[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 23.603607] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 27.789064] random: sshd: uninitialized urandom read (32 bytes read) [ 28.025859] random: sshd: uninitialized urandom read (32 bytes read) [ 28.744966] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.55' (ECDSA) to the list of known hosts. [ 34.468048] random: sshd: uninitialized urandom read (32 bytes read) 2018/09/05 11:06:58 fuzzer started [ 35.532096] random: cc1: uninitialized urandom read (8 bytes read) 2018/09/05 11:07:00 connecting to host at 10.128.0.26:44519 2018/09/05 11:07:00 checking revisions... 2018/09/05 11:07:00 testing simple program... executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 185.216616] INFO: task syz-fuzzer:4910 blocked for more than 140 seconds. [ 185.223814] Not tainted 4.19.0-rc2-next-20180905+ #58 [ 185.229599] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.237635] syz-fuzzer D18248 4910 4904 0x00000000 [ 185.243341] Call Trace: [ 185.245975] __schedule+0x87c/0x1df0 [ 185.249777] ? __sched_text_start+0x8/0x8 [ 185.253997] ? ext4_set_page_dirty+0x254/0x340 [ 185.258655] ? graph_lock+0x170/0x170 [ 185.262508] ? print_usage_bug+0xc0/0xc0 [ 185.266643] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 185.272240] ? find_held_lock+0x36/0x1c0 [ 185.276369] schedule+0xfb/0x450 [ 185.279797] ? mark_held_locks+0xc9/0x160 [ 185.284020] ? __schedule+0x1df0/0x1df0 [ 185.288054] ? _raw_spin_unlock_irq+0x27/0x70 [ 185.292652] ? _raw_spin_unlock_irq+0x27/0x70 [ 185.297212] ? lockdep_hardirqs_on+0x421/0x5c0 [ 185.301859] ? trace_hardirqs_on+0xbd/0x2c0 [ 185.306275] ? kasan_check_read+0x11/0x20 [ 185.310504] ? __lock_page+0x585/0x7a0 [ 185.314441] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 185.319625] ? kasan_check_write+0x14/0x20 [ 185.323926] io_schedule+0x1c/0x70 [ 185.327531] __lock_page+0x5b7/0x7a0 [ 185.331321] ? __lock_page_killable+0x850/0x850 [ 185.336052] ? __sb_end_write+0xac/0xe0 [ 185.340082] ? ext4_page_mkwrite+0xa95/0x1450 [ 185.344644] ? page_cache_tree_insert+0x560/0x560 [ 185.349560] ? __lock_is_held+0xb5/0x140 [ 185.353704] ? check_same_owner+0x340/0x340 [ 185.358086] ? rcu_note_context_switch+0x680/0x680 [ 185.363197] do_page_mkwrite+0x429/0x520 [ 185.367309] ? print_bad_pte+0x5f0/0x5f0 [ 185.371505] ? pud_val+0x88/0x100 [ 185.375008] ? find_held_lock+0x36/0x1c0 [ 185.379158] __handle_mm_fault+0x2a0a/0x4350 [ 185.383622] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 185.388527] ? graph_lock+0x170/0x170 [ 185.392380] ? kasan_check_read+0x11/0x20 [ 185.396605] ? lock_downgrade+0x8f0/0x8f0 [ 185.400839] ? handle_mm_fault+0x8c4/0xc80 [ 185.405139] ? handle_mm_fault+0x8c4/0xc80 [ 185.409440] ? kasan_check_read+0x11/0x20 [ 185.413671] ? rcu_is_watching+0x8c/0x150 [ 185.417873] ? __do_page_fault+0x620/0xe50 [ 185.422170] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 185.426899] handle_mm_fault+0x53e/0xc80 [ 185.431032] ? __handle_mm_fault+0x4350/0x4350 [ 185.435669] ? find_vma+0x34/0x190 [ 185.439272] __do_page_fault+0x620/0xe50 [ 185.443400] ? mm_fault_error+0x380/0x380 [ 185.447615] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 185.453156] ? trace_hardirqs_on+0x2c0/0x2c0 [ 185.457650] do_page_fault+0xf6/0x7a4 [ 185.461508] ? vmalloc_sync_all+0x30/0x30 [ 185.465720] ? error_entry+0x70/0xd0 [ 185.469500] ? trace_hardirqs_off_caller+0xbb/0x2b0 [ 185.474590] ? trace_hardirqs_on_caller+0xc0/0x2b0 [ 185.479637] ? syscall_return_slowpath+0x5e0/0x5e0 [ 185.484652] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 185.489548] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 185.494619] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 185.500139] ? prepare_exit_to_usermode+0x291/0x3b0 [ 185.505215] ? page_fault+0x8/0x30 [ 185.508807] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 185.513716] ? page_fault+0x8/0x30 [ 185.517312] page_fault+0x1e/0x30 [ 185.520826] RIP: 0033:0x70b581 [ 185.524069] Code: 48 89 6c 24 10 48 8d 6c 24 10 48 8b 44 24 20 48 8b 48 08 48 8b 50 10 48 8d 58 08 48 83 fa 08 0f 8c 1e 01 00 00 48 8b 54 24 28 <88> 11 48 8b 48 08 48 8b 70 10 48 83 fe 01 0f 86 44 01 00 00 48 89 [ 185.543029] RSP: 002b:000000c4200313f0 EFLAGS: 00010212 [ 185.548507] RAX: 000000c420031508 RBX: 000000c420031510 RCX: 00007f2838ed1000 [ 185.555839] RDX: 0000000000000543 RSI: 000000000072a460 RDI: 000000c420031348 [ 185.563188] RBP: 000000c420031400 R08: 0000000000000000 R09: 0000000000000000 [ 185.570519] R10: 0000000000949c4a R11: 0000000000000004 R12: 0000000000000000 [ 185.577838] R13: 0000000000000020 R14: 0000000000000013 R15: 000000000000000f [ 185.585179] [ 185.585179] Showing all locks held in the system: [ 185.591559] 1 lock held by khungtaskd/757: [ 185.595845] #0: 00000000a3250455 (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x428 [ 185.604544] 4 locks held by kworker/u4:5/776: [ 185.609084] #0: 00000000fd8a5b0a ((wq_completion)"writeback"){+.+.}, at: process_one_work+0xb44/0x1aa0 [ 185.618703] #1: 0000000014cb626a ((work_completion)(&(&wb->dwork)->work)){+.+.}, at: process_one_work+0xb9b/0x1aa0 [ 185.629405] #2: 0000000040ac20cf (&fc->fs_type->s_umount_key#29){++++}, at: trylock_super+0x22/0x110 [ 185.638948] #3: 00000000750cd6e6 (&sbi->s_journal_flag_rwsem){.+.+}, at: do_writepages+0x9a/0x1a0 [ 185.648178] 1 lock held by khugepaged/801: [ 185.652494] #0: 000000009f7be133 (&mm->mmap_sem){++++}, at: collapse_huge_page+0x2bf/0x2250 [ 185.661190] 3 locks held by rsyslogd/4793: [ 185.665507] #0: 000000002b8e4419 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200 [ 185.673568] #1: 00000000323d6dca (logbuf_lock){-.-.}, at: aa_file_perm+0x10d/0xfc0 [ 185.681484] #2: 00000000a3250455 (rcu_read_lock){....}, at: __update_idle_core+0xc4/0x610 [ 185.689996] 2 locks held by getty/4884: [ 185.694013] #0: 000000009866f08d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 185.702328] #1: 0000000097fe3cf8 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 [ 185.711252] 2 locks held by getty/4885: [ 185.715264] #0: 00000000129f08ac (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 185.723581] #1: 0000000002d3614d (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 [ 185.732531] 2 locks held by getty/4886: [ 185.736569] #0: 000000000d3d1d30 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 185.744900] #1: 0000000045512f2c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 [ 185.753820] 2 locks held by getty/4887: [ 185.757839] #0: 000000007d09d6f6 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 185.766183] #1: 00000000d67a9ede (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 [ 185.775108] 2 locks held by getty/4888: [ 185.779159] #0: 000000004fcb7fe4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 185.787504] #1: 000000006bee921e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 [ 185.796447] 2 locks held by getty/4889: [ 185.800497] #0: 000000004e8c31e2 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 185.808811] #1: 00000000940f2fbd (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 [ 185.817782] 2 locks held by getty/4890: [ 185.821791] #0: 00000000ba821f93 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 [ 185.830102] #1: 00000000fb9d6fac (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 [ 185.839022] 1 lock held by syz-fuzzer/4910: [ 185.843382] #0: 000000009f7be133 (&mm->mmap_sem){++++}, at: __do_page_fault+0x389/0xe50 [ 185.851736] [ 185.853421] ============================================= [ 185.853421] [ 185.860497] NMI backtrace for cpu 0 [ 185.864177] CPU: 0 PID: 757 Comm: khungtaskd Not tainted 4.19.0-rc2-next-20180905+ #58 [ 185.872238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 185.881597] Call Trace: [ 185.884201] dump_stack+0x1c9/0x2b4 [ 185.887888] ? dump_stack_print_info.cold.2+0x52/0x52 [ 185.893098] ? vprintk_default+0x28/0x30 [ 185.897175] ? lapic_can_unplug_cpu.cold.30+0x3f/0x3f [ 185.902377] nmi_cpu_backtrace.cold.4+0x48/0x88 [ 185.907062] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 185.911828] ? lapic_can_unplug_cpu.cold.30+0x3f/0x3f [ 185.917027] nmi_trigger_cpumask_backtrace+0x1b6/0x1cd [ 185.922319] arch_trigger_cpumask_backtrace+0x14/0x20 [ 185.927515] watchdog+0xb39/0x1040 [ 185.931090] ? reset_hung_task_detector+0xd0/0xd0 [ 185.935942] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 185.941058] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 185.946182] ? lockdep_hardirqs_on+0x421/0x5c0 [ 185.950774] ? trace_hardirqs_on+0xbd/0x2c0 [ 185.955135] ? kasan_check_read+0x11/0x20 [ 185.959293] ? __kthread_parkme+0xd7/0x1b0 [ 185.963564] ? kasan_check_write+0x14/0x20 [ 185.967813] ? do_raw_spin_lock+0xc1/0x200 [ 185.972062] ? __kthread_parkme+0x58/0x1b0 [ 185.976308] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 185.981850] ? __kthread_parkme+0x106/0x1b0 [ 185.986193] kthread+0x35a/0x420 [ 185.989568] ? reset_hung_task_detector+0xd0/0xd0 [ 185.994427] ? kthread_bind+0x40/0x40 [ 185.998234] ret_from_fork+0x3a/0x50 [ 186.002004] Sending NMI from CPU 0 to CPUs 1: [ 186.007283] NMI backtrace for cpu 1 [ 186.007290] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.19.0-rc2-next-20180905+ #58 [ 186.007296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 186.007300] RIP: 0010:pvclock_clocksource_read+0x1/0x680 [ 186.007312] Code: 4c 8b 45 c8 0f b6 45 d0 eb a4 be 04 00 00 00 48 89 df e8 52 73 85 00 e9 15 ff ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 55 <48> 89 e5 41 57 41 56 48 8d 85 78 ff ff ff 41 55 48 c1 e8 03 41 54 [ 186.007316] RSP: 0018:ffff8801db107b80 EFLAGS: 00000082 [ 186.007338] RAX: ffffffff81352dd0 RBX: ffffffff8811b980 RCX: ffffffff816aad8e [ 186.007343] RDX: 0000000000000000 RSI: ffffffff816aada1 RDI: ffffffff88f79040 [ 186.007348] RBP: ffff8801db107b90 R08: ffff8801d9f0e380 R09: 0000000000000000 [ 186.007353] R10: 0000000000000003 R11: 0000000000000000 R12: dffffc0000000000 [ 186.007358] R13: 00000000000203ce R14: ffff8801db107c70 R15: ffffffff8811bea0 [ 186.007364] FS: 0000000000000000(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 [ 186.007368] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 186.007373] CR2: ffffffffff600400 CR3: 00000001b8489000 CR4: 00000000001406e0 [ 186.007376] Call Trace: [ 186.007378] [ 186.007382] ? kvm_clock_get_cycles+0x18/0x30 [ 186.007386] ktime_get+0x248/0x440 [ 186.007389] ? ktime_get_raw_ts64+0x4f0/0x4f0 [ 186.007393] ? trace_hardirqs_off+0xb8/0x2b0 [ 186.007396] ? irq_exit+0x210/0x210 [ 186.007400] ? sched_ttwu_pending+0x8e/0x280 [ 186.007403] ? task_prio+0x50/0x50 [ 186.007407] tick_nohz_irq_exit+0x7e/0x100 [ 186.007410] irq_exit+0x1c0/0x210 [ 186.007413] scheduler_ipi+0x53c/0xa50 [ 186.007417] ? migration_cpu_stop+0x470/0x470 [ 186.007420] ? rcu_nmi_exit+0x259/0x2d0 [ 186.007424] ? rcu_idle_enter+0x480/0x480 [ 186.007428] ? kvm_sched_clock_read+0x18/0x30 [ 186.007431] ? sched_clock+0x31/0x40 [ 186.007434] ? sched_clock_cpu+0x1b/0x170 [ 186.007438] ? task_prio+0x50/0x50 [ 186.007442] smp_reschedule_interrupt+0xfd/0x5e0 [ 186.007445] ? smp_thermal_interrupt+0x710/0x710 [ 186.007449] ? interrupt_entry+0xb5/0xf0 [ 186.007453] ? trace_hardirqs_off_caller+0xbb/0x2b0 [ 186.007457] ? trace_hardirqs_off_caller+0xbb/0x2b0 [ 186.007461] ? trace_hardirqs_off+0xb8/0x2b0 [ 186.007465] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 186.007470] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 186.007474] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 186.007477] ? task_prio+0x50/0x50 [ 186.007481] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 186.007486] reschedule_interrupt+0xf/0x20 [ 186.007489] [ 186.007493] RIP: 0010:native_safe_halt+0x6/0x10 [ 186.007504] Code: c7 48 89 45 d8 e8 ca 7a e5 fa 48 8b 45 d8 e9 d2 fe ff ff 48 89 df e8 b9 7a e5 fa eb 8a 90 90 90 90 90 90 90 55 48 89 e5 fb f4 <5d> c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 f4 5d c3 90 90 90 90 90 [ 186.007508] RSP: 0018:ffff8801d9f1fc30 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff02 [ 186.007517] RAX: dffffc0000000000 RBX: 1ffff1003b3e3f8a RCX: 0000000000000000 [ 186.007522] RDX: 1ffffffff10237d8 RSI: 0000000000000001 RDI: ffffffff8811bec0 [ 186.007527] RBP: ffff8801d9f1fc30 R08: ffff8801d9f0e380 R09: 0000000000000000 [ 186.007532] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 186.007537] R13: ffff8801d9f1fcf0 R14: 0000000000000001 R15: 0000000000000000 [ 186.007541] default_idle+0xc2/0x410 [ 186.007545] ? kasan_check_write+0x14/0x20 [ 186.007548] ? __sched_text_end+0x1/0x1 [ 186.007552] ? rcu_idle_enter+0x30a/0x480 [ 186.007556] ? rcu_eqs_special_set+0x1b0/0x1b0 [ 186.007560] ? tsc_verify_tsc_adjust+0x109/0x380 [ 186.007564] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 186.007568] ? mark_tsc_async_resets+0x20/0x20 [ 186.007572] ? trace_hardirqs_on+0x2c0/0x2c0 [ 186.007576] ? __tick_nohz_idle_restart_tick+0x28c/0x3c0 [ 186.007580] arch_cpu_idle+0x10/0x20 [ 186.007584] default_idle_call+0x6d/0x90 [ 186.007587] do_idle+0x3aa/0x580 [ 186.007590] ? retint_kernel+0x10/0x10 [ 186.007594] ? arch_cpu_idle_exit+0x70/0x70 [ 186.007598] cpu_startup_entry+0x10c/0x120 [ 186.007601] ? cpu_in_idle+0x20/0x20 [ 186.007605] start_secondary+0x433/0x5d0 [ 186.007609] ? set_cpu_sibling_map+0x18b0/0x18b0 [ 186.007613] secondary_startup_64+0xa4/0xb0 [ 186.007633] Kernel panic - not syncing: hung_task: blocked tasks [ 186.405685] CPU: 0 PID: 757 Comm: khungtaskd Not tainted 4.19.0-rc2-next-20180905+ #58 [ 186.413737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 186.423084] Call Trace: [ 186.425700] dump_stack+0x1c9/0x2b4 [ 186.429376] ? dump_stack_print_info.cold.2+0x52/0x52 [ 186.434612] ? printk_safe_log_store+0x2f0/0x2f0 [ 186.439380] panic+0x238/0x4e7 [ 186.442585] ? add_taint.cold.5+0x16/0x16 [ 186.446742] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 186.452294] ? nmi_trigger_cpumask_backtrace+0x18c/0x1cd [ 186.457775] ? printk_safe_flush+0xd7/0x130 [ 186.462105] watchdog+0xb4a/0x1040 [ 186.465686] ? reset_hung_task_detector+0xd0/0xd0 [ 186.470544] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 186.475654] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 186.480768] ? lockdep_hardirqs_on+0x421/0x5c0 [ 186.485358] ? trace_hardirqs_on+0xbd/0x2c0 [ 186.489687] ? kasan_check_read+0x11/0x20 [ 186.493859] ? __kthread_parkme+0xd7/0x1b0 [ 186.498103] ? kasan_check_write+0x14/0x20 [ 186.502352] ? do_raw_spin_lock+0xc1/0x200 [ 186.506601] ? __kthread_parkme+0x58/0x1b0 [ 186.510852] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 186.516403] ? __kthread_parkme+0x106/0x1b0 [ 186.520743] kthread+0x35a/0x420 [ 186.524118] ? reset_hung_task_detector+0xd0/0xd0 [ 186.528997] ? kthread_bind+0x40/0x40 [ 186.532837] ret_from_fork+0x3a/0x50 [ 186.537029] Dumping ftrace buffer: [ 186.540600] (ftrace buffer empty) [ 186.544294] Kernel Offset: disabled [ 186.547999] Rebooting in 86400 seconds..