[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 13.068103] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 16.652372] random: sshd: uninitialized urandom read (32 bytes read) [ 16.881072] random: sshd: uninitialized urandom read (32 bytes read) [ 17.388910] random: sshd: uninitialized urandom read (32 bytes read) [ 30.726389] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.62' (ECDSA) to the list of known hosts. [ 36.223956] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 36.303355] ================================================================== [ 36.310828] BUG: KASAN: double-free or invalid-free in p9stat_free+0x35/0x100 [ 36.318075] [ 36.319756] CPU: 1 PID: 3808 Comm: syz-executor747 Not tainted 4.9.124-g09eb2ba #31 [ 36.327567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.336901] ffff8801d906fa90 ffffffff81eb95e9 ffffea00071f7f40 ffff8801c7dfdc00 [ 36.344886] ffff8801da001c80 ffffffff839c4e35 0000000000000282 ffff8801d906fac8 [ 36.352885] ffffffff8156c35e ffff8801c7dfdc00 ffffffff839c4e35 ffff8801da001c80 [ 36.360869] Call Trace: [ 36.363433] [] dump_stack+0xc1/0x128 [ 36.368770] [] ? p9stat_free+0x35/0x100 [ 36.374369] [] print_address_description+0x6c/0x234 [ 36.381006] [] ? p9stat_free+0x35/0x100 [ 36.386601] [] ? p9stat_free+0x35/0x100 [ 36.392229] [] kasan_report_double_free+0x64/0xa0 [ 36.398702] [] kasan_slab_free+0xa4/0xc0 [ 36.404402] [] kfree+0xfb/0x310 [ 36.409312] [] p9stat_free+0x35/0x100 [ 36.414742] [] v9fs_dir_readdir+0x49e/0x820 [ 36.420688] [] ? v9fs_dir_release+0x60/0x60 [ 36.426633] [] ? trace_hardirqs_on+0x10/0x10 [ 36.432664] [] ? fsnotify+0x114/0x1100 [ 36.438174] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 36.445075] [] iterate_dir+0x1ac/0x600 [ 36.450639] [] SyS_getdents+0x13c/0x2a0 [ 36.456242] [] ? SyS_old_readdir+0x150/0x150 [ 36.462272] [] ? fillonedir+0x270/0x270 [ 36.467872] [] ? do_syscall_64+0x48/0x490 [ 36.473642] [] ? SyS_old_readdir+0x150/0x150 [ 36.479671] [] do_syscall_64+0x1a6/0x490 [ 36.485358] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 36.492273] [ 36.493878] Allocated by task 3808: [ 36.497479] save_stack_trace+0x16/0x20 [ 36.501439] save_stack+0x43/0xd0 [ 36.504909] kasan_kmalloc+0xc7/0xe0 [ 36.508605] __kmalloc+0x11d/0x300 [ 36.512120] p9pdu_readf+0x483/0x1d50 [ 36.515893] p9pdu_readf+0xefc/0x1d50 [ 36.519668] p9stat_read+0xda/0x400 [ 36.523318] v9fs_dir_readdir+0x475/0x820 [ 36.527456] iterate_dir+0x1ac/0x600 [ 36.531151] SyS_getdents+0x13c/0x2a0 [ 36.534929] do_syscall_64+0x1a6/0x490 [ 36.538798] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 36.543868] [ 36.545467] Freed by task 3808: [ 36.548720] save_stack_trace+0x16/0x20 [ 36.552664] save_stack+0x43/0xd0 [ 36.556092] kasan_slab_free+0x72/0xc0 [ 36.559961] kfree+0xfb/0x310 [ 36.563045] p9stat_free+0x35/0x100 [ 36.566646] p9pdu_readf+0xf14/0x1d50 [ 36.570445] p9stat_read+0xda/0x400 [ 36.574046] v9fs_dir_readdir+0x475/0x820 [ 36.578177] iterate_dir+0x1ac/0x600 [ 36.581875] SyS_getdents+0x13c/0x2a0 [ 36.585656] do_syscall_64+0x1a6/0x490 [ 36.589524] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 36.594602] [ 36.596208] The buggy address belongs to the object at ffff8801c7dfdc00 [ 36.596208] which belongs to the cache kmalloc-8 of size 8 [ 36.608489] The buggy address is located 0 bytes inside of [ 36.608489] 8-byte region [ffff8801c7dfdc00, ffff8801c7dfdc08) [ 36.619996] The buggy address belongs to the page: [ 36.624905] page:ffffea00071f7f40 count:1 mapcount:0 mapping: (null) index:0x0 [ 36.633142] flags: 0x8000000000000080(slab) [ 36.637438] page dumped because: kasan: bad access detected [ 36.643121] [ 36.644821] Memory state around the buggy address: [ 36.649733] ffff8801c7dfdb00: fc fc 00 fc fc 00 fc fc 00 fc fc 00 fc fc 00 fc [ 36.657067] ffff8801c7dfdb80: fc fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc [ 36.664397] >ffff8801c7dfdc00: fb fc fc fb fc fc fb fc fc fb fc fc 00 fc fc 00 [ 36.671726] ^ [ 36.675068] ffff8801c7dfdc80: fc fc 00 fc fc 00 fc fc fb fc fc 00 fc fc 00 fc [ 36.682412] ffff8801c7dfdd00: fc fb fc fc fb fc fc 00 fc fc 00 fc fc 00 fc fc [ 36.689755] ================================================================== [ 36.697085] Disabling lock debugging due to kernel taint [ 36.704071] Kernel panic - not syncing: panic_on_warn set ... [ 36.704071] [ 36.711431] CPU: 1 PID: 3808 Comm: syz-executor747 Tainted: G B 4.9.124-g09eb2ba #31 [ 36.720430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.729757] ffff8801d906f9f0 ffffffff81eb95e9 ffffffff843c828b 00000000ffffffff [ 36.737755] ffff8801da001c00 0000000000000001 0000000000000282 ffff8801d906fab0 [ 36.745760] ffffffff81423eb5 0000000041b58ab3 ffffffff843bb8e8 ffffffff81423cf6 [ 36.753747] Call Trace: [ 36.756313] [] dump_stack+0xc1/0x128 [ 36.761654] [] panic+0x1bf/0x3bc [ 36.766643] [] ? add_taint.cold.6+0x16/0x16 [ 36.772661] [] ? ___preempt_schedule+0x16/0x18 [ 36.778875] [] ? p9stat_free+0x35/0x100 [ 36.784469] [] ? p9stat_free+0x35/0x100 [ 36.790066] [] kasan_end_report+0x47/0x4f [ 36.795842] [] kasan_report_double_free+0x81/0xa0 [ 36.802308] [] kasan_slab_free+0xa4/0xc0 [ 36.807994] [] kfree+0xfb/0x310 [ 36.812899] [] p9stat_free+0x35/0x100 [ 36.818321] [] v9fs_dir_readdir+0x49e/0x820 [ 36.824265] [] ? v9fs_dir_release+0x60/0x60 [ 36.830211] [] ? trace_hardirqs_on+0x10/0x10 [ 36.836250] [] ? fsnotify+0x114/0x1100 [ 36.841764] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 36.848759] [] iterate_dir+0x1ac/0x600 [ 36.854277] [] SyS_getdents+0x13c/0x2a0 [ 36.859876] [] ? SyS_old_readdir+0x150/0x150 [ 36.865909] [] ? fillonedir+0x270/0x270 [ 36.871507] [] ? do_syscall_64+0x48/0x490 [ 36.877277] [] ? SyS_old_readdir+0x150/0x150 [ 36.883306] [] do_syscall_64+0x1a6/0x490 [ 36.888992] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 36.896256] Dumping ftrace buffer: [ 36.899773] (ftrace buffer empty) [ 36.903511] Kernel Offset: disabled [ 36.907121] Rebooting in 86400 seconds..