[ 40.484342] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.26' (ECDSA) to the list of known hosts. [ 46.174669] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 46.295314] audit: type=1400 audit(1584964316.269:36): avc: denied { map } for pid=7476 comm="syz-executor293" path="/root/syz-executor293405943" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 49.560230] ================================================================== [ 49.567778] BUG: KASAN: use-after-free in snd_seq_timer_interrupt+0x305/0x380 [ 49.575046] Read of size 8 at addr ffff88808ec0e618 by task swapper/1/0 [ 49.581776] [ 49.583389] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.174-syzkaller #0 [ 49.590467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.599834] Call Trace: [ 49.602415] [ 49.604552] dump_stack+0x13e/0x194 [ 49.608160] ? snd_seq_timer_interrupt+0x305/0x380 [ 49.613074] print_address_description.cold+0x7c/0x1e2 [ 49.618333] ? snd_seq_timer_interrupt+0x305/0x380 [ 49.623244] kasan_report.cold+0xa9/0x2ae [ 49.627386] snd_seq_timer_interrupt+0x305/0x380 [ 49.632135] snd_timer_interrupt+0x653/0xec0 [ 49.636534] ? initialize_timer+0x270/0x270 [ 49.640842] call_timer_fn+0x14a/0x650 [ 49.644719] ? snd_timer_interrupt+0xec0/0xec0 [ 49.649284] ? __next_timer_interrupt+0x140/0x140 [ 49.654113] ? _raw_spin_unlock_irq+0x24/0x80 [ 49.658587] ? snd_timer_interrupt+0xec0/0xec0 [ 49.663150] ? snd_timer_interrupt+0xec0/0xec0 [ 49.667719] run_timer_softirq+0x52a/0x1390 [ 49.672025] ? add_timer+0xa20/0xa20 [ 49.675733] ? kvm_clock_read+0x1f/0x30 [ 49.679703] ? kvm_sched_clock_read+0x5/0x10 [ 49.684099] ? sched_clock_cpu+0x18/0x1b0 [ 49.688233] __do_softirq+0x254/0x9bf [ 49.692064] ? check_preemption_disabled+0x35/0x240 [ 49.697120] irq_exit+0x15b/0x1a0 [ 49.700560] smp_apic_timer_interrupt+0x141/0x5e0 [ 49.705393] apic_timer_interrupt+0x8f/0xa0 [ 49.709698] [ 49.711918] RIP: 0010:native_safe_halt+0xe/0x10 [ 49.716568] RSP: 0018:ffff8880a989fee0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 [ 49.724255] RAX: 1ffffffff0fa2cd4 RBX: dffffc0000000000 RCX: 0000000000000000 [ 49.731505] RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880a988abbc [ 49.738753] RBP: ffffffff87d16690 R08: 1ffffffff1124101 R09: 0000000000000000 [ 49.746003] R10: 0000000000000000 R11: 0000000000000000 R12: ffffed1015311468 [ 49.753252] R13: ffff8880a988a340 R14: 0000000000000000 R15: 0000000000000000 [ 49.760517] default_idle+0x47/0x370 [ 49.764223] do_idle+0x250/0x3c0 [ 49.767568] cpu_startup_entry+0x14/0x20 [ 49.771612] secondary_startup_64+0xa5/0xb0 [ 49.775914] [ 49.777530] Allocated by task 8523: [ 49.781199] save_stack+0x32/0xa0 [ 49.784655] kasan_kmalloc+0xbf/0xe0 [ 49.788362] kmem_cache_alloc_trace+0x14d/0x7b0 [ 49.793013] snd_seq_queue_alloc+0x51/0x490 [ 49.797315] snd_seq_ioctl_create_queue+0xa5/0x2f0 [ 49.802233] snd_seq_ioctl+0x1af/0x2f0 [ 49.806108] do_vfs_ioctl+0x75a/0xfe0 [ 49.809886] SyS_ioctl+0x7f/0xb0 [ 49.813239] do_syscall_64+0x1d5/0x640 [ 49.817103] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 49.822282] [ 49.823898] Freed by task 8523: [ 49.827167] save_stack+0x32/0xa0 [ 49.830597] kasan_slab_free+0x75/0xc0 [ 49.834460] kfree+0xcb/0x260 [ 49.837554] snd_seq_queue_client_leave+0x2f/0x120 [ 49.842460] seq_free_client1.part.0+0xf0/0x270 [ 49.847107] seq_free_client+0x6c/0xe0 [ 49.850984] snd_seq_release+0x4d/0xe0 [ 49.854851] __fput+0x25f/0x790 [ 49.858115] task_work_run+0x113/0x190 [ 49.861984] do_exit+0x9f2/0x2b00 [ 49.865415] do_group_exit+0x100/0x310 [ 49.869279] SyS_exit_group+0x19/0x20 [ 49.873059] do_syscall_64+0x1d5/0x640 [ 49.876935] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 49.882105] [ 49.883711] The buggy address belongs to the object at ffff88808ec0e5c0 [ 49.883711] which belongs to the cache kmalloc-512 of size 512 [ 49.896346] The buggy address is located 88 bytes inside of [ 49.896346] 512-byte region [ffff88808ec0e5c0, ffff88808ec0e7c0) [ 49.908112] The buggy address belongs to the page: [ 49.913031] page:ffffea00023b0380 count:1 mapcount:0 mapping:ffff88808ec0e0c0 index:0x0 [ 49.921193] flags: 0xfffe0000000100(slab) [ 49.925332] raw: 00fffe0000000100 ffff88808ec0e0c0 0000000000000000 0000000100000006 [ 49.933190] raw: ffffea00023b9c60 ffffea00023b1a20 ffff88812fe56940 0000000000000000 [ 49.941089] page dumped because: kasan: bad access detected [ 49.946774] [ 49.948383] Memory state around the buggy address: [ 49.953315] ffff88808ec0e500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 49.960657] ffff88808ec0e580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 49.968031] >ffff88808ec0e600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.975370] ^ [ 49.979494] ffff88808ec0e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.986831] ffff88808ec0e700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.994201] ================================================================== [ 50.001546] Disabling lock debugging due to kernel taint [ 50.006971] Kernel panic - not syncing: panic_on_warn set ... [ 50.006971] [ 50.014340] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 4.14.174-syzkaller #0 [ 50.022678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.032010] Call Trace: [ 50.034576] [ 50.036737] dump_stack+0x13e/0x194 [ 50.040382] panic+0x1f9/0x42d [ 50.043551] ? add_taint.cold+0x16/0x16 [ 50.047512] ? lock_downgrade+0x6e0/0x6e0 [ 50.051638] ? snd_seq_timer_interrupt+0x305/0x380 [ 50.056546] kasan_end_report+0x43/0x49 [ 50.060497] kasan_report.cold+0x12f/0x2ae [ 50.064721] snd_seq_timer_interrupt+0x305/0x380 [ 50.069454] snd_timer_interrupt+0x653/0xec0 [ 50.073855] ? initialize_timer+0x270/0x270 [ 50.078158] call_timer_fn+0x14a/0x650 [ 50.082023] ? snd_timer_interrupt+0xec0/0xec0 [ 50.086583] ? __next_timer_interrupt+0x140/0x140 [ 50.091404] ? _raw_spin_unlock_irq+0x24/0x80 [ 50.095881] ? snd_timer_interrupt+0xec0/0xec0 [ 50.100441] ? snd_timer_interrupt+0xec0/0xec0 [ 50.105002] run_timer_softirq+0x52a/0x1390 [ 50.109306] ? add_timer+0xa20/0xa20 [ 50.112994] ? kvm_clock_read+0x1f/0x30 [ 50.116958] ? kvm_sched_clock_read+0x5/0x10 [ 50.121350] ? sched_clock_cpu+0x18/0x1b0 [ 50.125509] __do_softirq+0x254/0x9bf [ 50.129374] ? check_preemption_disabled+0x35/0x240 [ 50.134382] irq_exit+0x15b/0x1a0 [ 50.137813] smp_apic_timer_interrupt+0x141/0x5e0 [ 50.142633] apic_timer_interrupt+0x8f/0xa0 [ 50.146928] [ 50.149143] RIP: 0010:native_safe_halt+0xe/0x10 [ 50.153783] RSP: 0018:ffff8880a989fee0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 [ 50.161465] RAX: 1ffffffff0fa2cd4 RBX: dffffc0000000000 RCX: 0000000000000000 [ 50.168750] RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880a988abbc [ 50.176006] RBP: ffffffff87d16690 R08: 1ffffffff1124101 R09: 0000000000000000 [ 50.183260] R10: 0000000000000000 R11: 0000000000000000 R12: ffffed1015311468 [ 50.190505] R13: ffff8880a988a340 R14: 0000000000000000 R15: 0000000000000000 [ 50.197762] default_idle+0x47/0x370 [ 50.201456] do_idle+0x250/0x3c0 [ 50.204829] cpu_startup_entry+0x14/0x20 [ 50.208864] secondary_startup_64+0xa5/0xb0 [ 50.214072] Kernel Offset: disabled [ 50.217720] Rebooting in 86400 seconds..