[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.575852] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.927864] random: sshd: uninitialized urandom read (32 bytes read) [ 25.310190] random: sshd: uninitialized urandom read (32 bytes read) [ 26.179864] random: sshd: uninitialized urandom read (32 bytes read) [ 26.338083] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.27' (ECDSA) to the list of known hosts. [ 31.757960] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 36.967166] ================================================================== [ 36.974637] BUG: KASAN: use-after-free in _copy_to_user+0xe9/0x110 [ 36.980935] Read of size 924 at addr ffff8801a7bffff2 by task syz-executor971/4572 [ 36.988621] [ 36.990229] CPU: 0 PID: 4572 Comm: syz-executor971 Not tainted 4.18.0-rc3+ #3 [ 36.997477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.006812] Call Trace: [ 37.009382] dump_stack+0x1c9/0x2b4 [ 37.012990] ? dump_stack_print_info.cold.2+0x52/0x52 [ 37.018159] ? printk+0xa7/0xcf [ 37.021416] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 37.026164] ? _copy_to_user+0xe9/0x110 [ 37.030118] print_address_description+0x6c/0x20b [ 37.034940] ? _copy_to_user+0xe9/0x110 [ 37.038893] kasan_report.cold.7+0x242/0x2fe [ 37.043286] check_memory_region+0x13e/0x1b0 [ 37.047675] kasan_check_read+0x11/0x20 [ 37.051630] _copy_to_user+0xe9/0x110 [ 37.055412] bpf_test_finish.isra.7+0xee/0x1f0 [ 37.059973] ? bpf_test_init.isra.8+0x100/0x100 [ 37.064622] ? bpf_test_run+0x2c0/0x3b0 [ 37.068580] ? bpf_test_run+0x2fc/0x3b0 [ 37.072541] bpf_prog_test_run_skb+0x7d7/0xa30 [ 37.077106] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 37.081931] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.087447] ? __bpf_prog_get+0x9b/0x290 [ 37.091487] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 37.096304] bpf_prog_test_run+0x130/0x1a0 [ 37.100528] __x64_sys_bpf+0x3d8/0x510 [ 37.104392] ? bpf_prog_get+0x20/0x20 [ 37.108184] ? do_syscall_64+0x9a/0x820 [ 37.112148] do_syscall_64+0x1b9/0x820 [ 37.116025] ? syscall_return_slowpath+0x5e0/0x5e0 [ 37.120934] ? syscall_return_slowpath+0x31d/0x5e0 [ 37.125843] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.131364] ? retint_user+0x18/0x18 [ 37.135059] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.139884] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 37.145052] RIP: 0033:0x4408d9 [ 37.148218] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 37.167486] RSP: 002b:00007ffe4952eec8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141 [ 37.175176] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9 [ 37.182423] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a [ 37.189670] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8 [ 37.196926] R10: 00000000011e7880 R11: 0000000000000213 R12: 0000000000401da0 [ 37.204176] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 37.211430] [ 37.213034] The buggy address belongs to the page: [ 37.218028] page:ffffea00069effc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 37.226148] flags: 0x2fffc0000000000() [ 37.230016] raw: 02fffc0000000000 ffffea00069effc8 ffffea00069effc8 0000000000000000 [ 37.237875] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 37.245728] page dumped because: kasan: bad access detected [ 37.251412] [ 37.253012] Memory state around the buggy address: [ 37.257918] ffff8801a7bffe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.265255] ffff8801a7bfff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.272597] >ffff8801a7bfff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.279930] ^ [ 37.286920] ffff8801a7c00000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.294257] ffff8801a7c00080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.301591] ================================================================== [ 37.308931] Disabling lock debugging due to kernel taint [ 37.314439] Kernel panic - not syncing: panic_on_warn set ... [ 37.314439] [ 37.321796] CPU: 0 PID: 4572 Comm: syz-executor971 Tainted: G B 4.18.0-rc3+ #3 [ 37.330435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.339764] Call Trace: [ 37.342338] dump_stack+0x1c9/0x2b4 [ 37.345945] ? dump_stack_print_info.cold.2+0x52/0x52 [ 37.351115] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 37.355857] panic+0x238/0x4e7 [ 37.359039] ? add_taint.cold.5+0x16/0x16 [ 37.363169] ? do_raw_spin_unlock+0xa7/0x2f0 [ 37.367552] ? do_raw_spin_unlock+0xa7/0x2f0 [ 37.371942] ? _copy_to_user+0xe9/0x110 [ 37.375896] kasan_end_report+0x47/0x4f [ 37.379847] kasan_report.cold.7+0x76/0x2fe [ 37.384261] check_memory_region+0x13e/0x1b0 [ 37.388646] kasan_check_read+0x11/0x20 [ 37.392600] _copy_to_user+0xe9/0x110 [ 37.396379] bpf_test_finish.isra.7+0xee/0x1f0 [ 37.400936] ? bpf_test_init.isra.8+0x100/0x100 [ 37.405590] ? bpf_test_run+0x2c0/0x3b0 [ 37.409549] ? bpf_test_run+0x2fc/0x3b0 [ 37.413502] bpf_prog_test_run_skb+0x7d7/0xa30 [ 37.418064] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 37.422889] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.428412] ? __bpf_prog_get+0x9b/0x290 [ 37.432454] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 37.437281] bpf_prog_test_run+0x130/0x1a0 [ 37.441500] __x64_sys_bpf+0x3d8/0x510 [ 37.445363] ? bpf_prog_get+0x20/0x20 [ 37.449144] ? do_syscall_64+0x9a/0x820 [ 37.453100] do_syscall_64+0x1b9/0x820 [ 37.456964] ? syscall_return_slowpath+0x5e0/0x5e0 [ 37.461870] ? syscall_return_slowpath+0x31d/0x5e0 [ 37.466780] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 37.472297] ? retint_user+0x18/0x18 [ 37.475994] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.480821] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 37.485987] RIP: 0033:0x4408d9 [ 37.489154] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 37.508274] RSP: 002b:00007ffe4952eec8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141 [ 37.515976] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9 [ 37.523223] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a [ 37.530470] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8 [ 37.537719] R10: 00000000011e7880 R11: 0000000000000213 R12: 0000000000401da0 [ 37.544967] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 37.552670] Dumping ftrace buffer: [ 37.556187] (ftrace buffer empty) [ 37.559921] Kernel Offset: disabled [ 37.563553] Rebooting in 86400 seconds..