[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 15.775944] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.039213] random: sshd: uninitialized urandom read (32 bytes read) [ 20.293459] random: sshd: uninitialized urandom read (32 bytes read) [ 20.905112] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.43' (ECDSA) to the list of known hosts. [ 26.442238] random: sshd: uninitialized urandom read (32 bytes read) 2018/08/19 19:12:59 fuzzer started [ 27.691447] random: cc1: uninitialized urandom read (8 bytes read) 2018/08/19 19:13:02 dialing manager at 10.128.0.26:41363 2018/08/19 19:13:04 syscalls: 1 2018/08/19 19:13:04 code coverage: enabled 2018/08/19 19:13:04 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/08/19 19:13:04 setuid sandbox: enabled 2018/08/19 19:13:04 namespace sandbox: enabled 2018/08/19 19:13:04 fault injection: CONFIG_FAULT_INJECTION is not enabled 2018/08/19 19:13:04 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/08/19 19:13:04 net packed injection: enabled 2018/08/19 19:13:04 net device setup: enabled [ 32.998203] random: crng init done 19:13:49 executing program 0: getgid() add_key(&(0x7f0000000140)='cifs.spnego\x00', &(0x7f0000000940), &(0x7f0000000980), 0x0, 0xfffffffffffffffc) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000366000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) listen(r1, 0x0) connect$unix(r0, &(0x7f0000932000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) r2 = accept(r1, 0x0, &(0x7f0000000080)=0x1fd) write$binfmt_script(r2, &(0x7f0000000180)={'#! ', "e91f7189591e9233614b"}, 0x0) 19:13:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) fsetxattr(r0, &(0x7f00000000c0)=@known='security.capability\x00', &(0x7f0000000080)="000000037970652700060045a3107d5a0000000000000000", 0x18, 0x0) 19:13:49 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="8a5c010700315f85715070") r1 = socket(0x800000000000a, 0x80005, 0x0) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000040)={'bridge_slave_0\x00', 0x80}) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000080)={'bridge_slave_0\x00', 0x4340}) 19:13:49 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) connect$l2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x26) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)="2f02726f75702e7374617000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0xc0185879, 0x20000001) 19:13:49 executing program 4: 19:13:49 executing program 3: 19:13:49 executing program 5: 19:13:49 executing program 6: [ 76.581415] IPVS: Creating netns size=2536 id=1 [ 76.629120] IPVS: Creating netns size=2536 id=2 [ 76.671417] IPVS: Creating netns size=2536 id=3 [ 76.722770] IPVS: Creating netns size=2536 id=4 [ 76.770199] IPVS: Creating netns size=2536 id=5 [ 76.831864] IPVS: Creating netns size=2536 id=6 [ 76.901563] IPVS: Creating netns size=2536 id=7 [ 76.989285] IPVS: Creating netns size=2536 id=8 [ 77.308860] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.364261] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.519350] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.528661] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.592518] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.605095] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.643615] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 77.682822] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 77.701260] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.777513] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.808423] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.863160] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.892953] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 77.918502] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 77.959005] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 77.991465] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.006336] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 78.021394] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.051676] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 78.098921] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.126985] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.142542] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.154975] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 78.168474] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 78.182982] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.203232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.216786] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.227059] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 78.239789] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 78.257847] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 78.267607] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.283675] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.295363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.304572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.326199] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.345244] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 78.381128] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 78.409118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.424976] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.433587] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.451866] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.462353] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 78.469954] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.477473] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.506507] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.515117] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.527244] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.550489] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 78.559900] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.589133] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.596883] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.612351] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.625931] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.635669] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.647965] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 78.656076] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.671556] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 78.683472] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.691257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.698817] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.711698] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.732165] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 78.740606] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.752966] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.773397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.782980] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.818208] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 78.842165] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.853324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.870024] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.898667] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 78.924141] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.931748] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.943166] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.965829] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.985330] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 79.024164] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.037383] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.056554] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.066311] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.079955] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.087445] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.100414] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 79.111332] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 79.120022] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.127517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.167019] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 79.190879] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 79.197777] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.214010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.233995] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.248566] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.260115] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.343751] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 79.357813] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.371880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.604004] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 81.755962] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 81.854987] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.873036] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.887212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.894912] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 81.921592] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 82.011350] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 82.017554] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.026818] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.107108] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 82.125923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.133336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.150610] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 82.164941] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.173888] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.248343] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 82.343335] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 82.464972] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 82.481692] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 82.490433] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.497158] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.511389] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 82.671445] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 82.683960] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.692958] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.702967] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 82.714898] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.723821] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.743842] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 82.754823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.774064] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 19:13:56 executing program 0: 19:13:56 executing program 0: 19:13:56 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f00000d9000/0x600000)=nil, 0x600000, 0x8) [ 83.595159] BUG: unable to handle kernel paging request at ffffeafff97d8020 [ 83.603116] IP: [] __split_huge_pmd+0x391/0x1870 [ 83.609983] PGD 0 [ 83.611948] [ 83.613602] Oops: 0000 [#1] PREEMPT SMP KASAN [ 83.618099] Dumping ftrace buffer: [ 83.621637] (ftrace buffer empty) [ 83.625346] Modules linked in: [ 83.628665] CPU: 1 PID: 5863 Comm: syz-executor0 Not tainted 4.9.122-g54068d6 #78 [ 83.636278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 83.645639] task: ffff8801d5561800 task.stack: ffff8801d4d98000 [ 83.651709] RIP: 0010:[] [] __split_huge_pmd+0x391/0x1870 [ 83.660597] RSP: 0018:ffff8801d4d9f8e0 EFLAGS: 00010246 [ 83.666047] RAX: dffffc0000000000 RBX: ffffeafff97d8000 RCX: ffffc90000901000 [ 83.673314] RDX: 1ffffd5fff2fb004 RSI: ffffffff8154df6e RDI: ffffeafff97d8020 [ 83.680582] RBP: ffff8801d4d9fa10 R08: ffff8801d5562110 R09: 0000000000000001 [ 83.687850] R10: ffff8801d5561800 R11: 1ffff1003aaac41d R12: ffffea0000000000 [ 83.695111] R13: 0000000000000000 R14: ffff8801d7c46be0 R15: ffff8801b9586800 [ 83.702366] FS: 00007f3079b40700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 [ 83.710596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.716484] CR2: ffffeafff97d8020 CR3: 00000001be146000 CR4: 00000000001606f0 [ 83.723746] Stack: [ 83.725884] ffff8801d4d9faa0 0000000000000046 ffffffff81003066 0000000000000000 [ 83.733955] 0000000000000000 0000000000000000 ffff8801db3224e8 0000000000000000 [ 83.742011] 0000000000000000 0000000000000001 0000000000000001 1ffff1003a9b3f31 [ 83.750073] Call Trace: [ 83.752665] [] ? ___preempt_schedule+0x16/0x18 [ 83.758897] [] ? change_huge_pmd+0x540/0x540 [ 83.764959] [] ? debug_check_no_locks_freed+0x210/0x210 [ 83.771985] [] ? migrate_swap_stop+0x820/0x820 [ 83.778218] [] ? plist_check_head+0x4a/0x60 [ 83.784196] [] unmap_page_range+0xa52/0x1730 [ 83.790262] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 83.797193] [] ? vm_normal_page_pmd+0x310/0x310 [ 83.803512] [] ? pagevec_lru_move_fn+0x183/0x200 [ 83.809922] [] unmap_single_vma+0x101/0x260 [ 83.815895] [] zap_page_range+0x269/0x3c0 [ 83.821700] [] ? unmap_vmas+0x1d0/0x1d0 [ 83.827333] [] ? vmacache_find+0x57/0x290 [ 83.833131] [] SyS_madvise+0x63a/0xee0 [ 83.838682] [] ? do_mprotect_pkey+0x70c/0x890 [ 83.844819] [] ? madvise_free_pte_range+0x1130/0x1130 [ 83.851665] [] ? SyS_futex+0x206/0x310 [ 83.857210] [] ? do_futex+0x17c0/0x17c0 [ 83.862824] [] ? mprotect_fixup+0x930/0x930 [ 83.869037] [] ? do_syscall_64+0x48/0x490 [ 83.874834] [] ? madvise_free_pte_range+0x1130/0x1130 [ 83.881661] [] do_syscall_64+0x1a6/0x490 [ 83.887350] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 83.894246] Code: ff df 4c 21 e3 49 bc 00 00 00 00 00 ea ff ff 48 c1 eb 06 4c 01 e3 48 8d 7b 20 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 14 13 00 00 <4c> 8b 6b 20 49 89 dc 41 f6 c5 01 0f 85 ab 0a 00 00 e8 b9 2d e1 [ 83.921195] RIP [] __split_huge_pmd+0x391/0x1870 [ 83.927696] RSP [ 83.931294] CR2: ffffeafff97d8020 [ 83.934722] ---[ end trace 1660318db1e7cfdc ]--- [ 83.939447] Kernel panic - not syncing: Fatal exception [ 83.945125] Dumping ftrace buffer: [ 83.948641] (ftrace buffer empty) [ 83.952325] Kernel Offset: disabled [ 83.955924] Rebooting in 86400 seconds..