[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 34.158493] random: sshd: uninitialized urandom read (32 bytes read) [ 34.531919] kauditd_printk_skb: 10 callbacks suppressed [ 34.531928] audit: type=1400 audit(1555835783.101:35): avc: denied { map } for pid=6954 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 34.583836] random: sshd: uninitialized urandom read (32 bytes read) [ 35.108963] random: sshd: uninitialized urandom read (32 bytes read) [ 35.285096] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.62' (ECDSA) to the list of known hosts. [ 40.776204] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 40.895976] audit: type=1400 audit(1555835789.461:36): avc: denied { map } for pid=6967 comm="syz-executor877" path="/root/syz-executor877815962" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 40.931331] FAULT_INJECTION: forcing a failure. [ 40.931331] name failslab, interval 1, probability 0, space 0, times 1 [ 40.942955] CPU: 0 PID: 6967 Comm: syz-executor877 Not tainted 4.14.113 #3 [ 40.949969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.959318] Call Trace: [ 40.961915] dump_stack+0x138/0x19c [ 40.965622] should_fail.cold+0x10f/0x159 [ 40.969900] should_failslab+0xdb/0x130 [ 40.974017] kmem_cache_alloc_node_trace+0x283/0x770 [ 40.979118] ? find_next_bit+0x28/0x30 [ 40.983107] __kmalloc_node+0x3d/0x80 [ 40.986901] blk_mq_realloc_hw_ctxs+0x1bf/0xe90 [ 40.991630] blk_mq_update_nr_hw_queues+0x1c9/0x3a0 [ 40.996654] nbd_start_device+0x12c/0xb00 [ 41.000801] nbd_ioctl+0x43e/0xae0 [ 41.004326] ? nbd_add_socket+0x5e0/0x5e0 [ 41.008574] ? lock_downgrade+0x6e0/0x6e0 [ 41.012722] ? nbd_add_socket+0x5e0/0x5e0 [ 41.016857] blkdev_ioctl+0x983/0x1880 [ 41.020731] ? blkpg_ioctl+0x980/0x980 [ 41.024617] ? __might_sleep+0x93/0xb0 [ 41.028639] block_ioctl+0xde/0x120 [ 41.032258] ? blkdev_fallocate+0x3b0/0x3b0 [ 41.036695] do_vfs_ioctl+0x7b9/0x1070 [ 41.040763] ? selinux_file_mprotect+0x5d0/0x5d0 [ 41.045524] ? ioctl_preallocate+0x1c0/0x1c0 [ 41.050059] ? vfs_write+0x104/0x500 [ 41.053776] ? security_file_ioctl+0x83/0xc0 [ 41.058286] ? security_file_ioctl+0x8f/0xc0 [ 41.062887] SyS_ioctl+0x8f/0xc0 [ 41.066403] ? do_vfs_ioctl+0x1070/0x1070 [ 41.070609] do_syscall_64+0x1eb/0x630 [ 41.074496] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.079343] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 41.084536] RIP: 0033:0x4446b9 [ 41.087708] RSP: 002b:00007ffe3bd3f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.095791] RAX: ffffffffffffffda RBX: 00007ffe3bd3f210 RCX: 00000000004446b9 [ 41.103299] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 [ 41.110755] RBP: 0000000000000007 R08: 0000000000000001 R09: 0000000000400d80 [ 41.119582] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004023c0 [ 41.126955] R13: 0000000000402450 R14: 0000000000000000 R15: 0000000000000000 [ 41.136727] BUG: unable to handle kernel NULL pointer dereference at 0000000000000120 [ 41.144969] IP: blk_mq_map_swqueue+0x25e/0x9c0 [ 41.149585] PGD a5472067 P4D a5472067 PUD a974b067 PMD 0 [ 41.155235] Oops: 0002 [#1] PREEMPT SMP KASAN [ 41.159721] Modules linked in: [ 41.162995] CPU: 0 PID: 6967 Comm: syz-executor877 Not tainted 4.14.113 #3 [ 41.169998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.179337] task: ffff8880a6f72480 task.stack: ffff88809d570000 [ 41.185403] RIP: 0010:blk_mq_map_swqueue+0x25e/0x9c0 [ 41.190596] RSP: 0018:ffff88809d577a50 EFLAGS: 00010297 [ 41.195967] RAX: ffff8880a6f72480 RBX: 0000000000000001 RCX: 0000000000000000 [ 41.203561] RDX: 0000000000000000 RSI: ffff8880a48b79c0 RDI: ffff8880a48b79c8 [ 41.211063] RBP: ffff88809d577ac8 R08: 0000000000000000 R09: 0000000000000000 [ 41.218547] R10: 0000000000000000 R11: ffff88809d5778e8 R12: 0000000000000001 [ 41.225911] R13: ffff8882192e9300 R14: dffffc0000000000 R15: ffff8880a4ba0fb0 [ 41.233177] FS: 00000000018a1940(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000 [ 41.241692] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.247683] CR2: 0000000000000120 CR3: 00000000a55e9000 CR4: 00000000001406f0 [ 41.255159] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.262819] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.270329] Call Trace: [ 41.272945] ? __mutex_unlock_slowpath+0x7b7/0x800 [ 41.278099] blk_mq_update_nr_hw_queues+0x21c/0x3a0 [ 41.283523] nbd_start_device+0x12c/0xb00 [ 41.287788] nbd_ioctl+0x43e/0xae0 [ 41.291792] ? nbd_add_socket+0x5e0/0x5e0 [ 41.296172] ? lock_downgrade+0x6e0/0x6e0 [ 41.300790] ? nbd_add_socket+0x5e0/0x5e0 [ 41.304919] blkdev_ioctl+0x983/0x1880 [ 41.308973] ? blkpg_ioctl+0x980/0x980 [ 41.312863] ? __might_sleep+0x93/0xb0 [ 41.316810] block_ioctl+0xde/0x120 [ 41.320436] ? blkdev_fallocate+0x3b0/0x3b0 [ 41.324968] do_vfs_ioctl+0x7b9/0x1070 [ 41.329106] ? selinux_file_mprotect+0x5d0/0x5d0 [ 41.333862] ? ioctl_preallocate+0x1c0/0x1c0 [ 41.338313] ? vfs_write+0x104/0x500 [ 41.342023] ? security_file_ioctl+0x83/0xc0 [ 41.346470] ? security_file_ioctl+0x8f/0xc0 [ 41.351056] SyS_ioctl+0x8f/0xc0 [ 41.354410] ? do_vfs_ioctl+0x1070/0x1070 [ 41.358555] do_syscall_64+0x1eb/0x630 [ 41.362637] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.367757] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 41.372945] RIP: 0033:0x4446b9 [ 41.376245] RSP: 002b:00007ffe3bd3f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.384366] RAX: ffffffffffffffda RBX: 00007ffe3bd3f210 RCX: 00000000004446b9 [ 41.391726] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 [ 41.399066] RBP: 0000000000000007 R08: 0000000000000001 R09: 0000000000400d80 [ 41.406341] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004023c0 [ 41.413712] R13: 0000000000402450 R14: 0000000000000000 R15: 0000000000000000 [ 41.421069] Code: ea 03 42 80 3c 32 00 0f 85 94 06 00 00 41 83 fc 3f 48 8b 17 0f 87 4b 04 00 00 48 89 55 c8 48 89 45 d0 e8 76 17 93 fe 48 8b 55 c8 48 0f ab 9a 20 01 00 00 48 8d ba 78 01 00 00 48 8b 45 d0 48 [ 41.440689] RIP: blk_mq_map_swqueue+0x25e/0x9c0 RSP: ffff88809d577a50 [ 41.447418] CR2: 0000000000000120 [ 41.451383] ---[ end trace 48c34c2e429ec6a4 ]--- [ 41.456233] Kernel panic - not syncing: Fatal exception [ 41.462712] Kernel Offset: disabled [ 41.466651] Rebooting in 86400 seconds..