[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.645362] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 108.260041] random: sshd: uninitialized urandom read (32 bytes read, 62 bits of entropy available) [ 108.545025] random: sshd: uninitialized urandom read (32 bytes read, 62 bits of entropy available) [ 109.210257] random: sshd: uninitialized urandom read (32 bytes read, 112 bits of entropy available) Warning: Permanently added '10.128.0.56' (ECDSA) to the list of known hosts. [ 114.788864] random: sshd: uninitialized urandom read (32 bytes read, 118 bits of entropy available) 2018/08/28 22:37:14 fuzzer started [ 115.886861] random: cc1: uninitialized urandom read (8 bytes read, 120 bits of entropy available) 2018/08/28 22:37:16 dialing manager at 10.128.0.26:34473 2018/08/28 22:37:18 syscalls: 1 2018/08/28 22:37:18 code coverage: enabled 2018/08/28 22:37:18 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/08/28 22:37:18 setuid sandbox: enabled 2018/08/28 22:37:18 namespace sandbox: enabled 2018/08/28 22:37:18 fault injection: CONFIG_FAULT_INJECTION is not enabled 2018/08/28 22:37:18 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/08/28 22:37:18 net packed injection: enabled 2018/08/28 22:37:18 net device setup: enabled INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "3" respawning too fast: disabled for 5 minutes INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes [ 121.010312] random: nonblocking pool is initialized 22:37:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000000), 0x0, 0x0, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, r0) add_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f00000000c0), &(0x7f0000000240)="1db510774375f47a05942c459e810c73fdf5623fb1eea51ac1e04c0907bc6c8326e016c477b652f66bcff5828246a8c69e7a40e2aa1197a1d13cb6162194e50a799882e500", 0x45, r0) keyctl$search(0xa, r0, &(0x7f0000000080)='dns_resolver\x00', &(0x7f00000001c0), 0x0) 22:37:57 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000000)=""/246) 22:37:57 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") rt_sigsuspend(&(0x7f0000000300)={0x2afe}, 0x2) 22:37:57 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x80000000000006a, 0x0) 22:37:57 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000100)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x2, 0x8, 0xffffffffffffffff}, 0x14}}, 0x0) 22:37:57 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000000), 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffffe}, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) shutdown(r1, 0x1) 22:37:57 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00009b4fd0)={0x0, 0x0, &(0x7f0000009ff0), 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000300)="c6"}) 22:37:57 executing program 6: socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000000)) r0 = socket(0x1000100000010, 0x2, 0x0) write(r0, &(0x7f0000000080)="1f0000001e0007f1fff5ff0200000000000000005307a33d6c390836be381b", 0x1f) [ 157.472597] IPVS: Creating netns size=2552 id=1 [ 157.679966] IPVS: Creating netns size=2552 id=2 [ 157.772573] IPVS: Creating netns size=2552 id=3 [ 157.873212] IPVS: Creating netns size=2552 id=4 [ 157.987474] IPVS: Creating netns size=2552 id=5 [ 158.160951] IPVS: Creating netns size=2552 id=6 [ 158.381223] IPVS: Creating netns size=2552 id=7 [ 158.615497] IPVS: Creating netns size=2552 id=8 [ 158.658284] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 158.735815] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 158.856662] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 158.963554] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 159.166632] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 159.242841] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 159.254333] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 159.391065] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 159.433642] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 159.516886] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 159.533058] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 159.630801] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 159.642586] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 159.754619] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 159.839494] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 159.849119] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 159.890880] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 159.948581] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 160.002217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 160.053968] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 160.106239] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 160.115339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 160.135336] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 160.206540] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 160.278628] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 160.308166] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 160.364521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 160.415506] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 160.429903] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 160.501202] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 160.516873] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 160.533138] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 160.596360] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 160.612043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 160.683093] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 160.699644] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 160.764027] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 160.792364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 160.870860] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 160.889136] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 160.933598] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 161.015727] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 161.031023] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 161.084064] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 161.191188] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 161.261297] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 161.292543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 161.322047] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 161.342899] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 161.401252] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 161.422867] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 161.532101] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 161.760597] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 161.801007] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 161.845078] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 161.916636] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 161.933416] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 161.975606] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.011650] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.029721] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 162.040472] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.121989] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.142125] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.176343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 164.852862] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 165.120081] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 165.253864] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 165.276363] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 165.559621] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 165.594398] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 165.633202] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 165.845325] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 165.913384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 166.220474] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 166.309194] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 166.471582] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 166.488897] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 166.637876] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 166.796635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 166.861960] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 22:38:07 executing program 0: r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x8c2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) ftruncate(r0, 0x200000000) 22:38:07 executing program 0: 22:38:07 executing program 0: [ 167.899430] ================================================================== [ 167.906854] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x177c/0x1a00 [ 167.913345] Read of size 8 at addr ffff8800b174fa18 by task syz-executor2/5874 [ 167.920699] [ 167.922328] CPU: 1 PID: 5874 Comm: syz-executor2 Not tainted 4.4.153-g5e24b4e #26 [ 167.929953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 167.939305] 0000000000000000 b91e927edf26adcb ffff8801bf267548 ffffffff81e162ed [ 167.947396] ffffea0002c5d3c0 ffff8800b174fa18 0000000000000000 ffff8800b174fa18 [ 167.955461] 0000000000001000 ffff8801bf267580 ffffffff8151b4d9 ffff8800b174fa18 [ 167.964059] Call Trace: [ 167.966649] [] dump_stack+0xc1/0x124 [ 167.972014] [] print_address_description+0x6c/0x216 [ 167.978692] [] kasan_report.cold.7+0x175/0x2f7 [ 167.984922] [] ? ip6_xmit+0x177c/0x1a00 [ 167.990551] [] __asan_report_load8_noabort+0x14/0x20 [ 167.997302] [] ip6_xmit+0x177c/0x1a00 [ 168.002753] [] ? kasan_slab_free+0x72/0xc0 [ 168.008635] [] ? kfree+0xf4/0x310 [ 168.013744] [] ? pskb_expand_head+0x683/0x970 [ 168.019892] [] ? ip6_finish_output2+0x1ca0/0x1ca0 [ 168.026390] [] ? __lock_is_held+0xa2/0xf0 [ 168.032191] [] ? ipv4_dst_check+0x111/0x160 [ 168.038164] [] ? __sk_dst_check+0x114/0x270 [ 168.044137] [] inet6_csk_xmit+0x245/0x490 [ 168.049936] [] ? inet6_csk_xmit+0xff/0x490 [ 168.055826] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 168.062411] [] ? udp6_set_csum+0xd3/0xa70 [ 168.068233] [] l2tp_xmit_skb+0xb9c/0xe80 [ 168.073960] [] pppol2tp_sendmsg+0x4e0/0x7d0 [ 168.079941] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 168.086466] [] ? pppol2tp_release+0x310/0x310 [ 168.092653] [] sock_sendmsg+0xcc/0x110 [ 168.098194] [] ___sys_sendmsg+0x441/0x880 [ 168.103991] [] ? copy_msghdr_from_user+0x550/0x550 [ 168.110575] [] ? __fget+0x148/0x3b0 [ 168.115854] [] ? __fget+0x16f/0x3b0 [ 168.121131] [] ? __fget+0x47/0x3b0 [ 168.126316] [] ? __fget_light+0x9f/0x1f0 [ 168.132020] [] ? __fdget+0x18/0x20 [ 168.137207] [] ? sockfd_lookup_light+0xb6/0x160 [ 168.143522] [] __sys_sendmmsg+0x1d4/0x2e0 [ 168.149325] [] ? SyS_sendmsg+0x50/0x50 [ 168.154869] [] ? ip6_datagram_connect+0x3a/0x50 [ 168.161193] [] ? inet_dgram_connect+0x11e/0x200 [ 168.167511] [] ? fput+0x20/0x150 [ 168.172524] [] ? SYSC_connect+0x22a/0x300 [ 168.178326] [] ? SYSC_bind+0x280/0x280 [ 168.183863] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 168.190011] [] ? compat_SyS_get_robust_list+0x310/0x310 [ 168.197016] [] ? SyS_socket+0x121/0x1b0 [ 168.202634] [] ? move_addr_to_kernel+0x50/0x50 [ 168.208866] [] compat_SyS_sendmmsg+0x32/0x40 [ 168.214918] [] ? compat_SyS_sendmsg+0x40/0x40 [ 168.221071] [] do_fast_syscall_32+0x324/0x8b0 [ 168.227214] [] sysenter_flags_fixed+0xd/0x1a [ 168.233260] [ 168.234881] Allocated by task 0: [ 168.238233] (stack is not available) [ 168.241943] [ 168.243572] Freed by task 0: [ 168.246575] (stack is not available) [ 168.250280] [ 168.251916] The buggy address belongs to the object at ffff8800b174fa00 [ 168.251916] which belongs to the cache ip_dst_cache of size 208 [ 168.264685] The buggy address is located 24 bytes inside of [ 168.264685] 208-byte region [ffff8800b174fa00, ffff8800b174fad0) [ 168.276464] The buggy address belongs to the page: [ 168.282842] [ 168.284483] ================================================ [ 168.290277] [ BUG: lock held when returning to user space! ] [ 168.296066] 4.4.153-g5e24b4e #26 Not tainted [ 168.300470] ------------------------------------------------ [ 168.306258] ip/46519232 is leaving the kernel with locks still held! [ 168.312741] -1317733888 lock held by ip/46519232: [ 168.317592] kasan: CONFIG_KASAN_INLINE enabled [ 168.321984] kasan: GPF could be caused by NULL-ptr deref or user memory access[ 168.329466] ------------[ cut here ]------------ [ 168.334227] WARNING: CPU: 0 PID: 46519232 at kernel/sched/core.c:7946 __might_sleep+0x138/0x1a0() [ 168.343255] do not call blocking ops when !TASK_RUNNING; state=ffffea0002c5d3c0 set at [] dump_page_badflags+0x57/0x70 [ 168.355662] Kernel panic - not syncing: panic_on_warn set ... [ 168.355662] [ 169.509164] Shutting down cpus with NMI [ 169.514057] Dumping ftrace buffer: [ 169.517585] (ftrace buffer empty) [ 169.521269] Kernel Offset: disabled [ 169.524869] Rebooting in 86400 seconds..