[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.655572] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.157159] random: sshd: uninitialized urandom read (32 bytes read) [ 22.462416] random: sshd: uninitialized urandom read (32 bytes read) [ 23.331694] random: sshd: uninitialized urandom read (32 bytes read) [ 23.496762] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.15.195' (ECDSA) to the list of known hosts. [ 28.947482] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program [ 29.060699] ================================================================== [ 29.068196] BUG: KASAN: slab-out-of-bounds in pdu_read+0x90/0xd0 [ 29.074336] Read of size 26214 at addr ffff8801ac3c85ad by task syz-executor186/4535 [ 29.082554] [ 29.084172] CPU: 0 PID: 4535 Comm: syz-executor186 Not tainted 4.18.0-rc3+ #137 [ 29.091596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.101071] Call Trace: [ 29.103652] dump_stack+0x1c9/0x2b4 [ 29.107392] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.112585] ? printk+0xa7/0xcf [ 29.115851] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 29.120596] ? pdu_read+0x90/0xd0 [ 29.124044] print_address_description+0x6c/0x20b [ 29.128884] ? pdu_read+0x90/0xd0 [ 29.132329] kasan_report.cold.7+0x242/0x2fe [ 29.136736] check_memory_region+0x13e/0x1b0 [ 29.141129] memcpy+0x23/0x50 [ 29.144219] pdu_read+0x90/0xd0 [ 29.147486] p9pdu_readf+0x579/0x2170 [ 29.151276] ? p9pdu_writef+0xe0/0xe0 [ 29.155073] ? __fget+0x414/0x670 [ 29.158518] ? rcu_is_watching+0x61/0x150 [ 29.162660] ? expand_files.part.8+0x9c0/0x9c0 [ 29.167253] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.172469] ? p9_fd_show_options+0x1c0/0x1c0 [ 29.176964] p9_client_create+0xde0/0x16c9 [ 29.181208] ? p9_client_read+0xc60/0xc60 [ 29.185356] ? find_held_lock+0x36/0x1c0 [ 29.189413] ? __lockdep_init_map+0x105/0x590 [ 29.193925] ? kasan_check_write+0x14/0x20 [ 29.198154] ? __init_rwsem+0x1cc/0x2a0 [ 29.202110] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 29.207132] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.212136] ? __kmalloc_track_caller+0x5f5/0x760 [ 29.216964] ? save_stack+0xa9/0xd0 [ 29.220577] ? save_stack+0x43/0xd0 [ 29.224186] ? kasan_kmalloc+0xc4/0xe0 [ 29.228056] ? kmem_cache_alloc_trace+0x152/0x780 [ 29.232896] ? memcpy+0x45/0x50 [ 29.236174] v9fs_session_init+0x21a/0x1a80 [ 29.240491] ? find_held_lock+0x36/0x1c0 [ 29.244540] ? v9fs_show_options+0x7e0/0x7e0 [ 29.248936] ? kasan_check_read+0x11/0x20 [ 29.253065] ? rcu_is_watching+0x8c/0x150 [ 29.257195] ? rcu_pm_notify+0xc0/0xc0 [ 29.261070] ? v9fs_mount+0x61/0x900 [ 29.264769] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.269771] ? kmem_cache_alloc_trace+0x616/0x780 [ 29.274603] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 29.280127] v9fs_mount+0x7c/0x900 [ 29.283657] mount_fs+0xae/0x328 [ 29.287021] vfs_kern_mount.part.34+0xdc/0x4e0 [ 29.291612] ? may_umount+0xb0/0xb0 [ 29.295230] ? _raw_read_unlock+0x22/0x30 [ 29.299362] ? __get_fs_type+0x97/0xc0 [ 29.303239] do_mount+0x581/0x30e0 [ 29.306779] ? copy_mount_string+0x40/0x40 [ 29.311000] ? copy_mount_options+0x5f/0x380 [ 29.315398] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.320398] ? kmem_cache_alloc_trace+0x616/0x780 [ 29.325756] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.331364] ? copy_mount_options+0x285/0x380 [ 29.335845] ksys_mount+0x12d/0x140 [ 29.339458] __x64_sys_mount+0xbe/0x150 [ 29.343427] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.348445] do_syscall_64+0x1b9/0x820 [ 29.352320] ? syscall_return_slowpath+0x5e0/0x5e0 [ 29.357244] ? syscall_return_slowpath+0x31d/0x5e0 [ 29.362175] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.367708] ? retint_user+0x18/0x18 [ 29.371417] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.376253] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.381430] RIP: 0033:0x4408d9 [ 29.384615] Code: e8 8c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 29.403871] RSP: 002b:00007fff3a7584e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 29.411576] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9 [ 29.418831] RDX: 00000000200000c0 RSI: 0000000020000080 RDI: 0000000000000000 [ 29.426086] RBP: 0000000000000000 R08: 0000000020000380 R09: 00000000004002c8 [ 29.433513] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000717f [ 29.440770] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 29.448039] [ 29.449656] Allocated by task 4535: [ 29.453293] save_stack+0x43/0xd0 [ 29.456741] kasan_kmalloc+0xc4/0xe0 [ 29.460440] __kmalloc+0x14e/0x760 [ 29.463968] p9_fcall_alloc+0x1e/0x90 [ 29.467753] p9_client_prepare_req.part.8+0x754/0xcd0 [ 29.472931] p9_client_rpc+0x1bd/0x1400 [ 29.476909] p9_client_create+0xd09/0x16c9 [ 29.481132] v9fs_session_init+0x21a/0x1a80 [ 29.485445] v9fs_mount+0x7c/0x900 [ 29.488976] mount_fs+0xae/0x328 [ 29.492332] vfs_kern_mount.part.34+0xdc/0x4e0 [ 29.496893] do_mount+0x581/0x30e0 [ 29.500412] ksys_mount+0x12d/0x140 [ 29.504024] __x64_sys_mount+0xbe/0x150 [ 29.507985] do_syscall_64+0x1b9/0x820 [ 29.511858] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.517040] [ 29.518648] Freed by task 0: [ 29.521650] (stack is not available) [ 29.525336] [ 29.526951] The buggy address belongs to the object at ffff8801ac3c8580 [ 29.526951] which belongs to the cache kmalloc-16384 of size 16384 [ 29.539938] The buggy address is located 45 bytes inside of [ 29.539938] 16384-byte region [ffff8801ac3c8580, ffff8801ac3cc580) [ 29.551883] The buggy address belongs to the page: [ 29.556813] page:ffffea0006b0f200 count:1 mapcount:0 mapping:ffff8801da802200 index:0x0 compound_mapcount: 0 [ 29.567035] flags: 0x2fffc0000008100(slab|head) [ 29.571695] raw: 02fffc0000008100 ffffea0006b0ee08 ffff8801da801c48 ffff8801da802200 [ 29.579574] raw: 0000000000000000 ffff8801ac3c8580 0000000100000001 0000000000000000 [ 29.587433] page dumped because: kasan: bad access detected [ 29.593118] [ 29.594724] Memory state around the buggy address: [ 29.599632] ffff8801ac3ca480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.606977] ffff8801ac3ca500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.614330] >ffff8801ac3ca580: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 29.621685] ^ [ 29.626088] ffff8801ac3ca600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.633434] ffff8801ac3ca680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.640782] ================================================================== [ 29.648119] Disabling lock debugging due to kernel taint [ 29.653830] Kernel panic - not syncing: panic_on_warn set ... [ 29.653830] [ 29.661209] CPU: 0 PID: 4535 Comm: syz-executor186 Tainted: G B 4.18.0-rc3+ #137 [ 29.670046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.679385] Call Trace: [ 29.681969] dump_stack+0x1c9/0x2b4 [ 29.685586] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.690762] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 29.695500] panic+0x238/0x4e7 [ 29.698670] ? add_taint.cold.5+0x16/0x16 [ 29.702820] ? do_raw_spin_unlock+0xa7/0x2f0 [ 29.707211] ? pdu_read+0x90/0xd0 [ 29.710644] kasan_end_report+0x47/0x4f [ 29.714595] kasan_report.cold.7+0x76/0x2fe [ 29.718907] check_memory_region+0x13e/0x1b0 [ 29.723391] memcpy+0x23/0x50 [ 29.726476] pdu_read+0x90/0xd0 [ 29.729749] p9pdu_readf+0x579/0x2170 [ 29.733546] ? p9pdu_writef+0xe0/0xe0 [ 29.737330] ? __fget+0x414/0x670 [ 29.740762] ? rcu_is_watching+0x61/0x150 [ 29.744888] ? expand_files.part.8+0x9c0/0x9c0 [ 29.749464] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.754465] ? p9_fd_show_options+0x1c0/0x1c0 [ 29.758963] p9_client_create+0xde0/0x16c9 [ 29.763190] ? p9_client_read+0xc60/0xc60 [ 29.767321] ? find_held_lock+0x36/0x1c0 [ 29.771367] ? __lockdep_init_map+0x105/0x590 [ 29.775847] ? kasan_check_write+0x14/0x20 [ 29.780064] ? __init_rwsem+0x1cc/0x2a0 [ 29.784030] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 29.789036] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.794039] ? __kmalloc_track_caller+0x5f5/0x760 [ 29.798872] ? save_stack+0xa9/0xd0 [ 29.802481] ? save_stack+0x43/0xd0 [ 29.806097] ? kasan_kmalloc+0xc4/0xe0 [ 29.809967] ? kmem_cache_alloc_trace+0x152/0x780 [ 29.814795] ? memcpy+0x45/0x50 [ 29.818066] v9fs_session_init+0x21a/0x1a80 [ 29.822372] ? find_held_lock+0x36/0x1c0 [ 29.826423] ? v9fs_show_options+0x7e0/0x7e0 [ 29.832354] ? kasan_check_read+0x11/0x20 [ 29.836481] ? rcu_is_watching+0x8c/0x150 [ 29.840606] ? rcu_pm_notify+0xc0/0xc0 [ 29.844478] ? v9fs_mount+0x61/0x900 [ 29.848176] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.853186] ? kmem_cache_alloc_trace+0x616/0x780 [ 29.858020] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 29.863554] v9fs_mount+0x7c/0x900 [ 29.867078] mount_fs+0xae/0x328 [ 29.870429] vfs_kern_mount.part.34+0xdc/0x4e0 [ 29.874999] ? may_umount+0xb0/0xb0 [ 29.878617] ? _raw_read_unlock+0x22/0x30 [ 29.882742] ? __get_fs_type+0x97/0xc0 [ 29.886611] do_mount+0x581/0x30e0 [ 29.890131] ? copy_mount_string+0x40/0x40 [ 29.894348] ? copy_mount_options+0x5f/0x380 [ 29.898737] ? rcu_read_lock_sched_held+0x108/0x120 [ 29.903733] ? kmem_cache_alloc_trace+0x616/0x780 [ 29.908557] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.914075] ? copy_mount_options+0x285/0x380 [ 29.918556] ksys_mount+0x12d/0x140 [ 29.922176] __x64_sys_mount+0xbe/0x150 [ 29.926135] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.931134] do_syscall_64+0x1b9/0x820 [ 29.935001] ? syscall_return_slowpath+0x5e0/0x5e0 [ 29.939922] ? syscall_return_slowpath+0x31d/0x5e0 [ 29.944836] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.950354] ? retint_user+0x18/0x18 [ 29.954049] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.958872] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.964043] RIP: 0033:0x4408d9 [ 29.967217] Code: e8 8c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 29.986332] RSP: 002b:00007fff3a7584e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 29.994021] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9 [ 30.001270] RDX: 00000000200000c0 RSI: 0000000020000080 RDI: 0000000000000000 [ 30.008515] RBP: 0000000000000000 R08: 0000000020000380 R09: 00000000004002c8 [ 30.015764] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000717f [ 30.023019] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 30.030750] Dumping ftrace buffer: [ 30.034277] (ftrace buffer empty) [ 30.037961] Kernel Offset: disabled [ 30.041570] Rebooting in 86400 seconds..