[ 33.419796] audit: type=1800 audit(1556763903.564:33): pid=6893 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 33.451558] audit: type=1800 audit(1556763903.574:34): pid=6893 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 37.138613] random: sshd: uninitialized urandom read (32 bytes read) [ 37.409514] audit: type=1400 audit(1556763907.554:35): avc: denied { map } for pid=7066 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 37.474951] random: sshd: uninitialized urandom read (32 bytes read) [ 38.064686] random: sshd: uninitialized urandom read (32 bytes read) [ 58.543610] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.31' (ECDSA) to the list of known hosts. [ 64.227715] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program [ 64.367604] audit: type=1400 audit(1556763934.514:36): avc: denied { map } for pid=7078 comm="syz-executor021" path="/root/syz-executor021756876" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 64.416944] ================================================================== [ 64.424550] BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x9524/0x9d13 [ 64.431738] Read of size 6 at addr ffff88808ba3ec7b by task kworker/u5:0/1402 [ 64.439422] [ 64.441047] CPU: 1 PID: 1402 Comm: kworker/u5:0 Not tainted 4.14.114 #4 [ 64.447789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.457167] Workqueue: hci0 hci_rx_work [ 64.461151] Call Trace: [ 64.463763] dump_stack+0x138/0x19c [ 64.467391] ? hci_event_packet+0x9524/0x9d13 [ 64.472044] print_address_description.cold+0x7c/0x1dc [ 64.477410] ? hci_event_packet+0x9524/0x9d13 [ 64.481915] kasan_report.cold+0xaf/0x2b5 [ 64.486066] __asan_report_load_n_noabort+0xf/0x20 [ 64.490999] hci_event_packet+0x9524/0x9d13 [ 64.495337] ? hci_cmd_complete_evt+0x9ba0/0x9ba0 [ 64.500205] ? __lock_acquire+0x270b/0x45e0 [ 64.504553] ? __debug_object_init+0x8a0/0x8e0 [ 64.509140] ? partition_sched_domains+0x70/0x605 [ 64.514106] ? skb_dequeue+0x12e/0x180 [ 64.518005] ? mark_held_locks+0xb1/0x100 [ 64.522164] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 64.527358] ? trace_hardirqs_on_caller+0x400/0x590 [ 64.532397] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 64.537516] hci_rx_work+0x3ab/0x900 [ 64.541224] ? hci_rx_work+0x3ab/0x900 [ 64.545126] process_one_work+0x868/0x1610 [ 64.549369] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 64.554038] worker_thread+0x5d9/0x1050 [ 64.558114] kthread+0x31c/0x430 [ 64.561476] ? process_one_work+0x1610/0x1610 [ 64.565968] ? kthread_create_on_node+0xd0/0xd0 [ 64.571695] ret_from_fork+0x3a/0x50 [ 64.575571] [ 64.577230] Allocated by task 7082: [ 64.580893] save_stack_trace+0x16/0x20 [ 64.585075] save_stack+0x45/0xd0 [ 64.588725] kasan_kmalloc+0xce/0xf0 [ 64.592474] __kmalloc_node_track_caller+0x51/0x80 [ 64.597450] __kmalloc_reserve.isra.0+0x40/0xe0 [ 64.602147] __alloc_skb+0xcf/0x500 [ 64.605822] vhci_write+0xb6/0x437 [ 64.609403] __vfs_write+0x4ae/0x6c0 [ 64.613149] vfs_write+0x198/0x500 [ 64.616734] SyS_write+0xb8/0x180 [ 64.620221] do_syscall_64+0x1eb/0x630 [ 64.624132] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 64.629325] [ 64.630958] Freed by task 3559: [ 64.634263] save_stack_trace+0x16/0x20 [ 64.638268] save_stack+0x45/0xd0 [ 64.641743] kasan_slab_free+0x75/0xc0 [ 64.645650] kfree+0xcc/0x270 [ 64.648795] kernfs_fop_release+0x112/0x180 [ 64.653171] __fput+0x277/0x7a0 [ 64.656476] ____fput+0x16/0x20 [ 64.659793] task_work_run+0x119/0x190 [ 64.663710] exit_to_usermode_loop+0x1da/0x220 [ 64.668324] do_syscall_64+0x4a9/0x630 [ 64.672234] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 64.677435] [ 64.679074] The buggy address belongs to the object at ffff88808ba3ea80 [ 64.679074] which belongs to the cache kmalloc-512 of size 512 [ 64.691749] The buggy address is located 507 bytes inside of [ 64.691749] 512-byte region [ffff88808ba3ea80, ffff88808ba3ec80) [ 64.703814] The buggy address belongs to the page: [ 64.708764] page:ffffea00022e8f80 count:1 mapcount:0 mapping:ffff88808ba3e080 index:0x0 [ 64.716954] flags: 0x1fffc0000000100(slab) [ 64.721231] raw: 01fffc0000000100 ffff88808ba3e080 0000000000000000 0000000100000006 [ 64.729218] raw: ffffea00022e8f20 ffffea00024050e0 ffff8880aa800940 0000000000000000 [ 64.737134] page dumped because: kasan: bad access detected [ 64.742855] [ 64.744483] Memory state around the buggy address: [ 64.749434] ffff88808ba3eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.756816] ffff88808ba3ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.764201] >ffff88808ba3ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.771582] ^ [ 64.774992] ffff88808ba3ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.782367] ffff88808ba3ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.789754] ================================================================== [ 64.797128] Disabling lock debugging due to kernel taint [ 64.803655] Kernel panic - not syncing: panic_on_warn set ... [ 64.803655] [ 64.811040] CPU: 1 PID: 1402 Comm: kworker/u5:0 Tainted: G B 4.14.114 #4 [ 64.819061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.828774] Workqueue: hci0 hci_rx_work [ 64.832859] Call Trace: [ 64.835455] dump_stack+0x138/0x19c [ 64.839199] ? hci_event_packet+0x9524/0x9d13 [ 64.843697] panic+0x1f2/0x438 [ 64.846889] ? add_taint.cold+0x16/0x16 [ 64.850860] ? ___preempt_schedule+0x16/0x18 [ 64.855554] kasan_end_report+0x47/0x4f [ 64.859577] kasan_report.cold+0x136/0x2b5 [ 64.863826] __asan_report_load_n_noabort+0xf/0x20 [ 64.868775] hci_event_packet+0x9524/0x9d13 [ 64.873100] ? hci_cmd_complete_evt+0x9ba0/0x9ba0 [ 64.877937] ? __lock_acquire+0x270b/0x45e0 [ 64.882256] ? __debug_object_init+0x8a0/0x8e0 [ 64.886858] ? partition_sched_domains+0x70/0x605 [ 64.891700] ? skb_dequeue+0x12e/0x180 [ 64.895586] ? mark_held_locks+0xb1/0x100 [ 64.899845] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 64.904984] ? trace_hardirqs_on_caller+0x400/0x590 [ 64.909990] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 64.915169] hci_rx_work+0x3ab/0x900 [ 64.919030] ? hci_rx_work+0x3ab/0x900 [ 64.922910] process_one_work+0x868/0x1610 [ 64.927130] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 64.931790] worker_thread+0x5d9/0x1050 [ 64.935756] kthread+0x31c/0x430 [ 64.939139] ? process_one_work+0x1610/0x1610 [ 64.943700] ? kthread_create_on_node+0xd0/0xd0 [ 64.948757] ret_from_fork+0x3a/0x50 [ 64.953737] Kernel Offset: disabled [ 64.957389] Rebooting in 86400 seconds..