[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 30.643583] random: sshd: uninitialized urandom read (32 bytes read) [ 30.942761] kauditd_printk_skb: 9 callbacks suppressed [ 30.942769] audit: type=1400 audit(1572420321.498:35): avc: denied { map } for pid=6879 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 30.996939] random: sshd: uninitialized urandom read (32 bytes read) [ 31.537193] random: sshd: uninitialized urandom read (32 bytes read) [ 31.723185] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.1.38' (ECDSA) to the list of known hosts. [ 37.372854] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 37.489790] audit: type=1400 audit(1572420328.038:36): avc: denied { map } for pid=6893 comm="syz-executor752" path="/root/syz-executor752021065" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 37.495311] ================================================================== [ 37.523483] BUG: KASAN: global-out-of-bounds in do_blockdev_direct_IO+0x70c1/0x7fd0 [ 37.531317] Read of size 8 at addr ffffffff885d3380 by task syz-executor752/6893 [ 37.538827] [ 37.540437] CPU: 0 PID: 6893 Comm: syz-executor752 Not tainted 4.14.151 #0 [ 37.547424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.556756] Call Trace: [ 37.559328] dump_stack+0x138/0x197 [ 37.562936] ? do_blockdev_direct_IO+0x70c1/0x7fd0 [ 37.567845] print_address_description.cold+0x5/0x1dc [ 37.573019] ? do_blockdev_direct_IO+0x70c1/0x7fd0 [ 37.578060] kasan_report.cold+0xa9/0x2af [ 37.582189] __asan_report_load8_noabort+0x14/0x20 [ 37.587096] do_blockdev_direct_IO+0x70c1/0x7fd0 [ 37.591832] ? __ext4_get_inode_loc+0x392/0xf30 [ 37.596485] ? sb_init_dio_done_wq+0x80/0x80 [ 37.600872] ? __lock_acquire+0x2521/0x4620 [ 37.605204] ? save_trace+0x290/0x290 [ 37.608983] ? ext4_dio_get_block_unwritten_sync+0xd0/0xd0 [ 37.614591] ? ext4_dio_get_block_unwritten_sync+0xd0/0xd0 [ 37.620192] __blockdev_direct_IO+0xa1/0xca [ 37.624490] ? write_end_fn+0xa0/0xa0 [ 37.628286] ext4_direct_IO+0x70d/0x1890 [ 37.632341] ? ext4_dio_get_block_unwritten_sync+0xd0/0xd0 [ 37.637946] generic_file_direct_write+0x1e7/0x430 [ 37.642855] __generic_file_write_iter+0x2bc/0x5b0 [ 37.647764] ext4_file_write_iter+0x2ac/0xe90 [ 37.652241] ? ext4_file_mmap+0x2c0/0x2c0 [ 37.656386] ? __might_sleep+0x93/0xb0 [ 37.660271] do_iter_readv_writev+0x418/0x670 [ 37.664755] ? vfs_dedupe_file_range+0x8f0/0x8f0 [ 37.669500] ? rw_verify_area+0xea/0x2b0 [ 37.673543] do_iter_write+0x154/0x540 [ 37.677410] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 37.682856] ? __kmalloc+0x376/0x7a0 [ 37.686562] vfs_iter_write+0x77/0xb0 [ 37.690351] iter_file_splice_write+0x572/0xad0 [ 37.695006] ? default_file_splice_read+0x7b0/0x7b0 [ 37.700017] ? __lock_is_held+0xb6/0x140 [ 37.704114] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 37.708850] ? __sb_start_write+0x153/0x2f0 [ 37.713165] ? default_file_splice_read+0x7b0/0x7b0 [ 37.718178] SyS_splice+0xd92/0x1430 [ 37.721878] ? do_sys_open+0x221/0x430 [ 37.725745] ? compat_SyS_vmsplice+0x250/0x250 [ 37.730304] ? do_syscall_64+0x53/0x640 [ 37.734258] ? compat_SyS_vmsplice+0x250/0x250 [ 37.738817] do_syscall_64+0x1e8/0x640 [ 37.742681] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.747509] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 37.752676] RIP: 0033:0x440309 [ 37.755844] RSP: 002b:00007fff13a831c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 37.763543] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440309 [ 37.770792] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000004 [ 37.778040] RBP: 00000000006ca018 R08: 00000000ffffffff R09: 0000000000000000 [ 37.785290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b90 [ 37.792618] R13: 0000000000401c20 R14: 0000000000000000 R15: 0000000000000000 [ 37.800326] [ 37.801935] The buggy address belongs to the variable: [ 37.807195] __key.65489+0x20/0x40 [ 37.810710] [ 37.812323] Memory state around the buggy address: [ 37.817252] ffffffff885d3280: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [ 37.824610] ffffffff885d3300: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [ 37.831952] >ffffffff885d3380: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [ 37.839289] ^ [ 37.842633] ffffffff885d3400: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [ 37.849978] ffffffff885d3480: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [ 37.857331] ================================================================== [ 37.864670] Disabling lock debugging due to kernel taint [ 37.870406] Kernel panic - not syncing: panic_on_warn set ... [ 37.870406] [ 37.877770] CPU: 0 PID: 6893 Comm: syz-executor752 Tainted: G B 4.14.151 #0 [ 37.885976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.895325] Call Trace: [ 37.897915] dump_stack+0x138/0x197 [ 37.901521] ? do_blockdev_direct_IO+0x70c1/0x7fd0 [ 37.906426] panic+0x1f9/0x42d [ 37.909610] ? add_taint.cold+0x16/0x16 [ 37.913564] ? ___preempt_schedule+0x16/0x18 [ 37.917973] kasan_end_report+0x47/0x4f [ 37.921923] kasan_report.cold+0x130/0x2af [ 37.926147] __asan_report_load8_noabort+0x14/0x20 [ 37.931058] do_blockdev_direct_IO+0x70c1/0x7fd0 [ 37.935788] ? __ext4_get_inode_loc+0x392/0xf30 [ 37.940455] ? sb_init_dio_done_wq+0x80/0x80 [ 37.944841] ? __lock_acquire+0x2521/0x4620 [ 37.949141] ? save_trace+0x290/0x290 [ 37.952922] ? ext4_dio_get_block_unwritten_sync+0xd0/0xd0 [ 37.958522] ? ext4_dio_get_block_unwritten_sync+0xd0/0xd0 [ 37.964122] __blockdev_direct_IO+0xa1/0xca [ 37.968420] ? write_end_fn+0xa0/0xa0 [ 37.972198] ext4_direct_IO+0x70d/0x1890 [ 37.976235] ? ext4_dio_get_block_unwritten_sync+0xd0/0xd0 [ 37.981838] generic_file_direct_write+0x1e7/0x430 [ 37.986742] __generic_file_write_iter+0x2bc/0x5b0 [ 37.991651] ext4_file_write_iter+0x2ac/0xe90 [ 37.996121] ? ext4_file_mmap+0x2c0/0x2c0 [ 38.000246] ? __might_sleep+0x93/0xb0 [ 38.004108] do_iter_readv_writev+0x418/0x670 [ 38.008577] ? vfs_dedupe_file_range+0x8f0/0x8f0 [ 38.013324] ? rw_verify_area+0xea/0x2b0 [ 38.017375] do_iter_write+0x154/0x540 [ 38.021239] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 38.026665] ? __kmalloc+0x376/0x7a0 [ 38.030370] vfs_iter_write+0x77/0xb0 [ 38.034146] iter_file_splice_write+0x572/0xad0 [ 38.038807] ? default_file_splice_read+0x7b0/0x7b0 [ 38.043799] ? __lock_is_held+0xb6/0x140 [ 38.047852] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 38.052601] ? __sb_start_write+0x153/0x2f0 [ 38.056898] ? default_file_splice_read+0x7b0/0x7b0 [ 38.061890] SyS_splice+0xd92/0x1430 [ 38.065578] ? do_sys_open+0x221/0x430 [ 38.069441] ? compat_SyS_vmsplice+0x250/0x250 [ 38.073998] ? do_syscall_64+0x53/0x640 [ 38.077945] ? compat_SyS_vmsplice+0x250/0x250 [ 38.082501] do_syscall_64+0x1e8/0x640 [ 38.086380] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 38.091201] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 38.096366] RIP: 0033:0x440309 [ 38.099528] RSP: 002b:00007fff13a831c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 38.107223] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440309 [ 38.114470] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000004 [ 38.121718] RBP: 00000000006ca018 R08: 00000000ffffffff R09: 0000000000000000 [ 38.128978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b90 [ 38.136226] R13: 0000000000401c20 R14: 0000000000000000 R15: 0000000000000000 [ 38.144758] Kernel Offset: disabled [ 38.148395] Rebooting in 86400 seconds..