[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.459233] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.171311] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 23.424720] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 23.570623] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 24.434262] random: sshd: uninitialized urandom read (32 bytes read, 72 bits of entropy available) [ 28.310645] random: sshd: uninitialized urandom read (32 bytes read, 77 bits of entropy available) Warning: Permanently added '10.128.0.16' (ECDSA) to the list of known hosts. [ 30.056217] random: sshd: uninitialized urandom read (32 bytes read, 79 bits of entropy available) 2018/08/27 20:45:32 fuzzer started [ 31.116800] random: cc1: uninitialized urandom read (8 bytes read, 81 bits of entropy available) 2018/08/27 20:45:34 dialing manager at 10.128.0.26:34351 [ 33.406345] random: sshd: uninitialized urandom read (32 bytes read, 87 bits of entropy available) 2018/08/27 20:45:36 syscalls: 1 2018/08/27 20:45:36 code coverage: enabled 2018/08/27 20:45:36 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/08/27 20:45:36 setuid sandbox: enabled 2018/08/27 20:45:36 namespace sandbox: enabled 2018/08/27 20:45:36 fault injection: CONFIG_FAULT_INJECTION is not enabled 2018/08/27 20:45:36 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/08/27 20:45:36 net packed injection: enabled 2018/08/27 20:45:36 net device setup: enabled [ 35.219165] random: nonblocking pool is initialized 20:46:21 executing program 0: 20:46:21 executing program 2: 20:46:21 executing program 1: 20:46:21 executing program 4: 20:46:21 executing program 7: 20:46:21 executing program 5: 20:46:21 executing program 6: 20:46:21 executing program 3: exit(0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000080)) [ 78.959641] IPVS: Creating netns size=2552 id=1 [ 79.024661] IPVS: Creating netns size=2552 id=2 [ 79.115056] IPVS: Creating netns size=2552 id=3 [ 79.218749] IPVS: Creating netns size=2552 id=4 [ 79.352702] IPVS: Creating netns size=2552 id=5 [ 79.492281] IPVS: Creating netns size=2552 id=6 [ 79.693582] IPVS: Creating netns size=2552 id=7 [ 79.915104] IPVS: Creating netns size=2552 id=8 [ 80.007184] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 80.116197] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 80.608850] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 80.706213] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 80.715627] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 80.729716] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 80.759353] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 80.814869] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 80.924510] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 81.044971] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 81.233010] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 81.380266] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 81.388954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 81.435431] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 81.489464] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 81.504435] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 81.513521] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.544954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 81.616501] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.626459] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 81.636511] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 81.645251] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 81.746401] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 81.763359] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 82.013776] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 82.059725] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 82.107345] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 82.115131] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 82.136949] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 82.198172] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 82.245469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.274099] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 82.284223] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 82.351503] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 82.367227] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.384019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.409478] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 82.417766] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 82.431440] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 82.450855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.469096] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.490007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.510661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 82.528162] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 82.654731] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 82.744208] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 82.896491] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 82.988819] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 83.015482] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 83.050035] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 83.083657] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 83.101257] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 83.137157] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 83.167205] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 83.201314] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 83.290209] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 83.302338] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 83.337584] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 83.378855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 83.462574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 83.636510] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 83.737128] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 83.856266] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 83.932844] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 86.873131] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.029739] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.117533] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.168449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.380277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.420261] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.526061] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.710540] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.769191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 88.078402] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 88.095015] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 88.125221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 88.329750] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 88.387644] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 88.470563] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 88.649078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 20:46:32 executing program 0: 20:46:32 executing program 0: 20:46:32 executing program 0: 20:46:32 executing program 0: 20:46:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0), 0x80000000000006a, 0x0) [ 89.736762] ================================================================== [ 89.744168] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x177c/0x1a00 [ 89.750658] Read of size 8 at addr ffff8801d107ef18 by task syz-executor0/5772 [ 89.758011] [ 89.759636] CPU: 0 PID: 5772 Comm: syz-executor0 Not tainted 4.4.152-ge5c5f1f #89 [ 89.767249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 89.776595] 0000000000000000 29651aab302d4e48 ffff8801bc89f5c8 ffffffff81e15fed [ 89.784657] ffffea0007441f80 ffff8801d107ef18 0000000000000000 ffff8801d107ef18 [ 89.792737] 0000000000001000 ffff8801bc89f600 ffffffff8151b489 ffff8801d107ef18 [ 89.800790] Call Trace: [ 89.803396] [] dump_stack+0xc1/0x124 [ 89.808755] [] print_address_description+0x6c/0x216 [ 89.815415] [] kasan_report.cold.7+0x175/0x2f7 [ 89.821646] [] ? ip6_xmit+0x177c/0x1a00 [ 89.827267] [] __asan_report_load8_noabort+0x14/0x20 [ 89.834011] [] ip6_xmit+0x177c/0x1a00 [ 89.839459] [] ? kasan_slab_free+0x72/0xc0 [ 89.845340] [] ? kfree+0xf4/0x310 [ 89.850441] [] ? pskb_expand_head+0x683/0x970 [ 89.856583] [] ? ip6_finish_output2+0x1ca0/0x1ca0 [ 89.863072] [] ? __lock_is_held+0xa2/0xf0 [ 89.868869] [] ? ipv4_dst_check+0x111/0x160 [ 89.874850] [] ? __sk_dst_check+0x114/0x270 [ 89.880834] [] inet6_csk_xmit+0x245/0x490 [ 89.886630] [] ? inet6_csk_xmit+0xff/0x490 [ 89.892513] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 89.899090] [] ? udp6_set_csum+0xd3/0xa70 [ 89.904912] [] l2tp_xmit_skb+0xb9c/0xe80 [ 89.910622] [] pppol2tp_sendmsg+0x4e0/0x7d0 [ 89.916591] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 89.923080] [] ? pppol2tp_release+0x310/0x310 [ 89.929214] [] sock_sendmsg+0xcc/0x110 [ 89.934731] [] ___sys_sendmsg+0x441/0x880 [ 89.940503] [] ? copy_msghdr_from_user+0x550/0x550 [ 89.947057] [] ? __fget+0x148/0x3b0 [ 89.952311] [] ? __fget+0x16f/0x3b0 [ 89.957562] [] ? __fget+0x47/0x3b0 [ 89.962727] [] ? __fget_light+0x9f/0x1f0 [ 89.968411] [] ? __fdget+0x18/0x20 [ 89.973576] [] __sys_sendmmsg+0x12e/0x2e0 [ 89.979349] [] ? SyS_sendmsg+0x50/0x50 [ 89.984859] [] ? ip6_datagram_connect+0x3a/0x50 [ 89.991160] [] ? inet_dgram_connect+0x11e/0x200 [ 89.997451] [] ? fput+0x20/0x150 [ 90.002439] [] ? SYSC_connect+0x22a/0x300 [ 90.008209] [] ? SYSC_bind+0x280/0x280 [ 90.013721] [] ? SyS_futex+0x1f8/0x300 [ 90.019233] [] ? do_futex+0x17f0/0x17f0 [ 90.024834] [] ? SyS_socket+0x121/0x1b0 [ 90.030435] [] ? move_addr_to_kernel+0x50/0x50 [ 90.036644] [] SyS_sendmmsg+0x35/0x60 [ 90.042072] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 90.048623] [ 90.050224] Allocated by task 5772: [ 90.053835] [] save_stack_trace+0x26/0x50 [ 90.059734] [] save_stack+0x43/0xd0 [ 90.065109] [] kasan_kmalloc+0xc7/0xe0 [ 90.070739] [] kasan_slab_alloc+0x12/0x20 [ 90.076634] [] kmem_cache_alloc+0xbe/0x2a0 [ 90.082820] [] dst_alloc+0xb5/0x1a0 [ 90.088195] [] rt_dst_alloc+0x78/0x430 [ 90.093829] [] __ip_route_output_key_hash+0x9ac/0x2380 [ 90.100854] [] ip_route_output_flow+0x29/0xa0 [ 90.107095] [] __ip4_datagram_connect+0x663/0xfe0 [ 90.113684] [] __ip6_datagram_connect+0x1280/0x1960 [ 90.120445] [] ip6_datagram_connect+0x2f/0x50 [ 90.126681] [] inet_dgram_connect+0x117/0x200 [ 90.132918] [] SYSC_connect+0x1b8/0x300 [ 90.138637] [] SyS_connect+0x24/0x30 [ 90.144093] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 90.150787] [ 90.152398] Freed by task 0: [ 90.155388] (stack is not available) [ 90.159071] [ 90.160675] The buggy address belongs to the object at ffff8801d107edc0 [ 90.160675] which belongs to the cache ip_dst_cache of size 208 [ 90.173392] The buggy address is located 136 bytes to the right of [ 90.173392] 208-byte region [ffff8801d107edc0, ffff8801d107ee90) [ 90.185759] The buggy address belongs to the page: [ 91.544660] PANIC: double fault, error_code: 0x0 [ 91.549436] CPU: 0 PID: 5772 Comm: syz-executor0 Not tainted 4.4.152-ge5c5f1f #89 [ 91.557029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.566357] task: ffff8801d0be4800 task.stack: ffff8801bc898000 [ 91.572387] RIP: 0010:[] [] dump_page_badflags+0x1a/0x70 [ 91.581147] RSP: 0018:ffff8800fffffff8 EFLAGS: 00010092 [ 91.586572] RAX: 0000000000040000 RBX: ffffea0007441f80 RCX: ffffc90000c60000 [ 91.593821] RDX: 0000000000000000 RSI: ffffffff83aaae60 RDI: ffffea0007441f80 [ 91.601072] RBP: ffff880100000028 R08: 0000000000000001 R09: 0000000000000000 [ 91.608317] R10: 0000000000000001 R11: ffffffff858f0274 R12: 0000000000000000 [ 91.615589] R13: ffffffff83aaae60 R14: ffff8801d107edc0 R15: ffff8801d107ee90 [ 91.622875] FS: 00007efecfb48700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 91.631076] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 91.636929] CR2: ffff8800ffffffe8 CR3: 00000001cea9c000 CR4: 00000000001606f0 [ 91.644172] Stack: [ 91.646302] BUG: unable to handle kernel paging request at ffff8800fffffff8 [ 91.653615] IP: [] show_stack_log_lvl.cold.1+0x73/0x12e [ 91.660655] PGD 6330067 PUD 0 [ 91.664060] Thread overran stack, or stack corrupted [ 91.669133] Oops: 0000 [#1] PREEMPT SMP KASAN [ 91.674078] Dumping ftrace buffer: [ 91.677589] (ftrace buffer empty) [ 91.681288] Modules linked in: [ 91.684576] CPU: 0 PID: 5772 Comm: syz-executor0 Not tainted 4.4.152-ge5c5f1f #89 [ 91.692167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.701494] task: ffff8801d0be4800 task.stack: ffff8801bc898000 [ 91.707522] RIP: 0010:[] [] show_stack_log_lvl.cold.1+0x73/0x12e [ 91.716974] RSP: 0018:ffff8801db20ce68 EFLAGS: 00010046 [ 91.722398] RAX: ffff880100000000 RBX: 0000000000000000 RCX: ffff8801db207fc0 [ 91.729640] RDX: ffff8800fffffff8 RSI: ffffffff81e75b5b RDI: ffffffff83c15480 [ 91.736887] RBP: ffff8801db20cec0 R08: ffff8801db1fffc0 R09: 0000000000000000 [ 91.744133] R10: 0000000000000001 R11: ffffffff858f0254 R12: ffffffff841dc94c [ 91.751375] R13: ffff8801db20cf58 R14: 0000000000000000 R15: ffffffff841dc93a [ 91.758619] FS: 00007efecfb48700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 91.766820] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 91.772680] CR2: ffff8800fffffff8 CR3: 00000001cea9c000 CR4: 00000000001606f0 [ 91.779924] Stack: [ 91.782048] ffffffff841dc94c ffff8801d0be4800 29651aab302d4e48 0000000000000001 [ 91.790031] ffff880100000000 ffff8800fffffff8 ffff8801db20cf58 ffff8800fffffff8 [ 91.798011] 0000000000000040 ffff8800fffffff8 ffff8801d107ee90 ffff8801db20cf00 [ 91.806008] Call Trace: [ 91.808562] <#DF> [ 91.810614] [] show_regs.cold.2+0xa0/0x124 [ 91.816762] [] df_debug+0x1c/0x2d [ 91.821846] [] do_double_fault+0x113/0x230 [ 91.827708] [] double_fault+0x2d/0x40 [ 91.833137] [] ? dump_page_badflags+0x1a/0x70 [ 91.839253] <> [ 91.841473] Code: ec 8f 2f 00 48 8b 55 c8 48 8b 4d c0 4c 8b 45 b8 44 8b 4d b4 48 8d 42 08 41 f6 c1 03 48 89 45 c8 75 6a 45 85 c9 0f 85 8a 00 00 00 <48> 8b 12 4c 89 e6 48 c7 c7 42 c9 1d 84 44 89 4d b4 4c 89 45 b8 [ 91.869364] RIP [] show_stack_log_lvl.cold.1+0x73/0x12e [ 91.876485] RSP [ 91.880082] CR2: ffff8800fffffff8 [ 91.883506] ---[ end trace 233fd3c18c110a7d ]--- [ 91.888256] Kernel panic - not syncing: Fatal exception in interrupt [ 91.895050] Dumping ftrace buffer: [ 91.898568] (ftrace buffer empty) [ 91.902252] Kernel Offset: disabled [ 91.905852] Rebooting in 86400 seconds..