[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 21.483204] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 26.312098] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 26.769114] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 27.733725] random: nonblocking pool is initialized Warning: Permanently added '10.128.0.41' (ECDSA) to the list of known hosts. executing program [ 33.852091] ================================================================== [ 33.859463] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 33.866712] Read of size 4 at addr ffff8800bb858500 by task syz-executor964/3851 [ 33.874213] [ 33.875818] CPU: 1 PID: 3851 Comm: syz-executor964 Not tainted 4.4.131-gaa3863d #41 [ 33.883579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.892918] 0000000000000000 8b55997199635a46 ffff8801d956fcc0 ffffffff81e0df8d [ 33.900890] ffffea0002ee1600 ffff8800bb858500 0000000000000000 ffff8800bb858500 [ 33.908854] ffffffff82f18dc0 ffff8801d956fcf8 ffffffff8151520c ffff8800bb858500 [ 33.916823] Call Trace: [ 33.919384] [] dump_stack+0xc1/0x124 [ 33.924720] [] ? sock_release+0x1c0/0x1c0 [ 33.930490] [] print_address_description+0x6c/0x216 [ 33.937128] [] ? sock_release+0x1c0/0x1c0 [ 33.942911] [] kasan_report.cold.7+0x175/0x2f7 [ 33.949114] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 33.955840] [] __asan_report_load4_noabort+0x14/0x20 [ 33.962563] [] l2tp_session_queue_purge+0xf4/0x100 [ 33.969113] [] ? sock_release+0x1c0/0x1c0 [ 33.974969] [] pppol2tp_release+0x1ff/0x310 [ 33.980909] [] sock_release+0x96/0x1c0 [ 33.986420] [] sock_close+0x16/0x20 [ 33.991689] [] __fput+0x235/0x6f0 [ 33.996851] [] ____fput+0x15/0x20 [ 34.001928] [] task_work_run+0x10f/0x190 [ 34.007609] [] exit_to_usermode_loop+0x13d/0x160 [ 34.013987] [] syscall_return_slowpath+0x1b5/0x1f0 [ 34.020537] [] int_ret_from_sys_call+0x25/0xa3 [ 34.026734] [ 34.028332] Allocated by task 3850: [ 34.031928] [] save_stack_trace+0x26/0x50 [ 34.037814] [] save_stack+0x43/0xd0 [ 34.043183] [] kasan_kmalloc+0xc7/0xe0 [ 34.048810] [] __kmalloc+0x124/0x310 [ 34.054258] [] l2tp_session_create+0x39/0x1030 [ 34.060574] [] pppol2tp_connect+0x10f0/0x1910 [ 34.066806] [] SYSC_connect+0x1b8/0x300 [ 34.072521] [] SyS_connect+0x24/0x30 [ 34.077970] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 34.084655] [ 34.086264] Freed by task 3850: [ 34.089524] [] save_stack_trace+0x26/0x50 [ 34.095414] [] save_stack+0x43/0xd0 [ 34.100776] [] kasan_slab_free+0x72/0xc0 [ 34.106570] [] kfree+0xf4/0x310 [ 34.111581] [] l2tp_session_free+0x170/0x200 [ 34.117731] [] l2tp_tunnel_closeall+0x2b9/0x350 [ 34.124136] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 34.130542] [] udpv6_destroy_sock+0xb1/0xd0 [ 34.136603] [] sk_common_release+0x6d/0x300 [ 34.142663] [] udp_lib_close+0x15/0x20 [ 34.148286] [] inet_release+0xff/0x1d0 [ 34.153907] [] inet6_release+0x50/0x70 [ 34.159531] [] sock_release+0x96/0x1c0 [ 34.165158] [] sock_close+0x16/0x20 [ 34.170529] [] __fput+0x235/0x6f0 [ 34.175721] [] ____fput+0x15/0x20 [ 34.180909] [] task_work_run+0x10f/0x190 [ 34.186707] [] exit_to_usermode_loop+0x13d/0x160 [ 34.193198] [] syscall_return_slowpath+0x1b5/0x1f0 [ 34.199859] [] int_ret_from_sys_call+0x25/0xa3 [ 34.206180] [ 34.207779] The buggy address belongs to the object at ffff8800bb858500 [ 34.207779] which belongs to the cache kmalloc-512 of size 512 [ 34.220404] The buggy address is located 0 bytes inside of [ 34.220404] 512-byte region [ffff8800bb858500, ffff8800bb858700) [ 34.232073] The buggy address belongs to the page: [ 34.256399] BUG: unable to handle kernel NULL pointer dereference at (null) [ 34.264691] IP: [< (null)>] (null) [ 34.270016] PGD ad8fa067 PUD b2e88067 PMD 0 [ 34.274837] Oops: 0010 [#1] PREEMPT SMP KASAN [ 34.279886] Dumping ftrace buffer: [ 34.283419] (ftrace buffer empty) [ 34.287137] Modules linked in: [ 34.290448] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.131-gaa3863d #41 [ 34.297444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.306798] task: ffffffff84417840 task.stack: ffffffff84400000 [ 34.312844] RIP: 0010:[<0000000000000000>] [< (null)>] (null) [ 34.320596] RSP: 0018:ffff8801db207e80 EFLAGS: 00010086 [ 34.326042] RAX: 0000000000000000 RBX: ffff8801d4b74900 RCX: ffffffff8126d2d7 [ 34.333308] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8801d4b74900 [ 34.340580] RBP: ffff8801db207e98 R08: ffffffff853301b0 R09: 0000000000000001 [ 34.347907] R10: 0000000000000001 R11: ffffffff84417840 R12: ffff8800bb858700 [ 34.355175] R13: dffffc0000000000 R14: ffff8801d456ca74 R15: ffff8801d456ca30 [ 34.362449] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 34.370676] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.376558] CR2: 0000000000000000 CR3: 00000000b5bd5000 CR4: 00000000001606f0 [ 34.383835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.391110] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.398374] Stack: [ 34.400516] ffffffff8126d2c6 ffff8801d456ca00 ffff8801d456ca74 ffff8801db207f00 [ 34.408575] ffffffff8126a3ef ffffffff84418118 ffff8801d456ca38 ffff8801d456ca68 [ 34.416635] ffff8801d456ca20 ffff8801d456caa0 ffffffff811955a8 ffffffff84407d18 [ 34.424772] Call Trace: [ 34.427344] [ 34.429409] [] ? irq_chip_ack_parent+0x76/0x90 [ 34.435943] [] handle_edge_irq+0x1af/0x900 [ 34.441839] [] ? atomic_notifier_call_chain+0x98/0x140 [ 34.448765] [] handle_irq+0x256/0x390 [ 34.454221] [] ? check_preemption_disabled+0x3b/0x170 [ 34.461063] [] do_IRQ+0x89/0x1c0 [ 34.466093] [] common_interrupt+0xa0/0xa0 [ 34.471880] [ 34.473947] [] ? native_safe_halt+0x6/0x10 [ 34.480133] [] ? trace_hardirqs_on+0xd/0x10 [ 34.486115] [] default_idle+0x55/0x3c0 [ 34.491659] [] arch_cpu_idle+0x10/0x20 [ 34.497206] [] default_idle_call+0x57/0x70 [ 34.503102] [] cpu_startup_entry+0x6af/0x780 [ 34.509168] [] ? call_cpuidle+0xe0/0xe0 [ 34.514802] [] rest_init+0x188/0x18e [ 34.520172] [] start_kernel+0x6b3/0x6e7 [ 34.525798] [] ? thread_stack_cache_init+0xb/0xb [ 34.532206] [] ? early_idt_handler_array+0x120/0x120 [ 34.538962] [] ? early_idt_handler_array+0x120/0x120 [ 34.545716] [] x86_64_start_reservations+0x29/0x2b [ 34.552293] [] x86_64_start_kernel+0x13f/0x162 [ 34.558518] Code: Bad RIP value. [ 34.562238] RIP [< (null)>] (null) [ 34.567641] RSP [ 34.571254] CR2: 0000000000000000 [ 34.574702] ---[ end trace f6f03e18dab78880 ]--- [ 34.579444] Kernel panic - not syncing: Fatal exception in interrupt [ 35.723461] Shutting down cpus with NMI [ 35.728031] Dumping ftrace buffer: [ 35.731553] (ftrace buffer empty) [ 35.735234] Kernel Offset: disabled [ 35.738830] Rebooting in 86400 seconds..