[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.579231] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.815080] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available) [ 23.141979] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 24.086661] random: nonblocking pool is initialized Warning: Permanently added '10.128.10.5' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 32.008723] ================================================================== [ 32.016142] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 32.023421] Read of size 4 at addr ffff8801d0cfc000 by task syz-executor906/3945 [ 32.030941] [ 32.032568] CPU: 1 PID: 3945 Comm: syz-executor906 Not tainted 4.4.138-g07c0138 #62 [ 32.040338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.049680] 0000000000000000 6723b49ed928e8e6 ffff8801d933fb50 ffffffff81e0ed0d [ 32.057712] ffffea0007433f00 ffff8801d0cfc000 0000000000000000 ffff8801d0cfc000 [ 32.065722] ffffffff82f1a2b0 ffff8801d933fb88 ffffffff81515a16 ffff8801d0cfc000 [ 32.073715] Call Trace: [ 32.076280] [] dump_stack+0xc1/0x124 [ 32.081616] [] ? sock_release+0x1c0/0x1c0 [ 32.087388] [] print_address_description+0x6c/0x216 [ 32.094034] [] ? sock_release+0x1c0/0x1c0 [ 32.099811] [] kasan_report.cold.7+0x175/0x2f7 [ 32.106018] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 32.112757] [] __asan_report_load4_noabort+0x14/0x20 [ 32.119504] [] l2tp_session_queue_purge+0xf4/0x100 [ 32.126086] [] ? sock_release+0x1c0/0x1c0 [ 32.131883] [] pppol2tp_release+0x1ff/0x310 [ 32.137829] [] sock_release+0x96/0x1c0 [ 32.143346] [] sock_close+0x16/0x20 [ 32.148602] [] __fput+0x235/0x6f0 [ 32.153690] [] ____fput+0x15/0x20 [ 32.158779] [] task_work_run+0x10f/0x190 [ 32.164482] [] do_exit+0x9e5/0x26b0 [ 32.169745] [] ? release_task.part.17+0x1200/0x1200 [ 32.176386] [] ? __do_page_fault+0x385/0xa10 [ 32.182433] [] ? retint_user+0x18/0x3c [ 32.187957] [] do_group_exit+0x111/0x330 [ 32.193651] [] ? trace_hardirqs_on_thunk+0x17/0x19 [ 32.200216] [] SyS_exit_group+0x1d/0x20 [ 32.205838] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 32.212398] [ 32.214014] Allocated by task 3943: [ 32.217632] [] save_stack_trace+0x26/0x50 [ 32.223647] [] save_stack+0x43/0xd0 [ 32.229026] [] kasan_kmalloc+0xc7/0xe0 [ 32.234666] [] __kmalloc+0x124/0x310 [ 32.240132] [] l2tp_session_create+0x39/0x1030 [ 32.246458] [] pppol2tp_connect+0x10f0/0x1910 [ 32.252724] [] SYSC_connect+0x1b8/0x300 [ 32.258447] [] SyS_connect+0x24/0x30 [ 32.263925] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 32.270628] [ 32.272246] Freed by task 3915: [ 32.275500] [] save_stack_trace+0x26/0x50 [ 32.281424] [] save_stack+0x43/0xd0 [ 32.286816] [] kasan_slab_free+0x72/0xc0 [ 32.292627] [] kfree+0xf4/0x310 [ 32.297658] [] l2tp_session_free+0x170/0x200 [ 32.303828] [] l2tp_tunnel_closeall+0x2b9/0x350 [ 32.310240] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 32.316692] [] udpv6_destroy_sock+0xb1/0xd0 [ 32.322788] [] sk_common_release+0x6d/0x300 [ 32.328874] [] udp_lib_close+0x15/0x20 [ 32.334526] [] inet_release+0xff/0x1d0 [ 32.340172] [] inet6_release+0x50/0x70 [ 32.345823] [] sock_release+0x96/0x1c0 [ 32.351469] [] sock_close+0x16/0x20 [ 32.356846] [] __fput+0x235/0x6f0 [ 32.362044] [] ____fput+0x15/0x20 [ 32.367247] [] task_work_run+0x10f/0x190 [ 32.373052] [] do_exit+0x9e5/0x26b0 [ 32.378421] [] do_group_exit+0x111/0x330 [ 32.384223] [] SyS_exit_group+0x1d/0x20 [ 32.389940] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 32.396615] [ 32.398230] The buggy address belongs to the object at ffff8801d0cfc000 [ 32.398230] which belongs to the cache kmalloc-512 of size 512 [ 32.410861] The buggy address is located 0 bytes inside of [ 32.410861] 512-byte region [ffff8801d0cfc000, ffff8801d0cfc200) [ 32.422714] The buggy address belongs to the page: [ 32.438004] kasan: CONFIG_KASAN_INLINE enabled [ 32.442442] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN [ 32.455428] Dumping ftrace buffer: [ 32.458984] (ftrace buffer empty) [ 32.462693] Modules linked in: [ 32.466031] CPU: 0 PID: 3846 Comm: syz-executor906 Not tainted 4.4.138-g07c0138 #62 [ 32.473817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.483169] task: ffff8800bb2d4800 task.stack: ffff8800bae20000 [ 32.489220] RIP: 0010:[] [] debug_object_deactivate+0x191/0x340 [ 32.498639] RSP: 0018:ffff8801db207cf0 EFLAGS: 00010803 [ 32.504081] RAX: dffffc0000000000 RBX: b5a0012500000f67 RCX: 16b40024a00001ef [ 32.511349] RDX: 0000000000000000 RSI: ffffffff844c6720 RDI: b5a0012500000f7f [ 32.518664] RBP: ffff8801db207da8 R08: ffffffff8535b750 R09: 0000000000000001 [ 32.525939] R10: 0000000000000001 R11: ffff8800bb2d4800 R12: 1ffff1003b640fa0 [ 32.533214] R13: ffffffff85a3bc68 R14: ffff8801db219c40 R15: 0000000000000003 [ 32.540488] FS: 00000000008db940(0063) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 32.548717] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.554604] CR2: 00000000008db958 CR3: 00000000ac475000 CR4: 00000000001606f0 [ 32.561886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.569160] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.576464] Stack: [ 32.578614] 0000000000000092 ffffffff844c6720 0000000041b58ab3 ffffffff842092d7 [ 32.586698] ffffffff81e70670 ffff8800bb2d4800 ffffed001765aa1b ffff8800bb2d50e0 [ 32.594775] ffff8801db219658 0000000000000001 ffff8801db207d80 ffffffff81229682 [ 32.602836] Call Trace: [ 32.605411] [ 32.607483] [] ? debug_object_activate+0x480/0x480 [ 32.614373] [] ? __lock_is_held+0xa2/0xf0 [ 32.620209] [] __hrtimer_run_queues+0x222/0x1000 [ 32.626641] [] ? retrigger_next_event+0x1c0/0x1c0 [ 32.633148] [] ? kvm_clock_read+0x23/0x40 [ 32.638958] [] ? kvm_clock_get_cycles+0x9/0x10 [ 32.645208] [] ? hrtimer_interrupt+0x12d/0x430 [ 32.651459] [] hrtimer_interrupt+0x1b1/0x430 [ 32.657531] [] local_apic_timer_interrupt+0x74/0xa0 [ 32.664209] [] smp_apic_timer_interrupt+0x7c/0xa0 [ 32.670718] [] apic_timer_interrupt+0xa0/0xb0 [ 32.676862] [ 32.678943] [] ? smp_call_function_single+0x13b/0x3a0 [ 32.686102] [] ? smp_call_function_single+0x13d/0x3a0 [ 32.692959] [] ? do_flush_tlb_all+0x30/0x30 [ 32.698947] [] ? generic_exec_single+0x330/0x330 [ 32.705373] [] ? do_flush_tlb_all+0x30/0x30 [ 32.711363] [] ? find_next_bit+0x43/0x50 [ 32.717092] [] ? cpumask_next_and+0x90/0xb0 [ 32.723079] [] smp_call_function_many+0x5b9/0x710 [ 32.729596] [] ? __lock_is_held+0xa2/0xf0 [ 32.735415] [] ? do_flush_tlb_all+0x30/0x30 [ 32.741402] [] native_flush_tlb_others+0xfd/0x6e0 [ 32.747916] [] ? switch_mm+0x70/0x70 [ 32.753298] [] ? cpumask_any_but+0x8a/0xb0 [ 32.759198] [] flush_tlb_mm_range+0x10c/0x540 [ 32.765472] [] copy_process+0x4709/0x63e0 [ 32.771289] [] ? __cleanup_sighand+0x50/0x50 [ 32.777363] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 32.784302] [] ? remove_wait_queue+0x2b/0x40 [ 32.790371] [] ? do_wait+0x427/0xa30 [ 32.795757] [] _do_fork+0x146/0xe10 [ 32.801055] [] ? fork_idle+0x270/0x270 [ 32.806617] [] ? SyS_wait4+0x13b/0x1f0 [ 32.812167] [] ? SyS_waitid+0x2d0/0x2d0 [ 32.817808] [] ? kill_orphaned_pgrp+0x390/0x390 [ 32.825310] [] SyS_clone+0x37/0x50 [ 32.830523] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 32.837101] Code: a9 01 00 00 48 8b 1b 41 bf 01 00 00 00 48 85 db 74 42 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 41 83 c7 01 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 0c 01 00 00 4c 3b 73 18 74 7d 48 89 d9 48 c1 [ 32.864657] RIP [] debug_object_deactivate+0x191/0x340 [ 32.871727] RSP [ 32.875355] ---[ end trace 6ae77d55b75e44d3 ]--- [ 32.880110] Kernel panic - not syncing: Fatal exception in interrupt [ 34.015575] Shutting down cpus with NMI [ 34.020099] Dumping ftrace buffer: [ 34.023624] (ftrace buffer empty) [ 34.027306] Kernel Offset: disabled [ 34.030904] Rebooting in 86400 seconds..