6611 [ 29.164906] [ 29.166536] CPU: 1 PID: 6611 Comm: syz-executor3 Not tainted 4.9.109-ge1815b3 #3 [ 29.174059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.183432] ffff8801c72f7af0 ffffffff81eb3e29 ffffea000719e980 ffff8801c67a6c80 [ 29.191481] 0000000000000000 ffff8801c67a6c80 ffffffff83013be0 ffff8801c72f7b28 [ 29.199540] ffffffff81567a89 ffff8801c67a6c80 0000000000000004 0000000000000000 [ 29.207580] Call Trace: [ 29.210163] [] dump_stack+0xc1/0x128 [ 29.215531] [] ? sock_release+0x1c0/0x1c0 [ 29.221328] [] print_address_description+0x6c/0x234 [ 29.227997] [] ? sock_release+0x1c0/0x1c0 [ 29.233801] [] kasan_report.cold.6+0x242/0x2fe [ 29.240994] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 29.247748] [] __asan_report_load4_noabort+0x14/0x20 [ 29.254510] [] l2tp_session_queue_purge+0xf4/0x100 [ 29.261091] [] ? sock_release+0x1c0/0x1c0 [ 29.266893] [] pppol2tp_release+0x1fb/0x2e0 [ 29.272866] [] sock_release+0x96/0x1c0 [ 29.278403] [] sock_close+0x16/0x20 [ 29.283682] [] __fput+0x263/0x700 [ 29.288806] [] ____fput+0x15/0x20 [ 29.295000] [] task_work_run+0x10c/0x180 [ 29.300723] [] do_exit+0x9e1/0x27c0 [ 29.306004] [] ? release_task.part.19+0x1210/0x1210 [ 29.312675] [] ? __do_page_fault+0x5dd/0xd50 [ 29.318741] [] ? up_read+0x1a/0x40 [ 29.323933] [] ? __do_page_fault+0x183/0xd50 [ 29.329993] [] do_group_exit+0x111/0x340 [ 29.335725] [] ? do_group_exit+0x340/0x340 [ 29.341610] [] SyS_exit_group+0x1d/0x20 [ 29.347234] [] do_fast_syscall_32+0x2f7/0x870 [ 29.353382] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.360050] [] entry_SYSENTER_compat+0x90/0xa2 [ 29.366271] [ 29.367893] Allocated by task 6598: [ 29.371521] save_stack_trace+0x16/0x20 [ 29.375492] save_stack+0x43/0xd0 [ 29.378943] kasan_kmalloc+0xc7/0xe0 [ 29.382664] __kmalloc+0x11d/0x300 [ 29.386208] l2tp_session_create+0x38/0x16f0 [ 29.390615] pppol2tp_connect+0x10d7/0x18f0 [ 29.394935] SYSC_connect+0x1b8/0x300 [ 29.398737] SyS_connect+0x24/0x30 [ 29.402275] do_fast_syscall_32+0x2f7/0x870 [ 29.406592] entry_SYSENTER_compat+0x90/0xa2 [ 29.410989] [ 29.412617] Freed by task 6585: [ 29.415894] save_stack_trace+0x16/0x20 [ 29.419866] save_stack+0x43/0xd0 [ 29.423318] kasan_slab_free+0x72/0xc0 [ 29.427204] kfree+0xfb/0x310 [ 29.430310] l2tp_session_free+0x166/0x200 [ 29.434540] l2tp_tunnel_closeall+0x284/0x350 [ 29.439035] l2tp_udp_encap_destroy+0x87/0xe0 [ 29.443528] udpv6_destroy_sock+0xb1/0xd0 [ 29.447673] sk_common_release+0x6d/0x300 [ 29.451824] udp_lib_close+0x15/0x20 [ 29.455540] inet_release+0xff/0x1d0 [ 29.459255] inet6_release+0x50/0x70 [ 29.462969] sock_release+0x96/0x1c0 [ 29.466692] sock_close+0x16/0x20 [ 29.470146] __fput+0x263/0x700 [ 29.473421] ____fput+0x15/0x20 [ 29.476712] task_work_run+0x10c/0x180 [ 29.480602] do_exit+0x9e1/0x27c0 [ 29.484064] do_group_exit+0x111/0x340 [ 29.487948] SyS_exit_group+0x1d/0x20 [ 29.491749] do_fast_syscall_32+0x2f7/0x870 [ 29.496069] entry_SYSENTER_compat+0x90/0xa2 [ 29.500468] [ 29.502086] The buggy address belongs to the object at ffff8801c67a6c80 [ 29.502086] which belongs to the cache kmalloc-512 of size 512 [ 29.514737] The buggy address is located 0 bytes inside of [ 29.514737] 512-byte region [ffff8801c67a6c80, ffff8801c67a6e80) [ 29.526429] The buggy address belongs to the page: [ 29.531387] page:ffffea000719e980 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 29.541626] flags: 0x8000000000004080(slab|head) [ 29.546367] page dumped because: kasan: bad access detected [ 29.552064] [ 29.553688] Memory state around the buggy address: [ 29.558608] ffff8801c67a6b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.565980] ffff8801c67a6c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.573335] >ffff8801c67a6c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.580693] ^ [ 29.584052] ffff8801c67a6d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.591415] ffff8801c67a6d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.598777] ================================================================== [ 29.606125] Disabling lock debugging due to kernel taint [ 29.619074] Kernel panic - not syncing: panic_on_warn set ... [ 29.619074] [ 29.626466] CPU: 1 PID: 6611 Comm: syz-executor3 Tainted: G B 4.9.109-ge1815b3 #3 [ 29.635209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.644559] ffff8801c72f7a50 ffffffff81eb3e29 ffffffff843c6327 00000000ffffffff [ 29.652617] 0000000000000000 0000000000000001 ffffffff83013be0 ffff8801c72f7b10 [ 29.660667] ffffffff81421925 0000000041b58ab3 ffffffff843b9a40 ffffffff81421766 [ 29.668718] Call Trace: [ 29.671908] [] dump_stack+0xc1/0x128 [ 29.677270] [] ? sock_release+0x1c0/0x1c0 [ 29.683065] [] panic+0x1bf/0x3bc [ 29.688073] [] ? add_taint.cold.6+0x16/0x16 [ 29.694026] [] ? ___preempt_schedule+0x16/0x18 [ 29.700235] [] kasan_end_report+0x47/0x4f [ 29.706020] [] kasan_report.cold.6+0x76/0x2fe [ 29.712145] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 29.718887] [] __asan_report_load4_noabort+0x14/0x20 [ 29.725627] [] l2tp_session_queue_purge+0xf4/0x100 [ 29.732193] [] ? sock_release+0x1c0/0x1c0 [ 29.737969] [] pppol2tp_release+0x1fb/0x2e0 [ 29.743930] [] sock_release+0x96/0x1c0 [ 29.749443] [] sock_close+0x16/0x20 [ 29.754699] [] __fput+0x263/0x700 [ 29.759787] [] ____fput+0x15/0x20 [ 29.764876] [] task_work_run+0x10c/0x180 [ 29.770566] [] do_exit+0x9e1/0x27c0 [ 29.775820] [] ? release_task.part.19+0x1210/0x1210 [ 29.782463] [] ? __do_page_fault+0x5dd/0xd50 [ 29.788507] [] ? up_read+0x1a/0x40 [ 29.793679] [] ? __do_page_fault+0x183/0xd50 [ 29.799715] [] do_group_exit+0x111/0x340 [ 29.805403] [] ? do_group_exit+0x340/0x340 [ 29.811264] [] SyS_exit_group+0x1d/0x20 [ 29.816870] [] do_fast_syscall_32+0x2f7/0x870 [ 29.822992] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.829650] [] entry_SYSENTER_compat+0x90/0xa2 [ 29.836429] Dumping ftrace buffer: [ 29.839959] (ftrace buffer empty) [ 29.843645] Kernel Offset: disabled [ 29.847245] Rebooting in 86400 seconds..