[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.932379] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 20.959559] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.268802] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [ 22.337920] random: sshd: uninitialized urandom read (32 bytes read, 122 bits of entropy available) [ 34.547459] random: nonblocking pool is initialized Warning: Permanently added '10.128.0.63' (ECDSA) to the list of known hosts. 2018/04/02 16:32:23 parsed 1 programs 2018/04/02 16:32:23 executed programs: 0 [ 40.334650] IPVS: Creating netns size=2552 id=1 [ 40.498125] ================================================================== [ 40.505498] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xe8/0x100 [ 40.512746] Read of size 4 at addr ffff8800b3e5c780 by task syz-executor0/3789 [ 40.520073] [ 40.521669] CPU: 0 PID: 3789 Comm: syz-executor0 Not tainted 4.4.125-g38f41ec #21 [ 40.529255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.538576] 0000000000000000 5e6347478f87bcf2 ffff8801c7307c78 ffffffff81d067bd [ 40.546539] ffffea0002cf9700 ffff8800b3e5c780 0000000000000000 ffff8800b3e5c780 [ 40.554492] ffffffff82ded950 ffff8801c7307cb0 ffffffff814fea83 ffff8800b3e5c780 [ 40.562460] Call Trace: [ 40.565018] [] dump_stack+0xc1/0x124 [ 40.570348] [] ? sock_release+0x1e0/0x1e0 [ 40.576112] [] print_address_description+0x73/0x260 [ 40.582743] [] ? sock_release+0x1e0/0x1e0 [ 40.588512] [] kasan_report+0x285/0x370 [ 40.594107] [] ? l2tp_session_queue_purge+0xe8/0x100 [ 40.600828] [] __asan_report_load4_noabort+0x14/0x20 [ 40.607549] [] l2tp_session_queue_purge+0xe8/0x100 [ 40.614094] [] ? sock_release+0x1e0/0x1e0 [ 40.619857] [] pppol2tp_release+0x1ff/0x310 [ 40.625793] [] sock_release+0x8d/0x1e0 [ 40.631297] [] sock_close+0x16/0x20 [ 40.636538] [] __fput+0x233/0x6d0 [ 40.641607] [] ____fput+0x15/0x20 [ 40.646677] [] task_work_run+0x104/0x180 [ 40.652354] [] exit_to_usermode_loop+0x13d/0x160 [ 40.658727] [] do_fast_syscall_32+0x614/0x8a0 [ 40.664840] [] sysenter_flags_fixed+0xd/0x17 [ 40.670887] [ 40.672484] Allocated by task 3789: [ 40.676073] [] save_stack_trace+0x26/0x50 [ 40.681951] [] save_stack+0x43/0xd0 [ 40.687769] [] kasan_kmalloc+0xad/0xe0 [ 40.693386] [] __kmalloc+0x124/0x320 [ 40.698833] [] l2tp_session_create+0x39/0x10f0 [ 40.705146] [] pppol2tp_connect+0x10fc/0x1930 [ 40.711372] [] SYSC_connect+0x1b6/0x310 [ 40.717082] [] SyS_connect+0x24/0x30 [ 40.722529] [] do_fast_syscall_32+0x321/0x8a0 [ 40.728754] [] sysenter_flags_fixed+0xd/0x17 [ 40.734894] [ 40.736490] Freed by task 3788: [ 40.739734] [] save_stack_trace+0x26/0x50 [ 40.745612] [] save_stack+0x43/0xd0 [ 40.750966] [] kasan_slab_free+0x72/0xc0 [ 40.756758] [] kfree+0xfc/0x300 [ 40.761766] [] l2tp_session_free+0x170/0x200 [ 40.767904] [] l2tp_tunnel_closeall+0x2d1/0x3b0 [ 40.774309] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 40.780707] [] udpv6_destroy_sock+0xb1/0xd0 [ 40.786762] [] sk_common_release+0x6b/0x300 [ 40.792816] [] udp_lib_close+0x15/0x20 [ 40.798436] [] inet_release+0xfa/0x1d0 [ 40.804056] [] inet6_release+0x50/0x70 [ 40.809675] [] sock_release+0x8d/0x1e0 [ 40.815294] [] sock_close+0x16/0x20 [ 40.820653] [] __fput+0x233/0x6d0 [ 40.825841] [] ____fput+0x15/0x20 [ 40.831027] [] task_work_run+0x104/0x180 [ 40.836819] [] exit_to_usermode_loop+0x13d/0x160 [ 40.843304] [] do_fast_syscall_32+0x614/0x8a0 [ 40.849534] [] sysenter_flags_fixed+0xd/0x17 [ 40.855678] [ 40.857277] The buggy address belongs to the object at ffff8800b3e5c780 [ 40.857277] which belongs to the cache kmalloc-512 of size 512 [ 40.869900] The buggy address is located 0 bytes inside of [ 40.869900] 512-byte region [ffff8800b3e5c780, ffff8800b3e5c980) [ 40.881563] The buggy address belongs to the page: [ 42.298651] PANIC: double fault, error_code: 0x0 [ 42.303422] CPU: 0 PID: 3789 Comm: syz-executor0 Not tainted 4.4.125-g38f41ec #21 [ 42.311006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.320330] task: ffff8800ac511800 task.stack: ffff8801c7300000 [ 42.326355] RIP: 0010:[] [] dump_page_badflags+0xd/0x250 [ 42.335106] RSP: 0018:ffff880100000000 EFLAGS: 00010046 [ 42.340523] RAX: ffff8800ac511800 RBX: ffffea0002cf9700 RCX: ffffffff814912f0 [ 42.347762] RDX: 0000000000000000 RSI: ffffffff838a91a0 RDI: ffffea0002cf9700 [ 42.355007] RBP: ffff880100000018 R08: 0000000000000001 R09: 0000000000000000 [ 42.362246] R10: 0000000000000002 R11: fffffbfff0ad821e R12: 0000000000000000 [ 42.369485] R13: ffffffff838a91a0 R14: 0000000000000000 R15: 0000000000000000 [ 42.376749] FS: 0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:00000000f774cb40 [ 42.384942] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 42.390793] CR2: ffff8800fffffff8 CR3: 00000000b26fc000 CR4: 0000000000160670 [ 42.398034] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.405269] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.412503] Stack: [ 42.414616] [ 42.416211] Call Trace: [ 42.418760] [ 42.420788] Code: ff e8 88 df 06 00 e9 50 fd ff ff e8 7e df 06 00 e9 1d fd ff ff 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 55 49 89 f5 <41> 54 49 89 d4 53 48 89 fb 48 83 ec 08 e8 f1 04 ed ff 48 8d 7b [ 42.447657] Kernel panic - not syncing: Machine halted. [ 42.452988] CPU: 0 PID: 3789 Comm: syz-executor0 Not tainted 4.4.125-g38f41ec #21 [ 42.460575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.469896] 0000000000000000 5e6347478f87bcf2 ffff8801db20ce38 ffffffff81d067bd [ 42.477851] ffffffff838374c0 ffff8801db20cf10 ffffffff83808040 ffff880100000000 [ 42.485810] 0000000000000000 ffff8801db20cf00 ffffffff8141b46a 0000000041b58ab3 [ 42.493867] Call Trace: [ 42.496413] <#DF> [] dump_stack+0xc1/0x124 [ 42.502475] [] panic+0x1aa/0x388 [ 42.507510] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 42.514415] [] ? vprintk_emit+0x242/0x850 [ 42.520187] [] ? dump_page_badflags+0x22/0x250 [ 42.526389] [] ? vprintk_emit+0x242/0x850 [ 42.532159] [] df_debug+0x2d/0x30 [ 42.537231] [] do_double_fault+0x10b/0x210 [ 42.543086] [] double_fault+0x2d/0x40 [ 42.548504] [] ? dump_page_badflags+0x180/0x250 [ 42.554791] [] ? dump_page_badflags+0xd/0x250 [ 42.560899] <> [ 42.564433] Dumping ftrace buffer: [ 42.568265] (ftrace buffer empty) [ 42.571948] Kernel Offset: disabled [ 42.575553] Rebooting in 86400 seconds..