[....] Starting OpenBSD Secure Shell server: sshd[ 20.896155] random: sshd: uninitialized urandom read (32 bytes read) [ 20.996646] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 21.326811] sshd (4446) used greatest stack depth: 16552 bytes left [ 21.343699] random: sshd: uninitialized urandom read (32 bytes read) [ 22.096854] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.253065] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.43' (ECDSA) to the list of known hosts. [ 27.722252] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 27.819359] ================================================================== [ 27.826804] BUG: KASAN: slab-out-of-bounds in process_preds+0x191f/0x19d0 [ 27.833710] Write of size 4 at addr ffff8801cae83070 by task syz-executor935/4488 [ 27.841343] [ 27.842958] CPU: 1 PID: 4488 Comm: syz-executor935 Not tainted 4.17.0-rc4+ #16 [ 27.850292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.859627] Call Trace: [ 27.862197] dump_stack+0x1b9/0x294 [ 27.865804] ? dump_stack_print_info.cold.2+0x52/0x52 [ 27.870974] ? printk+0x9e/0xba [ 27.874233] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 27.878974] ? kasan_check_write+0x14/0x20 [ 27.883189] print_address_description+0x6c/0x20b [ 27.888013] ? process_preds+0x191f/0x19d0 [ 27.892227] kasan_report.cold.7+0x242/0x2fe [ 27.896615] __asan_report_store4_noabort+0x17/0x20 [ 27.901613] process_preds+0x191f/0x19d0 [ 27.905668] ? parse_pred+0x28e0/0x28e0 [ 27.909625] ? create_filter_start.constprop.12+0x55/0x2b0 [ 27.915229] create_filter+0x155/0x270 [ 27.919120] ? process_preds+0x19d0/0x19d0 [ 27.923346] ftrace_profile_set_filter+0x130/0x2e0 [ 27.928257] ? ftrace_profile_free_filter+0x70/0x70 [ 27.933255] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 27.938771] ? memdup_user+0x6b/0xa0 [ 27.942468] perf_event_set_filter+0x248/0x1230 [ 27.947129] ? kasan_check_write+0x14/0x20 [ 27.951346] ? mutex_trylock+0x2a0/0x2a0 [ 27.955391] ? perf_pmu_unregister+0x530/0x530 [ 27.959968] ? lockdep_init_map+0x9/0x10 [ 27.964007] ? debug_mutex_init+0x2d/0x60 [ 27.968136] ? mutex_trylock+0x2a0/0x2a0 [ 27.972179] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 27.977703] ? graph_lock+0x170/0x170 [ 27.981483] ? lock_downgrade+0x8e0/0x8e0 [ 27.985614] ? kasan_check_read+0x11/0x20 [ 27.989743] ? rcu_is_watching+0x85/0x140 [ 27.993869] ? __lock_is_held+0xb5/0x140 [ 27.997909] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 28.003088] _perf_ioctl+0x84c/0x15e0 [ 28.006870] ? __do_sys_perf_event_open+0x2fa0/0x2fa0 [ 28.012041] ? lock_downgrade+0x8e0/0x8e0 [ 28.016167] ? get_unused_fd_flags+0x190/0x190 [ 28.020731] ? kasan_check_read+0x11/0x20 [ 28.024859] ? rcu_is_watching+0x85/0x140 [ 28.028984] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 28.034154] ? mark_held_locks+0xc9/0x160 [ 28.038285] ? mutex_lock_nested+0x16/0x20 [ 28.042496] ? mutex_lock_nested+0x16/0x20 [ 28.046710] ? perf_event_ctx_lock_nested+0x40d/0x4e0 [ 28.051881] ? perf_event_read_event+0x430/0x430 [ 28.056618] ? __do_sys_perf_event_open+0x7b4/0x2fa0 [ 28.061705] perf_ioctl+0x59/0x80 [ 28.065139] ? _perf_ioctl+0x15e0/0x15e0 [ 28.069181] do_vfs_ioctl+0x1cf/0x16a0 [ 28.073052] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 28.078570] ? ioctl_preallocate+0x2e0/0x2e0 [ 28.082956] ? fget_raw+0x20/0x20 [ 28.086390] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 28.091905] ? __do_page_fault+0x441/0xe40 [ 28.096133] ? security_file_ioctl+0x94/0xc0 [ 28.100521] ksys_ioctl+0xa9/0xd0 [ 28.103956] __x64_sys_ioctl+0x73/0xb0 [ 28.107823] do_syscall_64+0x1b1/0x800 [ 28.111689] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 28.116511] ? syscall_return_slowpath+0x5c0/0x5c0 [ 28.121418] ? syscall_return_slowpath+0x30f/0x5c0 [ 28.126327] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 28.131670] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.136492] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.141660] RIP: 0033:0x43fdb9 [ 28.144827] RSP: 002b:00007ffe7612a838 EFLAGS: 00000213 ORIG_RAX: 0000000000000010 [ 28.152525] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdb9 [ 28.159771] RDX: 00000000200000c0 RSI: 0000000040082406 RDI: 0000000000000003 [ 28.167022] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 28.174276] R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004016e0 [ 28.181531] R13: 0000000000401770 R14: 0000000000000000 R15: 0000000000000000 [ 28.188788] [ 28.190397] Allocated by task 2419: [ 28.194413] save_stack+0x43/0xd0 [ 28.197851] kasan_kmalloc+0xc4/0xe0 [ 28.201541] __kmalloc+0x14e/0x760 [ 28.205065] kobject_get_path+0xc2/0x1a0 [ 28.209106] kobject_uevent_env+0x234/0x1110 [ 28.213505] kobject_synth_uevent+0xa4f/0xc0b [ 28.217982] uevent_store+0x26/0x70 [ 28.221588] dev_attr_store+0x5e/0x90 [ 28.225375] sysfs_kf_write+0x118/0x170 [ 28.229329] kernfs_fop_write+0x2ba/0x480 [ 28.233456] __vfs_write+0x10b/0x960 [ 28.237148] vfs_write+0x1f8/0x560 [ 28.240671] ksys_write+0xf9/0x250 [ 28.244191] __x64_sys_write+0x73/0xb0 [ 28.248056] do_syscall_64+0x1b1/0x800 [ 28.251928] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.257090] [ 28.258697] Freed by task 2419: [ 28.261960] save_stack+0x43/0xd0 [ 28.265393] __kasan_slab_free+0x11a/0x170 [ 28.269605] kasan_slab_free+0xe/0x10 [ 28.273383] kfree+0xd9/0x260 [ 28.276469] kobject_uevent_env+0x275/0x1110 [ 28.280857] kobject_synth_uevent+0xa4f/0xc0b [ 28.285330] uevent_store+0x26/0x70 [ 28.288936] dev_attr_store+0x5e/0x90 [ 28.292718] sysfs_kf_write+0x118/0x170 [ 28.296669] kernfs_fop_write+0x2ba/0x480 [ 28.300796] __vfs_write+0x10b/0x960 [ 28.304486] vfs_write+0x1f8/0x560 [ 28.308005] ksys_write+0xf9/0x250 [ 28.311536] __x64_sys_write+0x73/0xb0 [ 28.315402] do_syscall_64+0x1b1/0x800 [ 28.319268] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.324431] [ 28.326042] The buggy address belongs to the object at ffff8801cae83000 [ 28.326042] which belongs to the cache kmalloc-64 of size 64 [ 28.338511] The buggy address is located 48 bytes to the right of [ 28.338511] 64-byte region [ffff8801cae83000, ffff8801cae83040) [ 28.350708] The buggy address belongs to the page: [ 28.355620] page:ffffea00072ba0c0 count:1 mapcount:0 mapping:ffff8801cae83000 index:0xffff8801cae83e80 [ 28.365046] flags: 0x2fffc0000000100(slab) [ 28.369259] raw: 02fffc0000000100 ffff8801cae83000 ffff8801cae83e80 0000000100000009 [ 28.377118] raw: ffffea00073caae0 ffff8801da801338 ffff8801da800340 0000000000000000 [ 28.384973] page dumped because: kasan: bad access detected [ 28.390661] [ 28.392269] Memory state around the buggy address: [ 28.397174] ffff8801cae82f00: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 28.404534] ffff8801cae82f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.411870] >ffff8801cae83000: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.419204] ^ [ 28.426193] ffff8801cae83080: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 28.433530] ffff8801cae83100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 28.440862] ================================================================== [ 28.448196] Disabling lock debugging due to kernel taint [ 28.453705] Kernel panic - not syncing: panic_on_warn set ... [ 28.453705] [ 28.461073] CPU: 1 PID: 4488 Comm: syz-executor935 Tainted: G B 4.17.0-rc4+ #16 [ 28.469807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.479135] Call Trace: [ 28.481702] dump_stack+0x1b9/0x294 [ 28.485307] ? dump_stack_print_info.cold.2+0x52/0x52 [ 28.490477] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 28.495226] ? process_preds+0x18f0/0x19d0 [ 28.499437] panic+0x22f/0x4de [ 28.502606] ? add_taint.cold.5+0x16/0x16 [ 28.506731] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.511115] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.515510] ? process_preds+0x191f/0x19d0 [ 28.519728] kasan_end_report+0x47/0x4f [ 28.523679] kasan_report.cold.7+0x76/0x2fe [ 28.527984] __asan_report_store4_noabort+0x17/0x20 [ 28.532978] process_preds+0x191f/0x19d0 [ 28.537026] ? parse_pred+0x28e0/0x28e0 [ 28.540986] ? create_filter_start.constprop.12+0x55/0x2b0 [ 28.546592] create_filter+0x155/0x270 [ 28.550464] ? process_preds+0x19d0/0x19d0 [ 28.554678] ftrace_profile_set_filter+0x130/0x2e0 [ 28.559586] ? ftrace_profile_free_filter+0x70/0x70 [ 28.564580] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 28.570096] ? memdup_user+0x6b/0xa0 [ 28.573791] perf_event_set_filter+0x248/0x1230 [ 28.578438] ? kasan_check_write+0x14/0x20 [ 28.582651] ? mutex_trylock+0x2a0/0x2a0 [ 28.586689] ? perf_pmu_unregister+0x530/0x530 [ 28.591246] ? lockdep_init_map+0x9/0x10 [ 28.595282] ? debug_mutex_init+0x2d/0x60 [ 28.599409] ? mutex_trylock+0x2a0/0x2a0 [ 28.603451] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 28.608968] ? graph_lock+0x170/0x170 [ 28.612746] ? lock_downgrade+0x8e0/0x8e0 [ 28.616872] ? kasan_check_read+0x11/0x20 [ 28.620999] ? rcu_is_watching+0x85/0x140 [ 28.625133] ? __lock_is_held+0xb5/0x140 [ 28.629170] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 28.634343] _perf_ioctl+0x84c/0x15e0 [ 28.638123] ? __do_sys_perf_event_open+0x2fa0/0x2fa0 [ 28.643292] ? lock_downgrade+0x8e0/0x8e0 [ 28.647415] ? get_unused_fd_flags+0x190/0x190 [ 28.651982] ? kasan_check_read+0x11/0x20 [ 28.656107] ? rcu_is_watching+0x85/0x140 [ 28.660234] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 28.665412] ? mark_held_locks+0xc9/0x160 [ 28.669547] ? mutex_lock_nested+0x16/0x20 [ 28.673759] ? mutex_lock_nested+0x16/0x20 [ 28.677980] ? perf_event_ctx_lock_nested+0x40d/0x4e0 [ 28.683149] ? perf_event_read_event+0x430/0x430 [ 28.687888] ? __do_sys_perf_event_open+0x7b4/0x2fa0 [ 28.692970] perf_ioctl+0x59/0x80 [ 28.696410] ? _perf_ioctl+0x15e0/0x15e0 [ 28.700458] do_vfs_ioctl+0x1cf/0x16a0 [ 28.704327] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 28.709839] ? ioctl_preallocate+0x2e0/0x2e0 [ 28.714223] ? fget_raw+0x20/0x20 [ 28.717657] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 28.723170] ? __do_page_fault+0x441/0xe40 [ 28.727385] ? security_file_ioctl+0x94/0xc0 [ 28.731770] ksys_ioctl+0xa9/0xd0 [ 28.735200] __x64_sys_ioctl+0x73/0xb0 [ 28.739100] do_syscall_64+0x1b1/0x800 [ 28.742963] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 28.747781] ? syscall_return_slowpath+0x5c0/0x5c0 [ 28.752687] ? syscall_return_slowpath+0x30f/0x5c0 [ 28.757595] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 28.762934] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.767767] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 28.772934] RIP: 0033:0x43fdb9 [ 28.776101] RSP: 002b:00007ffe7612a838 EFLAGS: 00000213 ORIG_RAX: 0000000000000010 [ 28.783787] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdb9 [ 28.791033] RDX: 00000000200000c0 RSI: 0000000040082406 RDI: 0000000000000003 [ 28.798278] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 28.805523] R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004016e0 [ 28.812769] R13: 0000000000401770 R14: 0000000000000000 R15: 0000000000000000 [ 28.820514] Dumping ftrace buffer: [ 28.824040] (ftrace buffer empty) [ 28.827725] Kernel Offset: disabled [ 28.831328] Rebooting in 86400 seconds..