[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 33.679867] random: sshd: uninitialized urandom read (32 bytes read) [ 34.184182] kauditd_printk_skb: 9 callbacks suppressed [ 34.184189] audit: type=1400 audit(1574446180.619:35): avc: denied { map } for pid=6846 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 34.260868] random: sshd: uninitialized urandom read (32 bytes read) [ 34.855220] random: sshd: uninitialized urandom read (32 bytes read) [ 35.067484] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.12' (ECDSA) to the list of known hosts. [ 40.654910] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 40.768766] audit: type=1400 audit(1574446187.199:36): avc: denied { map } for pid=6859 comm="syz-executor169" path="/root/syz-executor169903745" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 40.772495] ifb0: Invalid MTU 47872 requested, hw max 1500 [ 40.812143] refcount_t: underflow; use-after-free. [ 40.817293] ------------[ cut here ]------------ [ 40.822163] WARNING: CPU: 0 PID: 6859 at lib/refcount.c:187 refcount_sub_and_test.cold+0x18/0x22 [ 40.831066] Kernel panic - not syncing: panic_on_warn set ... [ 40.831066] [ 40.838411] CPU: 0 PID: 6859 Comm: syz-executor169 Not tainted 4.14.155-syzkaller #0 [ 40.846274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.855622] Call Trace: [ 40.858192] dump_stack+0x142/0x197 [ 40.861801] panic+0x1f9/0x42d [ 40.864971] ? add_taint.cold+0x16/0x16 [ 40.868927] ? refcount_sub_and_test.cold+0x18/0x22 [ 40.873924] ? refcount_sub_and_test.cold+0x18/0x22 [ 40.878933] __warn.cold+0x2f/0x2f [ 40.882451] ? ist_end_non_atomic+0x10/0x10 [ 40.886766] ? refcount_sub_and_test.cold+0x18/0x22 [ 40.891761] report_bug+0x216/0x254 [ 40.895367] do_error_trap+0x1bb/0x310 [ 40.899232] ? math_error+0x360/0x360 [ 40.903012] ? vprintk_emit+0x171/0x600 [ 40.906966] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 40.911790] do_invalid_op+0x1b/0x20 [ 40.915481] invalid_op+0x1b/0x40 [ 40.918912] RIP: 0010:refcount_sub_and_test.cold+0x18/0x22 [ 40.924524] RSP: 0018:ffff88809f9df600 EFLAGS: 00010282 [ 40.929865] RAX: 0000000000000026 RBX: 0000000000008001 RCX: 0000000000000000 [ 40.937112] RDX: 0000000000000000 RSI: ffffffff866d07c0 RDI: ffffed1013f3beb6 [ 40.944372] RBP: ffff88809f9df628 R08: 0000000000000026 R09: ffff888085586e48 [ 40.951701] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808b720a3c [ 40.958953] R13: 0000000000008100 R14: 00000000ffffff01 R15: ffffffff88152e60 [ 40.966221] sock_wfree+0xa7/0x160 [ 40.969744] sctp_wfree+0x2a1/0x620 [ 40.973363] ? __sctp_write_space+0x5c0/0x5c0 [ 40.977883] skb_release_head_state+0x124/0x260 [ 40.982529] skb_release_all+0x16/0x60 [ 40.986395] consume_skb+0xaf/0x340 [ 40.990001] sctp_chunk_put+0x179/0x270 [ 40.993960] sctp_chunk_free+0x56/0x70 [ 40.997827] __sctp_outq_teardown+0x1c2/0xde0 [ 41.002303] sctp_outq_free+0x16/0x20 [ 41.006080] sctp_association_free+0x1ee/0x753 [ 41.010641] sctp_do_sm+0x3469/0x4ae0 [ 41.014419] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 41.019853] ? sctp_do_8_2_transport_strike.isra.0+0x880/0x880 [ 41.025802] ? __lock_is_held+0xb6/0x140 [ 41.029843] ? sctp_chunkify+0x4b/0x280 [ 41.033802] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 41.039236] ? rcu_read_lock_sched_held+0x110/0x130 [ 41.044229] ? kmem_cache_alloc+0x611/0x780 [ 41.048531] ? __alloc_skb+0x3ee/0x500 [ 41.052403] ? sctp_auth_send_cid+0x104/0x140 [ 41.056917] ? sctp_make_abort_user+0x145/0x1f0 [ 41.061577] sctp_primitive_ABORT+0xa0/0xd0 [ 41.065876] sctp_close+0x25e/0x730 [ 41.069485] ? sctp_init_sock+0x1230/0x1230 [ 41.073789] ? lock_acquire+0x16f/0x430 [ 41.077742] ? __sock_release+0x89/0x2b0 [ 41.081794] ? ip_mc_drop_socket+0x1d6/0x230 [ 41.086180] inet_release+0xec/0x1c0 [ 41.089869] __sock_release+0xce/0x2b0 [ 41.093736] ? __sock_release+0x2b0/0x2b0 [ 41.097860] sock_close+0x1b/0x30 [ 41.101293] __fput+0x275/0x7a0 [ 41.104554] ____fput+0x16/0x20 [ 41.107823] task_work_run+0x114/0x190 [ 41.111696] do_exit+0x7df/0x2c10 [ 41.115130] ? mm_update_next_owner+0x5d0/0x5d0 [ 41.119774] ? sock_common_getsockopt+0x94/0xd0 [ 41.124421] ? SyS_getsockopt+0x13c/0x1e0 [ 41.128554] do_group_exit+0x111/0x330 [ 41.132423] SyS_exit_group+0x1d/0x20 [ 41.136273] ? do_group_exit+0x330/0x330 [ 41.140337] do_syscall_64+0x1e8/0x640 [ 41.144208] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.149037] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 41.154300] RIP: 0033:0x43f268 [ 41.157468] RSP: 002b:00007ffda6bffde8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 41.165155] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f268 [ 41.172407] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 41.179693] RBP: 00000000004bea68 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 41.186943] R10: 000000002059aff8 R11: 0000000000000246 R12: 0000000000000001 [ 41.194190] R13: 00000000006d01a0 R14: 0000000000000000 R15: 0000000000000000 [ 41.202846] Kernel Offset: disabled [ 41.206517] Rebooting in 86400 seconds..