[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 28.251216] random: sshd: uninitialized urandom read (32 bytes read) [ 28.617972] audit: type=1400 audit(1545805267.063:6): avc: denied { map } for pid=1779 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 28.662031] random: sshd: uninitialized urandom read (32 bytes read) [ 29.201618] random: sshd: uninitialized urandom read (32 bytes read) [ 107.007673] random: sshd: uninitialized urandom read (32 bytes read) INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "3" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes Warning: Permanently added '10.128.10.58' (ECDSA) to the list of known hosts. [ 112.685362] random: sshd: uninitialized urandom read (32 bytes read) [ 112.780926] audit: type=1400 audit(1545805351.233:7): avc: denied { map } for pid=1839 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/12/26 06:22:31 parsed 1 programs [ 113.466813] audit: type=1400 audit(1545805351.913:8): avc: denied { map } for pid=1839 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=4999 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 114.013352] random: cc1: uninitialized urandom read (8 bytes read) 2018/12/26 06:22:33 executed programs: 0 [ 118.024601] audit: type=1400 audit(1545805356.473:9): avc: denied { create } for pid=2320 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 118.048805] audit: type=1400 audit(1545805356.473:10): avc: denied { write } for pid=2320 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 118.073446] audit: type=1400 audit(1545805356.473:11): avc: denied { read } for pid=2320 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 2018/12/26 06:22:38 executed programs: 77 2018/12/26 06:22:43 executed programs: 273 2018/12/26 06:22:48 executed programs: 468 2018/12/26 06:22:53 executed programs: 663 2018/12/26 06:22:58 executed programs: 858 2018/12/26 06:23:03 executed programs: 1049 2018/12/26 06:23:08 executed programs: 1239 [ 151.940336] ================================================================== [ 151.947822] BUG: KASAN: user-memory-access in n_tty_set_termios+0xee/0xcb0 [ 151.954824] Write of size 512 at addr 0000000000001060 by task syz-executor0/12778 [ 151.962524] [ 151.964142] CPU: 1 PID: 12778 Comm: syz-executor0 Not tainted 4.14.90+ #29 [ 151.971133] Call Trace: [ 151.973725] dump_stack+0xb9/0x11b [ 151.977266] kasan_report.cold.6+0x6d/0x2dd [ 151.981568] ? n_tty_set_termios+0xee/0xcb0 [ 151.985873] memset+0x1f/0x40 [ 151.988975] n_tty_set_termios+0xee/0xcb0 [ 151.993105] ? process_echoes+0x140/0x140 [ 151.997242] tty_set_termios+0x5fd/0x860 [ 152.001293] ? tty_wait_until_sent+0x480/0x480 [ 152.005858] ? lock_downgrade+0x560/0x560 [ 152.009991] set_termios+0x2bf/0x440 [ 152.013699] ? __tty_perform_flush+0x200/0x200 [ 152.018280] tty_mode_ioctl+0x870/0x920 [ 152.022240] ? tty_perform_flush+0x70/0x70 [ 152.026456] ? __ldsem_down_read_nested+0xb6/0x5b0 [ 152.031369] ? __ldsem_down_read_nested+0xd4/0x5b0 [ 152.036288] ? __ldsem_wake+0x320/0x320 [ 152.040251] ? avc_has_extended_perms+0x406/0xd50 [ 152.045076] n_tty_ioctl_helper+0x3f/0x350 [ 152.049297] n_tty_ioctl+0x43/0x2e0 [ 152.052905] ? pty_write_room+0xc0/0xc0 [ 152.056859] tty_ioctl+0x551/0x13e0 [ 152.060467] ? n_tty_receive_buf+0x40/0x40 [ 152.064680] ? tty_vhangup+0x30/0x30 [ 152.068410] ? avc_ss_reset+0x100/0x100 [ 152.072379] ? __lock_acquire+0x619/0x4320 [ 152.076600] ? trace_hardirqs_on+0x10/0x10 [ 152.080830] ? trace_hardirqs_on+0x10/0x10 [ 152.085054] ? trace_hardirqs_on+0x10/0x10 [ 152.089277] ? tty_vhangup+0x30/0x30 [ 152.092977] do_vfs_ioctl+0x1a0/0x1030 [ 152.096847] ? ioctl_preallocate+0x1d0/0x1d0 [ 152.101238] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 152.106928] ? print_irq_inversion_bug.cold.45+0x8b/0x320 [ 152.112444] ? lock_acquire+0x10f/0x380 [ 152.116399] ? check_preemption_disabled+0x34/0x1e0 [ 152.121393] ? assoc_array_gc+0x10eb/0x1120 [ 152.125699] ? __fget+0x22b/0x3a0 [ 152.129153] ? security_file_ioctl+0x7c/0xb0 [ 152.133542] SyS_ioctl+0x7e/0xb0 [ 152.136899] ? do_vfs_ioctl+0x1030/0x1030 [ 152.141029] do_syscall_64+0x19b/0x4b0 [ 152.144920] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 152.150096] RIP: 0033:0x457759 [ 152.153266] RSP: 002b:00007f8587a65c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 152.160952] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457759 [ 152.168198] RDX: 0000000020000000 RSI: 0000000000005402 RDI: 0000000000000006 [ 152.175447] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 152.182696] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8587a666d4 [ 152.189959] R13: 00000000004c1710 R14: 00000000004d37f8 R15: 00000000ffffffff [ 152.197251] ================================================================== [ 152.204586] Disabling lock debugging due to kernel taint [ 152.211138] Kernel panic - not syncing: panic_on_warn set ... [ 152.211138] [ 152.218503] CPU: 1 PID: 12778 Comm: syz-executor0 Tainted: G B 4.14.90+ #29 [ 152.226704] Call Trace: [ 152.229273] dump_stack+0xb9/0x11b [ 152.232794] panic+0x1bf/0x3a4 [ 152.235971] ? add_taint.cold.4+0x16/0x16 [ 152.240099] ? ___preempt_schedule+0x16/0x18 [ 152.244491] kasan_end_report+0x43/0x49 [ 152.248441] kasan_report.cold.6+0x77/0x2dd [ 152.252761] ? n_tty_set_termios+0xee/0xcb0 [ 152.257065] memset+0x1f/0x40 [ 152.260149] n_tty_set_termios+0xee/0xcb0 [ 152.264289] ? process_echoes+0x140/0x140 [ 152.268416] tty_set_termios+0x5fd/0x860 [ 152.272455] ? tty_wait_until_sent+0x480/0x480 [ 152.277013] ? lock_downgrade+0x560/0x560 [ 152.281148] set_termios+0x2bf/0x440 [ 152.284846] ? __tty_perform_flush+0x200/0x200 [ 152.289460] tty_mode_ioctl+0x870/0x920 [ 152.293414] ? tty_perform_flush+0x70/0x70 [ 152.297625] ? __ldsem_down_read_nested+0xb6/0x5b0 [ 152.302546] ? __ldsem_down_read_nested+0xd4/0x5b0 [ 152.307459] ? __ldsem_wake+0x320/0x320 [ 152.311428] ? avc_has_extended_perms+0x406/0xd50 [ 152.316252] n_tty_ioctl_helper+0x3f/0x350 [ 152.320465] n_tty_ioctl+0x43/0x2e0 [ 152.324068] ? pty_write_room+0xc0/0xc0 [ 152.328017] tty_ioctl+0x551/0x13e0 [ 152.331627] ? n_tty_receive_buf+0x40/0x40 [ 152.335839] ? tty_vhangup+0x30/0x30 [ 152.339533] ? avc_ss_reset+0x100/0x100 [ 152.343489] ? __lock_acquire+0x619/0x4320 [ 152.347705] ? trace_hardirqs_on+0x10/0x10 [ 152.351918] ? trace_hardirqs_on+0x10/0x10 [ 152.356128] ? trace_hardirqs_on+0x10/0x10 [ 152.360344] ? tty_vhangup+0x30/0x30 [ 152.364046] do_vfs_ioctl+0x1a0/0x1030 [ 152.367917] ? ioctl_preallocate+0x1d0/0x1d0 [ 152.372310] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 152.378002] ? print_irq_inversion_bug.cold.45+0x8b/0x320 [ 152.383513] ? lock_acquire+0x10f/0x380 [ 152.387485] ? check_preemption_disabled+0x34/0x1e0 [ 152.392478] ? assoc_array_gc+0x10eb/0x1120 [ 152.396776] ? __fget+0x22b/0x3a0 [ 152.400211] ? security_file_ioctl+0x7c/0xb0 [ 152.404595] SyS_ioctl+0x7e/0xb0 [ 152.407939] ? do_vfs_ioctl+0x1030/0x1030 [ 152.412064] do_syscall_64+0x19b/0x4b0 [ 152.415937] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 152.421112] RIP: 0033:0x457759 [ 152.424277] RSP: 002b:00007f8587a65c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 152.431962] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457759 [ 152.439212] RDX: 0000000020000000 RSI: 0000000000005402 RDI: 0000000000000006 [ 152.446456] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 152.453701] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8587a666d4 [ 152.460971] R13: 00000000004c1710 R14: 00000000004d37f8 R15: 00000000ffffffff [ 152.468571] Kernel Offset: 0x16a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 152.479472] Rebooting in 86400 seconds..