[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.017552] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.320066] random: sshd: uninitialized urandom read (32 bytes read) [ 24.703256] random: sshd: uninitialized urandom read (32 bytes read) [ 25.564885] random: sshd: uninitialized urandom read (32 bytes read) [ 25.718643] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.40' (ECDSA) to the list of known hosts. [ 31.164796] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program [ 31.256227] ================================================================== [ 31.263688] BUG: KASAN: slab-out-of-bounds in pdu_read+0x90/0xd0 [ 31.269837] Read of size 61112 at addr ffff8801af3785ad by task syz-executor942/4536 [ 31.277701] [ 31.279328] CPU: 1 PID: 4536 Comm: syz-executor942 Not tainted 4.18.0-rc4+ #139 [ 31.286774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.296122] Call Trace: [ 31.298719] dump_stack+0x1c9/0x2b4 [ 31.302332] ? dump_stack_print_info.cold.2+0x52/0x52 [ 31.307511] ? printk+0xa7/0xcf [ 31.310775] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 31.315523] ? pdu_read+0x90/0xd0 [ 31.318976] print_address_description+0x6c/0x20b [ 31.323811] ? pdu_read+0x90/0xd0 [ 31.327244] kasan_report.cold.7+0x242/0x2fe [ 31.331636] check_memory_region+0x13e/0x1b0 [ 31.336037] memcpy+0x23/0x50 [ 31.339140] pdu_read+0x90/0xd0 [ 31.342403] p9pdu_readf+0x579/0x2170 [ 31.346196] ? p9pdu_writef+0xe0/0xe0 [ 31.349981] ? __fget+0x414/0x670 [ 31.353439] ? rcu_is_watching+0x61/0x150 [ 31.357574] ? expand_files.part.8+0x9c0/0x9c0 [ 31.362157] ? rcu_read_lock_sched_held+0x108/0x120 [ 31.367175] ? p9_fd_show_options+0x1c0/0x1c0 [ 31.371666] p9_client_create+0xde0/0x16c9 [ 31.375899] ? p9_client_read+0xc60/0xc60 [ 31.380044] ? find_held_lock+0x36/0x1c0 [ 31.384107] ? __lockdep_init_map+0x105/0x590 [ 31.388603] ? kasan_check_write+0x14/0x20 [ 31.392831] ? __init_rwsem+0x1cc/0x2a0 [ 31.396791] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 31.401808] ? rcu_read_lock_sched_held+0x108/0x120 [ 31.406817] ? __kmalloc_track_caller+0x5f5/0x760 [ 31.411654] ? save_stack+0xa9/0xd0 [ 31.415269] ? save_stack+0x43/0xd0 [ 31.418879] ? kasan_kmalloc+0xc4/0xe0 [ 31.422748] ? kmem_cache_alloc_trace+0x152/0x780 [ 31.427576] ? memcpy+0x45/0x50 [ 31.430842] v9fs_session_init+0x21a/0x1a80 [ 31.435148] ? find_held_lock+0x36/0x1c0 [ 31.439197] ? v9fs_show_options+0x7e0/0x7e0 [ 31.443591] ? kasan_check_read+0x11/0x20 [ 31.447718] ? rcu_is_watching+0x8c/0x150 [ 31.451856] ? rcu_pm_notify+0xc0/0xc0 [ 31.455738] ? v9fs_mount+0x61/0x900 [ 31.459434] ? rcu_read_lock_sched_held+0x108/0x120 [ 31.464440] ? kmem_cache_alloc_trace+0x616/0x780 [ 31.469272] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 31.474800] v9fs_mount+0x7c/0x900 [ 31.478342] mount_fs+0xae/0x328 [ 31.481694] vfs_kern_mount.part.34+0xdc/0x4e0 [ 31.486285] ? may_umount+0xb0/0xb0 [ 31.489907] ? _raw_read_unlock+0x22/0x30 [ 31.494060] ? __get_fs_type+0x97/0xc0 [ 31.497949] do_mount+0x581/0x30e0 [ 31.501488] ? copy_mount_string+0x40/0x40 [ 31.505715] ? copy_mount_options+0x5f/0x380 [ 31.510122] ? rcu_read_lock_sched_held+0x108/0x120 [ 31.515128] ? kmem_cache_alloc_trace+0x616/0x780 [ 31.519971] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.525506] ? copy_mount_options+0x285/0x380 [ 31.529986] ksys_mount+0x12d/0x140 [ 31.533608] __x64_sys_mount+0xbe/0x150 [ 31.537568] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 31.542569] do_syscall_64+0x1b9/0x820 [ 31.546453] ? syscall_return_slowpath+0x5e0/0x5e0 [ 31.551364] ? syscall_return_slowpath+0x31d/0x5e0 [ 31.556282] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 31.561644] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.566496] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.571675] RIP: 0033:0x440179 [ 31.574843] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 31.594093] RSP: 002b:00007ffcab89bb18 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 31.601880] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000440179 [ 31.609133] RDX: 0000000020000080 RSI: 0000000020000000 RDI: 0000000000000000 [ 31.616398] RBP: 0030656c69662f2e R08: 0000000020000340 R09: 00000000004002c8 [ 31.623660] R10: 0000000000000000 R11: 0000000000000206 R12: 64663d736e617274 [ 31.630920] R13: 0000000000401a90 R14: 0000000000000000 R15: 0000000000000000 [ 31.638184] [ 31.639797] Allocated by task 4536: [ 31.643430] save_stack+0x43/0xd0 [ 31.646876] kasan_kmalloc+0xc4/0xe0 [ 31.650584] __kmalloc+0x14e/0x760 [ 31.654115] p9_fcall_alloc+0x1e/0x90 [ 31.657909] p9_client_prepare_req.part.8+0x754/0xcd0 [ 31.663096] p9_client_rpc+0x1bd/0x1400 [ 31.667072] p9_client_create+0xd09/0x16c9 [ 31.671301] v9fs_session_init+0x21a/0x1a80 [ 31.675610] v9fs_mount+0x7c/0x900 [ 31.679134] mount_fs+0xae/0x328 [ 31.682484] vfs_kern_mount.part.34+0xdc/0x4e0 [ 31.687059] do_mount+0x581/0x30e0 [ 31.690600] ksys_mount+0x12d/0x140 [ 31.694207] __x64_sys_mount+0xbe/0x150 [ 31.698164] do_syscall_64+0x1b9/0x820 [ 31.702049] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.707219] [ 31.708826] Freed by task 0: [ 31.711818] (stack is not available) [ 31.715506] [ 31.717118] The buggy address belongs to the object at ffff8801af378580 [ 31.717118] which belongs to the cache kmalloc-16384 of size 16384 [ 31.730116] The buggy address is located 45 bytes inside of [ 31.730116] 16384-byte region [ffff8801af378580, ffff8801af37c580) [ 31.742060] The buggy address belongs to the page: [ 31.746990] page:ffffea0006bcde00 count:1 mapcount:0 mapping:ffff8801da802200 index:0x0 compound_mapcount: 0 [ 31.756958] flags: 0x2fffc0000008100(slab|head) [ 31.761616] raw: 02fffc0000008100 ffffea0006bb5808 ffff8801da801c48 ffff8801da802200 [ 31.769496] raw: 0000000000000000 ffff8801af378580 0000000100000001 0000000000000000 [ 31.777362] page dumped because: kasan: bad access detected [ 31.783061] [ 31.784684] Memory state around the buggy address: [ 31.789609] ffff8801af37a480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.796967] ffff8801af37a500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.804320] >ffff8801af37a580: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 31.811658] ^ [ 31.816052] ffff8801af37a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.823396] ffff8801af37a680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.830732] ================================================================== [ 31.838082] Disabling lock debugging due to kernel taint [ 31.843597] Kernel panic - not syncing: panic_on_warn set ... [ 31.843597] [ 31.850967] CPU: 1 PID: 4536 Comm: syz-executor942 Tainted: G B 4.18.0-rc4+ #139 [ 31.859801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.869142] Call Trace: [ 31.871714] dump_stack+0x1c9/0x2b4 [ 31.875341] ? dump_stack_print_info.cold.2+0x52/0x52 [ 31.880514] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 31.885256] panic+0x238/0x4e7 [ 31.888438] ? add_taint.cold.5+0x16/0x16 [ 31.892573] ? do_raw_spin_unlock+0xa7/0x2f0 [ 31.896973] ? pdu_read+0x90/0xd0 [ 31.900419] kasan_end_report+0x47/0x4f [ 31.904374] kasan_report.cold.7+0x76/0x2fe [ 31.908685] check_memory_region+0x13e/0x1b0 [ 31.913090] memcpy+0x23/0x50 [ 31.916189] pdu_read+0x90/0xd0 [ 31.919458] p9pdu_readf+0x579/0x2170 [ 31.923239] ? p9pdu_writef+0xe0/0xe0 [ 31.927055] ? __fget+0x414/0x670 [ 31.930490] ? rcu_is_watching+0x61/0x150 [ 31.934619] ? expand_files.part.8+0x9c0/0x9c0 [ 31.939206] ? rcu_read_lock_sched_held+0x108/0x120 [ 31.944209] ? p9_fd_show_options+0x1c0/0x1c0 [ 31.948698] p9_client_create+0xde0/0x16c9 [ 31.952924] ? p9_client_read+0xc60/0xc60 [ 31.957051] ? find_held_lock+0x36/0x1c0 [ 31.961098] ? __lockdep_init_map+0x105/0x590 [ 31.965576] ? kasan_check_write+0x14/0x20 [ 31.969792] ? __init_rwsem+0x1cc/0x2a0 [ 31.973755] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 31.978753] ? rcu_read_lock_sched_held+0x108/0x120 [ 31.983755] ? __kmalloc_track_caller+0x5f5/0x760 [ 31.988590] ? save_stack+0xa9/0xd0 [ 31.992214] ? save_stack+0x43/0xd0 [ 31.995824] ? kasan_kmalloc+0xc4/0xe0 [ 31.999704] ? kmem_cache_alloc_trace+0x152/0x780 [ 32.004541] ? memcpy+0x45/0x50 [ 32.007808] v9fs_session_init+0x21a/0x1a80 [ 32.012114] ? find_held_lock+0x36/0x1c0 [ 32.016173] ? v9fs_show_options+0x7e0/0x7e0 [ 32.020573] ? kasan_check_read+0x11/0x20 [ 32.024712] ? rcu_is_watching+0x8c/0x150 [ 32.028859] ? rcu_pm_notify+0xc0/0xc0 [ 32.032731] ? v9fs_mount+0x61/0x900 [ 32.036768] ? rcu_read_lock_sched_held+0x108/0x120 [ 32.041775] ? kmem_cache_alloc_trace+0x616/0x780 [ 32.046607] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 32.052135] v9fs_mount+0x7c/0x900 [ 32.055660] mount_fs+0xae/0x328 [ 32.059020] vfs_kern_mount.part.34+0xdc/0x4e0 [ 32.063592] ? may_umount+0xb0/0xb0 [ 32.067211] ? _raw_read_unlock+0x22/0x30 [ 32.071348] ? __get_fs_type+0x97/0xc0 [ 32.075223] do_mount+0x581/0x30e0 [ 32.079406] ? copy_mount_string+0x40/0x40 [ 32.083630] ? copy_mount_options+0x5f/0x380 [ 32.088030] ? rcu_read_lock_sched_held+0x108/0x120 [ 32.093043] ? kmem_cache_alloc_trace+0x616/0x780 [ 32.097876] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 32.103396] ? copy_mount_options+0x285/0x380 [ 32.107876] ksys_mount+0x12d/0x140 [ 32.111488] __x64_sys_mount+0xbe/0x150 [ 32.115456] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 32.120460] do_syscall_64+0x1b9/0x820 [ 32.124336] ? syscall_return_slowpath+0x5e0/0x5e0 [ 32.129246] ? syscall_return_slowpath+0x31d/0x5e0 [ 32.134169] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 32.139516] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 32.144348] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 32.149525] RIP: 0033:0x440179 [ 32.152698] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 32.171824] RSP: 002b:00007ffcab89bb18 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 32.179513] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000440179 [ 32.186768] RDX: 0000000020000080 RSI: 0000000020000000 RDI: 0000000000000000 [ 32.194109] RBP: 0030656c69662f2e R08: 0000000020000340 R09: 00000000004002c8 [ 32.201367] R10: 0000000000000000 R11: 0000000000000206 R12: 64663d736e617274 [ 32.208626] R13: 0000000000401a90 R14: 0000000000000000 R15: 0000000000000000 [ 32.216374] Dumping ftrace buffer: [ 32.219891] (ftrace buffer empty) [ 32.223583] Kernel Offset: disabled [ 32.227189] Rebooting in 86400 seconds..