[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 21.166473] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 26.803197] random: sshd: uninitialized urandom read (32 bytes read, 40 bits of entropy available) [ 27.248966] random: sshd: uninitialized urandom read (32 bytes read, 40 bits of entropy available) [ 27.907814] random: sshd: uninitialized urandom read (32 bytes read, 68 bits of entropy available) [ 60.291080] random: sshd: uninitialized urandom read (32 bytes read, 83 bits of entropy available) Warning: Permanently added '10.128.0.45' (ECDSA) to the list of known hosts. [ 65.847038] random: sshd: uninitialized urandom read (32 bytes read, 85 bits of entropy available) 2018/08/07 08:03:14 parsed 1 programs [ 67.356430] random: cc1: uninitialized urandom read (8 bytes read, 87 bits of entropy available) 2018/08/07 08:03:16 executed programs: 0 [ 68.606300] IPVS: Creating netns size=2552 id=1 [ 68.672609] IPVS: Creating netns size=2552 id=2 [ 68.732855] IPVS: Creating netns size=2552 id=3 [ 68.783050] IPVS: Creating netns size=2552 id=4 [ 68.850180] IPVS: Creating netns size=2552 id=5 [ 68.942995] IPVS: Creating netns size=2552 id=6 [ 69.063236] IPVS: Creating netns size=2552 id=7 [ 69.145979] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 69.182150] IPVS: Creating netns size=2552 id=8 [ 69.200246] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 69.301488] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 69.352041] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 69.552673] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 69.612676] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 69.685918] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 69.706137] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 69.743264] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 69.753085] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 69.779126] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 69.809630] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 69.832795] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 69.871571] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 69.937679] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 69.966489] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 69.975129] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 70.021574] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.058939] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 70.090646] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 70.121529] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 70.147760] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 70.155701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.165170] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 70.187417] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 70.201754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.216275] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 70.247218] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 70.290513] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 70.313546] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.358186] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 70.401978] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 70.452358] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 70.460651] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 70.524514] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 70.539465] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 70.553089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.569023] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 70.600843] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 70.610872] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 70.618840] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.635118] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 70.663881] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 70.674295] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 70.717000] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.752076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.794549] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.808931] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 70.828197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.843555] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 70.878648] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 70.947366] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 71.107264] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 71.175822] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 71.250692] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.315598] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.354279] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 71.433622] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 71.453020] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 71.552176] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 71.594084] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.637178] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.652378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.683177] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 74.919463] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 74.943989] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 75.153606] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.186969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.334597] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 75.607373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.697649] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 75.713755] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 75.928704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.999311] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.238089] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 76.263443] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 76.373961] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 76.487364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.502671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.655576] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/08/07 08:03:24 executed programs: 8 [ 80.522046] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 [ 80.580217] ================================================================== [ 80.587602] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 80.594872] Read of size 4 at addr ffff8801ceec3b80 by task syz-executor5/7214 [ 80.602218] [ 80.603844] CPU: 1 PID: 7214 Comm: syz-executor5 Not tainted 4.4.146-g1396226 #15 [ 80.611453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 80.620800] 0000000000000000 03fb76c3fa008e9a ffff8801c6f4fc78 ffffffff81e1292d [ 80.628853] ffffea00073bb080 ffff8801ceec3b80 0000000000000000 ffff8801ceec3b80 [ 80.636906] ffffffff82f1f7c0 ffff8801c6f4fcb0 ffffffff81517f76 ffff8801ceec3b80 [ 80.644954] Call Trace: [ 80.647536] [] dump_stack+0xc1/0x124 [ 80.652893] [] ? sock_release+0x1c0/0x1c0 [ 80.658688] [] print_address_description+0x6c/0x216 [ 80.665341] [] ? sock_release+0x1c0/0x1c0 [ 80.671126] [] kasan_report.cold.7+0x175/0x2f7 [ 80.677354] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 80.684101] [] __asan_report_load4_noabort+0x14/0x20 [ 80.690846] [] l2tp_session_queue_purge+0xf4/0x100 [ 80.697415] [] ? sock_release+0x1c0/0x1c0 [ 80.703204] [] pppol2tp_release+0x1ff/0x310 [ 80.709171] [] sock_release+0x96/0x1c0 [ 80.714701] [] sock_close+0x16/0x20 [ 80.719971] [] __fput+0x235/0x6f0 [ 80.725092] [] ____fput+0x15/0x20 [ 80.730191] [] task_work_run+0x10f/0x190 [ 80.735896] [] exit_to_usermode_loop+0x13d/0x160 [ 80.742298] [] do_fast_syscall_32+0x61e/0x8b0 [ 80.748445] [] sysenter_flags_fixed+0xd/0x1a [ 80.754477] [ 80.756080] Allocated by task 7226: [ 80.759681] [] save_stack_trace+0x26/0x50 [ 80.765593] [] save_stack+0x43/0xd0 [ 80.770982] [] kasan_kmalloc+0xc7/0xe0 [ 80.776638] [] __kmalloc+0x124/0x310 [ 80.782131] [] l2tp_session_create+0x39/0x1030 [ 80.788488] [] pppol2tp_connect+0x10f0/0x1910 [ 80.794744] [] SYSC_connect+0x1b8/0x300 [ 80.800483] [] SyS_connect+0x24/0x30 [ 80.805962] [] do_fast_syscall_32+0x324/0x8b0 [ 80.812214] [] sysenter_flags_fixed+0xd/0x1a [ 80.818389] [ 80.819994] Freed by task 7236: [ 80.823246] [] save_stack_trace+0x26/0x50 [ 80.829154] [] save_stack+0x43/0xd0 [ 80.834539] [] kasan_slab_free+0x72/0xc0 [ 80.840370] [] kfree+0xf4/0x310 [ 80.845413] [] l2tp_session_free+0x170/0x200 [ 80.851577] [] l2tp_tunnel_closeall+0x2b9/0x350 [ 80.858003] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 80.864454] [] udpv6_destroy_sock+0xb1/0xd0 [ 80.870527] [] sk_common_release+0x6d/0x300 [ 80.876610] [] udp_lib_close+0x15/0x20 [ 80.882245] [] inet_release+0xff/0x1d0 [ 80.887883] [] inet6_release+0x50/0x70 [ 80.893589] [] sock_release+0x96/0x1c0 [ 80.899228] [] sock_close+0x16/0x20 [ 80.904606] [] __fput+0x235/0x6f0 [ 80.909823] [] ____fput+0x15/0x20 [ 80.915031] [] task_work_run+0x10f/0x190 [ 80.920842] [] exit_to_usermode_loop+0x13d/0x160 [ 80.927350] [] do_fast_syscall_32+0x61e/0x8b0 [ 80.933608] [] sysenter_flags_fixed+0xd/0x1a [ 80.939771] [ 80.941377] The buggy address belongs to the object at ffff8801ceec3b80 [ 80.941377] which belongs to the cache kmalloc-512 of size 512 [ 80.954011] The buggy address is located 0 bytes inside of [ 80.954011] 512-byte region [ffff8801ceec3b80, ffff8801ceec3d80) [ 80.965686] The buggy address belongs to the page: [ 80.971146] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) [ 80.971952] page:ffffea00073bb080 count:1 mapcount:786445 mapping: (null) index:0x0 [ 80.971982] flags: 0xffff8801c75ffd29(locked|uptodate|lru|owner_priv_1|reserved|private|private_2|writeback|head|swapcache|mappedtodisk|reclaim|swapbacked|unevictable|mlocked|compound_lock) [ 80.971985] page dumped because: VM_BUG_ON_PAGE(PageSlab(page)) [ 81.010327] BUG: unable to handle kernel paging request at ffff8801ceec3d80 [ 81.017666] IP: [] 0xffff8801ceec3d80 [ 81.023145] PGD 6330067 PUD 80000001c00001e3 [ 81.027880] Oops: 0011 [#1] PREEMPT SMP KASAN [ 81.032876] Dumping ftrace buffer: [ 81.036410] (ftrace buffer empty) [ 81.040105] Modules linked in: [ 81.043411] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.146-g1396226 #15 [ 81.050405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 81.059746] task: ffffffff84417840 task.stack: ffffffff84400000 [ 81.065787] RIP: 0010:[] [] 0xffff8801ceec3d80 [ 81.073708] RSP: 0018:ffff8801db207db0 EFLAGS: 00010006 [ 81.079140] RAX: ffffffff84417840 RBX: ffff8801c6f47d28 RCX: 0000000000000000 [ 81.086396] RDX: 0000000000010000 RSI: ffffffff812a0005 RDI: ffff8801c6f47d28 [ 81.093651] RBP: ffff8801db207ee0 R08: ffffffff85356280 R09: 0000000000000001 [ 81.100906] R10: 0000000000000000 R11: ffffffff84417840 R12: ffff8801ceec3d80 [ 81.108161] R13: ffff8801db2196c0 R14: dffffc0000000000 R15: 0000000000000000 [ 81.115418] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 81.123629] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 81.129493] CR2: ffff8801ceec3d80 CR3: 00000000b1b8a000 CR4: 00000000001606f0 [ 81.136754] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 81.144013] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 81.151266] Stack: [ 81.153398] ffffffff812a000d 0000000000000046 ffff8801db207e78 ffffffff84417840 [ 81.161486] 1ffff1003b640fc3 ffff8801db219720 ffffed003b640fcf 0000000000000001 [ 81.169511] ffff8801db219780 0303880200000001 ffff8801db2196f8 ffff8801db219798 [ 81.177537] Call Trace: [ 81.180101] [ 81.182156] [] ? __hrtimer_run_queues+0x3ad/0x1000 [ 81.189051] [] ? retrigger_next_event+0x1c0/0x1c0 [ 81.195529] [] ? kvm_clock_read+0x23/0x40 [ 81.201316] [] ? kvm_clock_get_cycles+0x9/0x10 [ 81.207535] [] ? hrtimer_interrupt+0x12d/0x430 [ 81.213754] [] hrtimer_interrupt+0x1b1/0x430 [ 81.219798] [] local_apic_timer_interrupt+0x74/0xa0 [ 81.226454] [] smp_apic_timer_interrupt+0x7c/0xa0 [ 81.232931] [] apic_timer_interrupt+0xa0/0xb0 [ 81.239057] [ 81.241109] [] ? native_safe_halt+0x6/0x10 [ 81.247276] [] ? trace_hardirqs_on+0xd/0x10 [ 81.253231] [] default_idle+0x55/0x3c0 [ 81.258756] [] arch_cpu_idle+0x10/0x20 [ 81.264276] [] default_idle_call+0x57/0x70 [ 81.270144] [] cpu_startup_entry+0x6af/0x780 [ 81.276184] [] ? call_cpuidle+0xe0/0xe0 [ 81.281797] [] rest_init+0x188/0x18e [ 81.287153] [] start_kernel+0x6b3/0x6e7 [ 81.292764] [] ? thread_stack_cache_init+0xb/0xb [ 81.299153] [] ? early_idt_handler_array+0x120/0x120 [ 81.305889] [] ? early_idt_handler_array+0x120/0x120 [ 81.312628] [] x86_64_start_reservations+0x29/0x2b [ 81.319197] [] x86_64_start_kernel+0x13f/0x162 [ 81.325407] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <3a> 1c 00 00 50 01 e0 ec 44 1c 00 00 52 01 e0 82 00 00 00 00 00 [ 81.352736] RIP [] 0xffff8801ceec3d80 [ 81.358305] RSP [ 81.361914] CR2: ffff8801ceec3d80 [ 81.365351] ---[ end trace acf410420ebc8b3b ]--- [ 81.365359] ------------[ cut here ]------------ [ 81.365363] kernel BUG at include/linux/mm.h:464! [ 81.365371] invalid opcode: 0000 [#2] PREEMPT SMP KASAN [ 81.365378] Dumping ftrace buffer: [ 81.365381] (ftrace buffer empty) [ 81.365385] Modules linked in: [ 81.365394] CPU: 1 PID: 7214 Comm: syz-executor5 Tainted: G D 4.4.146-g1396226 #15 [ 81.365397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 81.365402] task: ffff8800bb8c1800 task.stack: ffff8801c6f48000 [ 81.365419] RIP: 0010:[] [] dump_page_badflags+0x57/0x70 [ 81.365424] RSP: 0018:ffff8801c6c00028 EFLAGS: 00010093 [ 81.365428] RAX: 0000000000000000 RBX: ffffea00073bb080 RCX: 0000000000000001 [ 81.365432] RDX: 0000000000000000 RSI: ffffffff81515fa9 RDI: ffff8800bb8c20dc [ 81.365436] RBP: ffff8801c6c00058 R08: 0000000000000001 R09: 0000000000000000 [ 81.365441] R10: 0000000000000001 R11: ffffffff858fc15b R12: 0000000000000000 [ 81.365445] R13: ffffffff83aaad60 R14: ffff8801ceec3b80 R15: ffff8801ceec3d80 [ 81.365451] FS: 0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:000000000915b900 [ 81.365456] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 81.365460] CR2: 0000000000625208 CR3: 00000001d2135000 CR4: 00000000001606f0 [ 81.365467] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 81.365471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 81.365472] Stack: [ 81.365481] 0000000000000000 ffffea00073bb080 0000000000000000 ffffffff83aaad60 [ 81.365489] ffff8801ceec3b80 ffff8801ceec3d80 ffff8801c6c00098 ffffffff8148f497 [ 81.365498] 0000000000000000 ffffea00073bb080 0000000000000000 ffffffff83aaad60 [ 81.365500] Call Trace: [ 81.365503] [ 81.365609] Code: 48 c1 ea 03 80 3c 02 00 75 23 48 8b 03 a8 80 0f 84 f6 69 08 00 e8 2a 43 ec ff 31 d2 48 c7 c6 60 ad aa 83 48 89 df e8 a9 ff ff ff <0f> 0b 48 89 df e8 cf c8 06 00 eb d3 0f 1f 00 66 2e 0f 1f 84 00 [ 81.365619] RIP [] dump_page_badflags+0x57/0x70 [ 81.365621] RSP [ 81.365626] ---[ end trace acf410420ebc8b3c ]--- [ 81.365630] Kernel panic - not syncing: Fatal exception [ 82.484692] Shutting down cpus with NMI [ 82.489080] Dumping ftrace buffer: [ 82.492620] (ftrace buffer empty) [ 82.496310] Kernel Offset: disabled [ 82.499911] Rebooting in 86400 seconds..