[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 33.695157] random: sshd: uninitialized urandom read (32 bytes read) [ 33.971717] kauditd_printk_skb: 10 callbacks suppressed [ 33.971726] audit: type=1400 audit(1569200896.530:35): avc: denied { map } for pid=6905 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 34.028818] random: sshd: uninitialized urandom read (32 bytes read) [ 34.606872] random: sshd: uninitialized urandom read (32 bytes read) [ 34.789434] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.215' (ECDSA) to the list of known hosts. [ 40.299238] random: sshd: uninitialized urandom read (32 bytes read) [ 40.424010] audit: type=1400 audit(1569200902.980:36): avc: denied { map } for pid=6918 comm="syz-executor183" path="/root/syz-executor183537952" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 40.711037] IPVS: ftp: loaded support on port[0] = 21 executing program [ 41.486804] BUG: unable to handle kernel NULL pointer dereference at (null) [ 41.494805] IP: (null) [ 41.498176] PGD 91876067 P4D 91876067 PUD 910c7067 PMD 0 [ 41.503854] Oops: 0010 [#1] PREEMPT SMP KASAN [ 41.508337] Modules linked in: [ 41.511609] CPU: 1 PID: 6919 Comm: syz-executor183 Not tainted 4.14.146 #0 [ 41.518682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.528023] task: ffff888081738180 task.stack: ffff88809f970000 [ 41.534054] RIP: 0010: (null) [ 41.537911] RSP: 0018:ffff88809f9775e8 EFLAGS: 00010246 [ 41.543424] RAX: dffffc0000000000 RBX: ffffffff86f15e00 RCX: 0000000000000000 [ 41.550761] RDX: 1ffffffff0de2bc8 RSI: 0000000000000001 RDI: ffff8880a843f240 [ 41.558367] RBP: ffff88809f9776c0 R08: 1ffff11013f2eee8 R09: ffff88809f977740 [ 41.565717] R10: ffffed1013f2eef3 R11: ffff88809f97779f R12: ffff88809f977698 [ 41.573096] R13: ffff8880a843f240 R14: 0000000000000001 R15: 0000000000000000 [ 41.580541] FS: 0000555556b97880(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000 [ 41.588836] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.594807] CR2: 0000000000000000 CR3: 00000000a0a1c000 CR4: 00000000001406e0 [ 41.602241] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.609493] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.616834] Call Trace: [ 41.619410] tc_bind_tclass+0x124/0x400 [ 41.623376] ? security_capable+0x8e/0xc0 [ 41.627509] ? __qdisc_calculate_pkt_len+0x2e0/0x2e0 [ 41.632599] ? memset+0x32/0x40 [ 41.636044] ? nla_parse+0x186/0x240 [ 41.639748] ? qdisc_match_from_root+0x14f/0x230 [ 41.644719] tc_ctl_tclass+0x94a/0xa70 [ 41.648767] ? qdisc_tree_reduce_backlog+0x4a0/0x4a0 [ 41.653847] ? rtnetlink_rcv_msg+0x305/0xb70 [ 41.658239] ? qdisc_tree_reduce_backlog+0x4a0/0x4a0 [ 41.663333] rtnetlink_rcv_msg+0x3eb/0xb70 [ 41.667557] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 41.672207] ? netlink_deliver_tap+0x93/0x8f0 [ 41.676683] netlink_rcv_skb+0x14f/0x3c0 [ 41.680899] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 41.685558] ? lock_downgrade+0x6e0/0x6e0 [ 41.689681] ? netlink_ack+0x9a0/0x9a0 [ 41.693655] ? netlink_deliver_tap+0xba/0x8f0 [ 41.698195] rtnetlink_rcv+0x1d/0x30 [ 41.701889] netlink_unicast+0x45d/0x640 [ 41.705929] ? netlink_attachskb+0x6a0/0x6a0 [ 41.710318] ? security_netlink_send+0x81/0xb0 [ 41.715145] netlink_sendmsg+0x7c4/0xc60 [ 41.719193] ? netlink_unicast+0x640/0x640 [ 41.723411] ? security_socket_sendmsg+0x89/0xb0 [ 41.728321] ? netlink_unicast+0x640/0x640 [ 41.732630] sock_sendmsg+0xce/0x110 [ 41.736323] ___sys_sendmsg+0x70a/0x840 [ 41.740287] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 41.745028] ? __might_fault+0x110/0x1d0 [ 41.749068] ? find_held_lock+0x35/0x130 [ 41.753114] ? __might_fault+0x110/0x1d0 [ 41.757266] ? lock_downgrade+0x6e0/0x6e0 [ 41.761431] ? kasan_check_read+0x11/0x20 [ 41.765710] ? _copy_to_user+0x87/0xd0 [ 41.769673] ? move_addr_to_user+0x94/0x1a0 [ 41.774503] ? __fget_light+0x172/0x1f0 [ 41.778459] ? __fdget+0x1b/0x20 [ 41.781811] ? sockfd_lookup_light+0xb4/0x160 [ 41.786419] __sys_sendmsg+0xb9/0x140 [ 41.790278] ? SyS_shutdown+0x170/0x170 [ 41.794700] SyS_sendmsg+0x2d/0x50 [ 41.798219] ? __sys_sendmsg+0x140/0x140 [ 41.802260] do_syscall_64+0x1e8/0x640 [ 41.806128] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.810955] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 41.816302] RIP: 0033:0x440d89 [ 41.820092] RSP: 002b:00007ffc1bf743b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 41.827787] RAX: ffffffffffffffda RBX: 00000000004a2650 RCX: 0000000000440d89 [ 41.835049] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 [ 41.842385] RBP: 00000000004a2650 R08: 0000000120080522 R09: 0000000120080522 [ 41.852288] R10: 0000000120080522 R11: 0000000000000246 R12: 0000000000402290 [ 41.859541] R13: 0000000000402320 R14: 0000000000000000 R15: 0000000000000000 [ 41.866884] Code: Bad RIP value. [ 41.870332] RIP: (null) RSP: ffff88809f9775e8 [ 41.875671] CR2: 0000000000000000 [ 41.879473] ---[ end trace e3508857f25e534c ]--- [ 41.884255] Kernel panic - not syncing: Fatal exception [ 41.891348] Kernel Offset: disabled [ 41.894988] Rebooting in 86400 seconds..