[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 17.498488] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.960291] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 21.175101] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 22.058188] random: sshd: uninitialized urandom read (32 bytes read, 107 bits of entropy available) [ 22.240401] random: sshd: uninitialized urandom read (32 bytes read, 111 bits of entropy available) Warning: Permanently added '10.128.15.233' (ECDSA) to the list of known hosts. [ 27.636376] random: sshd: uninitialized urandom read (32 bytes read, 119 bits of entropy available) executing program [ 27.736484] ================================================================== [ 27.743894] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 [ 27.750988] Read of size 8 at addr ffff8800b4604140 by task syzkaller854528/3316 [ 27.750989] [ 27.750996] CPU: 0 PID: 3316 Comm: syzkaller854528 Not tainted 4.4.112-g3fc4284 #32 [ 27.750999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.751013] 0000000000000000 dc43c4f23e398565 ffff8801cd60f9f0 ffffffff81d054ed [ 27.751020] ffffea0002d18100 ffff8800b4604140 0000000000000000 ffff8800b4604140 [ 27.751028] ffff8800b4168238 ffff8801cd60fa28 ffffffff814fd953 ffff8800b4604140 [ 27.751029] Call Trace: [ 27.751046] [] dump_stack+0xc1/0x124 [ 27.751055] [] print_address_description+0x73/0x260 [ 27.751061] [] kasan_report+0x285/0x370 [ 27.751070] [] ? sg_remove_request+0xf9/0x110 [ 27.751076] [] __asan_report_load8_noabort+0x14/0x20 [ 27.751082] [] sg_remove_request+0xf9/0x110 [ 27.751088] [] sg_finish_rem_req+0x295/0x340 [ 27.751094] [] sg_read+0xa21/0x1490 [ 27.751102] [] ? __check_object_size+0x154/0x35b [ 27.751109] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 27.751115] [] ? fsnotify+0xee0/0xee0 [ 27.751124] [] ? avc_policy_seqno+0x9/0x20 [ 27.751131] [] do_loop_readv_writev+0x141/0x1e0 [ 27.751137] [] ? security_file_permission+0x89/0x1e0 [ 27.751144] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 27.751150] [] ? sg_proc_seq_show_debug+0xd30/0xd30 [ 27.751156] [] do_readv_writev+0x5dd/0x6e0 [ 27.751162] [] ? vfs_write+0x530/0x530 [ 27.751169] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.751175] [] ? do_huge_pmd_anonymous_page+0x3dd/0xa10 [ 27.751182] [] ? handle_mm_fault+0x3f2/0x3190 [ 27.751188] [] ? sg_fasync+0x8d/0xb0 [ 27.751195] [] vfs_readv+0x78/0xb0 [ 27.751200] [] SyS_readv+0xd9/0x240 [ 27.751206] [] ? rw_copy_check_uvector+0x2d0/0x2d0 [ 27.751213] [] ? trace_hardirqs_on_thunk+0x17/0x19 [ 27.751219] [] entry_SYSCALL_64_fastpath+0x16/0x92 [ 27.751221] [ 27.751224] Allocated by task 0: [ 27.751226] (stack is not available) [ 27.751227] [ 27.751229] Freed by task 0: [ 27.751230] (stack is not available) [ 27.751231] [ 27.751236] The buggy address belongs to the object at ffff8800b4604100 [ 27.751236] which belongs to the cache fasync_cache of size 96 [ 27.751240] The buggy address is located 64 bytes inside of [ 27.751240] 96-byte region [ffff8800b4604100, ffff8800b4604160) [ 27.751242] The buggy address belongs to the page: [ 28.023070] kasan: CONFIG_KASAN_INLINE enabled [ 28.027528] BUG: unable to handle kernel paging request at fffffffdef82a740 [ 28.027542] IP: [] cpuacct_charge+0x155/0x390 [ 28.027559] PGD 420f067 PUD 0 [ 28.027565] Oops: 0000 [#1] PREEMPT SMP KASAN [ 28.027574] Dumping ftrace buffer: [ 28.027577] (ftrace buffer empty) [ 28.027579] Modules linked in: [ 28.027586] CPU: 1 PID: 3318 Comm: getty Not tainted 4.4.112-g3fc4284 #32 [ 28.027589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.027592] task: ffff8801d2284740 task.stack: ffff8800b41e8000 [ 28.027594] RIP: 0010:[] [] cpuacct_charge+0x155/0x390 [ 28.027603] RSP: 0018:ffff8801db307a20 EFLAGS: 00010046 [ 28.027607] RAX: 1ffffffff0854dff RBX: 0000000000018528 RCX: ffffffff847ea4c0 [ 28.027610] RDX: fffffbffbdf054e8 RSI: fffffffdef82a740 RDI: ffffffff842a6ff8 [ 28.027612] RBP: ffff8801db307a68 R08: 0000000000000000 R09: 0000000000000000 [ 28.027615] R10: ffffed0043fffa09 R11: 0000000000000000 R12: ffffffff842a6f20 [ 28.027618] R13: dffffc0000000000 R14: 00000000108ced2f R15: ffffffffcd608050 [ 28.027622] FS: 00007f22e542a700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 [ 28.027625] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.027628] CR2: fffffffdef82a740 CR3: 00000000b5538000 CR4: 0000000000160670 [ 28.027634] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.027636] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.027637] Stack: [ 28.027639] ffffffff8122a470 ffffffff81d49b1e 0000000000000000 ffff8801db307a78 [ 28.027646] ffff8801d22e5f60 ffffffff83843ba0 00000000108ced2f ffff8801d22e5fb0 [ 28.027652] ffff8801d22e5f00 ffff8801db307ab8 ffffffff811dc087 ffff8801db21f4c0 [ 28.027657] Call Trace: [ 28.027659] [ 28.027666] [] ? cpuacct_charge+0x60/0x390 [ 28.027674] [] ? find_next_bit+0x3e/0x50 [ 28.027680] [] update_curr+0x2c7/0x6c0 [ 28.027685] [] enqueue_task_fair+0x313/0x2940 [ 28.027693] [] ? sched_clock_cpu+0x15f/0x1e0 [ 28.027699] [] activate_task+0x148/0x270 [ 28.027705] [] ttwu_do_activate.constprop.131+0xbf/0x1e0 [ 28.027710] [] try_to_wake_up+0x68d/0xf60 [ 28.027716] [] default_wake_function+0x35/0x50 [ 28.027722] [] autoremove_wake_function+0x13/0x90 [ 28.027728] [] ? check_preemption_disabled+0x3b/0x200 [ 28.027734] [] __wake_up_common+0xb4/0x150 [ 28.027740] [] __wake_up+0x34/0x50 [ 28.027747] [] wake_up_klogd_work_func+0x56/0x80 [ 28.027753] [] irq_work_run_list+0xca/0x140 [ 28.027760] [] irq_work_tick+0x10e/0x170 [ 28.027766] [] update_process_times+0x52/0x70 [ 28.027775] [] tick_sched_handle.isra.16+0x55/0xf0 [ 28.027780] [] tick_sched_timer+0x72/0x120 [ 28.027785] [] ? tick_sched_do_timer+0xa0/0xa0 [ 28.027792] [] __hrtimer_run_queues+0x306/0xfe0 [ 28.027798] [] ? hrtimer_fixup_init+0x70/0x70 [ 28.027805] [] ? hrtimer_interrupt+0x131/0x440 [ 28.027811] [] hrtimer_interrupt+0x1a6/0x440 [ 28.027819] [] local_apic_timer_interrupt+0x6a/0xb0 [ 28.027827] [] smp_apic_timer_interrupt+0x76/0xa0 [ 28.027834] [] apic_timer_interrupt+0xa0/0xb0 [ 28.027836] [ 28.027842] [] ? console_unlock+0x790/0xa00 [ 28.027848] [] ? console_unlock+0x79a/0xa00 [ 28.027854] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 28.027860] [] ? vprintk_emit+0x323/0x850 [ 28.027866] [] vprintk_emit+0x55e/0x850 [ 28.027874] [] ? print_context_stack+0x48/0xc0 [ 28.027881] [] ? __module_text_address+0x13/0x140 [ 28.027887] [] vprintk+0x28/0x30 [ 28.027893] [] vprintk_default+0x1d/0x30 [ 28.027900] [] printk+0xb7/0xe2 [ 28.027906] [] ? pm_qos_get_value.part.4+0xb/0xb [ 28.027913] [] ? check_preemption_disabled+0x3b/0x200 [ 28.027920] [] ? kasan_die_handler+0x25/0x40 [ 28.027925] [] kasan_die_handler+0x31/0x40 [ 28.027932] [] notifier_call_chain+0x95/0x1b0 [ 28.027938] [] atomic_notifier_call_chain+0x7b/0x140 [ 28.027944] [] ? __atomic_notifier_call_chain+0x150/0x150 [ 28.027950] [] notify_die+0xdf/0x160 [ 28.027956] [] ? atomic_notifier_call_chain+0x140/0x140 [ 28.027961] [] ? __list_del_entry+0x86/0x1d0 [ 28.027968] [] ? search_exception_tables+0x31/0x40 [ 28.027975] [] do_general_protection+0x2f7/0x390 [ 28.027980] [] general_protection+0x28/0x30 [ 28.027986] [] ? __list_del_entry+0x86/0x1d0 [ 28.027992] [] ? _raw_spin_lock+0x3e/0x50 [ 28.027999] [] list_lru_del+0x6a/0x170 [ 28.028005] [] iput+0x480/0x960 [ 28.028012] [] __dentry_kill+0x51c/0x620 [ 28.028018] [] ? dput.part.19+0x2a/0x760 [ 28.028024] [] dput.part.19+0x638/0x760 [ 28.028030] [] ? dput.part.19+0x2a/0x760 [ 28.028038] [] ? sock_release+0x1e0/0x1e0 [ 28.028043] [] dput+0x1f/0x30 [ 28.028050] [] __fput+0x411/0x6d0 [ 28.028055] [] ____fput+0x15/0x20 [ 28.028061] [] task_work_run+0x104/0x180 [ 28.028067] [] exit_to_usermode_loop+0x145/0x170 [ 28.028074] [] syscall_return_slowpath+0x1b5/0x1f0 [ 28.028080] [] int_ret_from_sys_call+0x25/0xa3 [ 28.028094] Code: 49 8d bc 24 d8 00 00 00 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 9e 01 00 00 49 8b 9c 24 d8 00 00 00 80 3a 00 0f 85 0a 02 00 00 <4a> 03 1c f9 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 cf 01 00 [ 28.028197] RIP [] cpuacct_charge+0x155/0x390 [ 28.028207] RSP [ 28.028209] CR2: fffffffdef82a740 [ 28.028215] ---[ end trace b95b1b3eca16b682 ]--- [ 28.028219] Kernel panic - not syncing: Fatal exception in interrupt [ 29.147765] Shutting down cpus with NMI [ 29.148200] Dumping ftrace buffer: [ 29.148203] (ftrace buffer empty) [ 29.148205] Kernel Offset: disabled [ 29.785606] Rebooting in 86400 seconds..