[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.365060] random: sshd: uninitialized urandom read (32 bytes read, 31 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.371381] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [ 20.736022] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 21.710380] random: nonblocking pool is initialized Warning: Permanently added '10.128.0.10' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 37.851228] ================================================================== [ 37.858680] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 37.865944] Read of size 4 at addr ffff8800baf58f00 by task syz-executor316/6010 [ 37.873451] [ 37.875061] CPU: 0 PID: 6010 Comm: syz-executor316 Not tainted 4.4.138-g226f96b #63 [ 37.882836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.892176] 0000000000000000 ef8df5d6e8e936d0 ffff8801d88178b0 ffffffff81e0ed0d [ 37.900186] ffffea0002ebd600 ffff8800baf58f00 0000000000000000 ffff8800baf58f00 [ 37.908171] ffffffff82f1a2b0 ffff8801d88178e8 ffffffff81515a16 ffff8800baf58f00 [ 37.916180] Call Trace: [ 37.918752] [] dump_stack+0xc1/0x124 [ 37.924096] [] ? sock_release+0x1c0/0x1c0 [ 37.929991] [] print_address_description+0x6c/0x216 [ 37.936642] [] ? sock_release+0x1c0/0x1c0 [ 37.942422] [] kasan_report.cold.7+0x175/0x2f7 [ 37.948638] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 37.955370] [] __asan_report_load4_noabort+0x14/0x20 [ 37.962096] [] l2tp_session_queue_purge+0xf4/0x100 [ 37.968650] [] ? sock_release+0x1c0/0x1c0 [ 37.974418] [] pppol2tp_release+0x1ff/0x310 [ 37.980383] [] sock_release+0x96/0x1c0 [ 37.985897] [] sock_close+0x16/0x20 [ 37.991148] [] __fput+0x235/0x6f0 [ 37.996240] [] ____fput+0x15/0x20 [ 38.001317] [] task_work_run+0x10f/0x190 [ 38.007016] [] do_exit+0x9e5/0x26b0 [ 38.012295] [] ? debug_check_no_locks_freed+0x210/0x210 [ 38.019312] [] ? release_task.part.17+0x1200/0x1200 [ 38.025967] [] ? debug_check_no_locks_freed+0x210/0x210 [ 38.032954] [] ? recalc_sigpending+0x76/0xa0 [ 38.038987] [] do_group_exit+0x111/0x330 [ 38.044672] [] get_signal+0x4ec/0x14b0 [ 38.050204] [] do_signal+0x8b/0x1d30 [ 38.055550] [] ? setup_sigcontext+0x780/0x780 [ 38.061670] [] ? get_unused_fd_flags+0xd0/0xd0 [ 38.067875] [] ? kernel_sock_shutdown+0x80/0x80 [ 38.074171] [] ? SyS_futex+0x1f8/0x300 [ 38.079693] [] ? fd_install+0x4d/0x60 [ 38.085114] [] ? exit_to_usermode_loop+0xe4/0x160 [ 38.091593] [] exit_to_usermode_loop+0x11a/0x160 [ 38.097984] [] syscall_return_slowpath+0x1b5/0x1f0 [ 38.104578] [] int_ret_from_sys_call+0x25/0xa3 [ 38.110796] [ 38.112398] Allocated by task 6007: [ 38.116006] [] save_stack_trace+0x26/0x50 [ 38.121935] [] save_stack+0x43/0xd0 [ 38.127320] [] kasan_kmalloc+0xc7/0xe0 [ 38.132950] [] __kmalloc+0x124/0x310 [ 38.138427] [] l2tp_session_create+0x39/0x1030 [ 38.144755] [] pppol2tp_connect+0x10f0/0x1910 [ 38.150990] [] SYSC_connect+0x1b8/0x300 [ 38.156707] [] SyS_connect+0x24/0x30 [ 38.162162] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 38.168835] [ 38.170439] Freed by task 5969: [ 38.173687] [] save_stack_trace+0x26/0x50 [ 38.179580] [] save_stack+0x43/0xd0 [ 38.184951] [] kasan_slab_free+0x72/0xc0 [ 38.190753] [] kfree+0xf4/0x310 [ 38.195777] [] l2tp_session_free+0x170/0x200 [ 38.202008] [] l2tp_tunnel_closeall+0x2b9/0x350 [ 38.208446] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 38.214880] [] udpv6_destroy_sock+0xb1/0xd0 [ 38.220948] [] sk_common_release+0x6d/0x300 [ 38.227024] [] udp_lib_close+0x15/0x20 [ 38.232656] [] inet_release+0xff/0x1d0 [ 38.238291] [] inet6_release+0x50/0x70 [ 38.243934] [] sock_release+0x96/0x1c0 [ 38.249593] [] sock_close+0x16/0x20 [ 38.254969] [] __fput+0x235/0x6f0 [ 38.260192] [] ____fput+0x15/0x20 [ 38.265398] [] task_work_run+0x10f/0x190 [ 38.271220] [] do_exit+0x9e5/0x26b0 [ 38.276589] [] do_group_exit+0x111/0x330 [ 38.282392] [] SyS_exit_group+0x1d/0x20 [ 38.288106] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 38.294781] [ 38.296570] The buggy address belongs to the object at ffff8800baf58f00 [ 38.296570] which belongs to the cache kmalloc-512 of size 512 [ 38.309201] The buggy address is located 0 bytes inside of [ 38.309201] 512-byte region [ffff8800baf58f00, ffff8800baf59100) [ 38.320870] The buggy address belongs to the page: [ 38.329803] kasan: CONFIG_KASAN_INLINE enabled [ 38.334452] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN [ 38.347299] Dumping ftrace buffer: [ 38.350815] (ftrace buffer empty) [ 38.354503] Modules linked in: [ 38.357785] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.138-g226f96b #63 [ 38.364764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.374088] task: ffff8801d9a41800 task.stack: ffff8801d9a50000 [ 38.380114] RIP: 0010:[] [] debug_object_deactivate+0x191/0x340 [ 38.389476] RSP: 0018:ffff8801db307cf0 EFLAGS: 00010002 [ 38.394896] RAX: dffffc0000000000 RBX: 4000000000004080 RCX: 0800000000000813 [ 38.402135] RDX: 1ffffffff0b40897 RSI: ffffffff844c6720 RDI: 4000000000004098 [ 38.409409] RBP: ffff8801db307da8 R08: ffffffff8533df90 R09: 0000000000000001 [ 38.416651] R10: 0000000000000001 R11: ffff8801d9a41800 R12: 1ffff1003b660fa0 [ 38.423894] R13: ffffffff85a044a8 R14: ffff8801db319c40 R15: 0000000000000003 [ 38.431168] FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 [ 38.439373] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.445226] CR2: 00000000004009f8 CR3: 000000000440c000 CR4: 00000000001606f0 [ 38.452499] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.459752] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.466991] Stack: [ 38.469111] 0000000000000092 ffffffff844c6720 0000000041b58ab3 ffffffff842092d7 [ 38.477092] ffffffff81e70670 ffff8801d9a41800 ffffed003b34841b ffff8801d9a420e0 [ 38.485074] ffff8801db319658 0000000000000000 ffff8801db307d80 ffffffff81229682 [ 38.493054] Call Trace: [ 38.495608] [ 38.497658] [] ? debug_object_activate+0x480/0x480 [ 38.504508] [] ? __lock_is_held+0xa2/0xf0 [ 38.510277] [] __hrtimer_run_queues+0x222/0x1000 [ 38.516651] [] ? retrigger_next_event+0x1c0/0x1c0 [ 38.523117] [] ? kvm_clock_read+0x23/0x40 [ 38.528886] [] ? kvm_clock_get_cycles+0x9/0x10 [ 38.535086] [] ? hrtimer_interrupt+0x12d/0x430 [ 38.541287] [] hrtimer_interrupt+0x1b1/0x430 [ 38.547316] [] local_apic_timer_interrupt+0x74/0xa0 [ 38.553954] [] smp_apic_timer_interrupt+0x7c/0xa0 [ 38.560417] [] apic_timer_interrupt+0xa0/0xb0 [ 38.566526] [ 38.568559] [] ? native_safe_halt+0x6/0x10 [ 38.574722] [] default_idle+0x55/0x3c0 [ 38.580230] [] arch_cpu_idle+0x10/0x20 [ 38.585740] [] default_idle_call+0x57/0x70 [ 38.591602] [] cpu_startup_entry+0x6af/0x780 [ 38.597629] [] ? call_cpuidle+0xe0/0xe0 [ 38.603222] [] start_secondary+0x324/0x400 [ 38.609085] [] ? set_cpu_sibling_map+0x1180/0x1180 [ 38.615630] Code: a9 01 00 00 48 8b 1b 41 bf 01 00 00 00 48 85 db 74 42 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 41 83 c7 01 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 0c 01 00 00 4c 3b 73 18 74 7d 48 89 d9 48 c1 [ 38.642400] RIP [] debug_object_deactivate+0x191/0x340 [ 38.649425] RSP [ 38.653025] ---[ end trace 10364d3a97ec7a05 ]--- [ 38.657759] Kernel panic - not syncing: Fatal exception in interrupt [ 39.739614] Shutting down cpus with NMI [ 39.744206] Dumping ftrace buffer: [ 39.747723] (ftrace buffer empty) [ 39.751412] Kernel Offset: disabled [ 39.755012] Rebooting in 86400 seconds..