[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 15.655734] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.204616] random: sshd: uninitialized urandom read (32 bytes read) [ 20.517895] random: sshd: uninitialized urandom read (32 bytes read) [ 20.971844] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.25' (ECDSA) to the list of known hosts. [ 26.508405] urandom_read: 1 callbacks suppressed [ 26.508410] random: sshd: uninitialized urandom read (32 bytes read) 2018/08/07 07:40:40 parsed 1 programs [ 28.053146] random: cc1: uninitialized urandom read (8 bytes read) 2018/08/07 07:40:42 executed programs: 0 [ 29.044641] IPVS: Creating netns size=2536 id=1 [ 29.070394] IPVS: Creating netns size=2536 id=2 [ 29.090932] IPVS: Creating netns size=2536 id=3 [ 29.126927] IPVS: Creating netns size=2536 id=4 [ 29.155046] IPVS: Creating netns size=2536 id=5 [ 29.187454] IPVS: Creating netns size=2536 id=6 [ 29.238389] IPVS: Creating netns size=2536 id=7 [ 29.307236] IPVS: Creating netns size=2536 id=8 [ 29.484936] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.504306] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.525024] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.537035] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.587692] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.612048] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.624612] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.667163] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 29.676682] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.693310] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 29.709418] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 29.727224] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.748082] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 29.756605] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.782335] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 29.791970] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.807475] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.818181] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 29.827817] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 29.836486] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.844605] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 29.852308] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.865511] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 29.873455] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 29.881800] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 29.889294] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 29.901762] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 29.912647] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 29.921388] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 29.941359] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.954162] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.978519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.986940] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.000058] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.008163] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.017067] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.036926] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.048821] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.056632] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.070138] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.079722] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.089082] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 30.104298] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.115240] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.123670] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.131117] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 30.158885] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.177188] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.215714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.228251] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.239628] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.260379] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.271062] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.279198] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 30.288405] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.300897] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.311924] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.320206] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 30.329344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.338855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.353177] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.362118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.372905] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 30.381399] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.388812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.401455] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 30.408964] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.416803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.459732] ip (4563) used greatest stack depth: 24376 bytes left [ 31.447779] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.516591] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.568563] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 31.584957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.592265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.643144] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.668558] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 31.678572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.686761] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.727562] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.772198] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 31.778598] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.785426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.804495] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.843603] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.883682] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 31.892391] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.899116] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.907745] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.914982] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 31.960649] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 31.966795] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.976519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.021629] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 32.028120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.035609] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.048382] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 32.061923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.068670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.084935] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 32.099408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.108694] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/08/07 07:40:47 executed programs: 131 2018/08/07 07:40:52 executed programs: 635 [ 39.622640] ================================================================== [ 39.630061] BUG: KASAN: out-of-bounds in __unwind_start+0x37c/0x3c0 [ 39.636478] Read of size 8 at addr ffff8801d8267818 by task syz-executor1/8835 [ 39.643828] [ 39.645452] CPU: 0 PID: 8835 Comm: syz-executor1 Not tainted 4.9.118-g47b77b8 #24 [ 39.653062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.662409] ffff8801d78ef130 ffffffff81eb4b89 ffffea00076099c0 ffff8801d8267818 [ 39.670506] 0000000000000000 ffff8801d8267820 ffff8801d78ef268 ffff8801d78ef168 [ 39.678556] ffffffff81567f29 ffff8801d8267818 0000000000000008 0000000000000000 [ 39.686604] Call Trace: [ 39.689190] [] dump_stack+0xc1/0x128 [ 39.694546] [] print_address_description+0x6c/0x234 [ 39.701203] [] kasan_report.cold.6+0x242/0x2fe [ 39.707429] [] ? __unwind_start+0x37c/0x3c0 [ 39.713714] [] __asan_report_load8_noabort+0x14/0x20 [ 39.720461] [] __unwind_start+0x37c/0x3c0 [ 39.726254] [] ? ptrace_may_access+0x24/0x50 [ 39.732310] [] __save_stack_trace+0x59/0xf0 [ 39.738284] [] save_stack_trace_tsk+0x48/0x70 [ 39.744437] [] proc_pid_stack+0x148/0x220 [ 39.750265] [] ? lock_trace+0xc0/0xc0 [ 39.755721] [] proc_single_show+0xfd/0x170 [ 39.761605] [] seq_read+0x4b6/0x12e0 [ 39.766964] [] ? seq_dentry+0x290/0x290 [ 39.772581] [] ? __fsnotify_update_child_dentry_flags.part.1+0x300/0x300 [ 39.781065] [] ? fsnotify+0x1100/0x1100 [ 39.786688] [] do_loop_readv_writev.part.18+0xd5/0x280 [ 39.793615] [] do_readv_writev+0x565/0x7a0 [ 39.799509] [] ? vfs_write+0x530/0x530 [ 39.805045] [] ? kasan_unpoison_shadow+0x35/0x50 [ 39.811436] [] ? push_pipe+0x3f4/0x780 [ 39.816963] [] ? iov_iter_get_pages_alloc+0x2bb/0xf10 [ 39.823790] [] vfs_readv+0x84/0xc0 [ 39.828972] [] default_file_splice_read+0x44b/0x7e0 [ 39.835613] [] ? do_splice_direct+0x270/0x270 [ 39.841737] [] ? __might_sleep+0x95/0x1a0 [ 39.847512] [] ? futex_wait_queue_me+0x3d1/0x5c0 [ 39.853981] [] ? refill_pi_state_cache.part.8+0x200/0x200 [ 39.861145] [] ? rw_verify_area+0xe5/0x2b0 [ 39.867010] [] ? do_splice_direct+0x270/0x270 [ 39.873156] [] do_splice_to+0x10c/0x170 [ 39.878767] [] splice_direct_to_actor+0x23f/0x7e0 [ 39.885236] [] ? pipe_to_sendpage+0x330/0x330 [ 39.891372] [] ? do_splice_to+0x170/0x170 [ 39.897147] [] ? security_file_permission+0x8f/0x1f0 [ 39.903878] [] ? rw_verify_area+0xe5/0x2b0 [ 39.909740] [] do_splice_direct+0x1a3/0x270 [ 39.915688] [] ? splice_direct_to_actor+0x7e0/0x7e0 [ 39.922329] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 39.928898] [] ? __sb_start_write+0x161/0x300 [ 39.935030] [] do_sendfile+0x4f0/0xc60 [ 39.940561] [] ? do_compat_pwritev64+0x180/0x180 [ 39.946943] [] ? __might_fault+0x114/0x1d0 [ 39.952818] [] compat_SyS_sendfile+0xd1/0x160 [ 39.958948] [] ? SyS_sendfile64+0x160/0x160 [ 39.964900] [] ? do_fast_syscall_32+0xcf/0x870 [ 39.971106] [] ? SyS_sendfile64+0x160/0x160 [ 39.977060] [] do_fast_syscall_32+0x2f7/0x870 [ 39.983193] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.989853] [] entry_SYSENTER_compat+0x90/0xa2 [ 39.996062] [ 39.997664] The buggy address belongs to the page: [ 40.002573] page:ffffea00076099c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 40.010808] flags: 0x8000000000000000() [ 40.014754] page dumped because: kasan: bad access detected [ 40.020433] [ 40.022033] Memory state around the buggy address: [ 40.026948] ffff8801d8267700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.034296] ffff8801d8267780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.041631] >ffff8801d8267800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.048961] ^ [ 40.053355] ffff8801d8267880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.060689] ffff8801d8267900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.068021] ================================================================== [ 40.075350] Disabling lock debugging due to kernel taint [ 40.090187] Kernel panic - not syncing: panic_on_warn set ... [ 40.090187] [ 40.097603] CPU: 0 PID: 8835 Comm: syz-executor1 Tainted: G B 4.9.118-g47b77b8 #24 [ 40.106430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.115773] ffff8801d78ef090 ffffffff81eb4b89 ffffffff843c8907 00000000ffffffff [ 40.123773] 0000000000000000 0000000000000000 ffff8801d78ef268 ffff8801d78ef150 [ 40.131808] ffffffff81421c25 0000000041b58ab3 ffffffff843bbfe8 ffffffff81421a66 [ 40.139807] Call Trace: [ 40.142377] [] dump_stack+0xc1/0x128 [ 40.147718] [] panic+0x1bf/0x3bc [ 40.152708] [] ? add_taint.cold.6+0x16/0x16 [ 40.158653] [] ? ___preempt_schedule+0x16/0x18 [ 40.164861] [] kasan_end_report+0x47/0x4f [ 40.170630] [] kasan_report.cold.6+0x76/0x2fe [ 40.176763] [] ? __unwind_start+0x37c/0x3c0 [ 40.182709] [] __asan_report_load8_noabort+0x14/0x20 [ 40.189436] [] __unwind_start+0x37c/0x3c0 [ 40.195208] [] ? ptrace_may_access+0x24/0x50 [ 40.201241] [] __save_stack_trace+0x59/0xf0 [ 40.207187] [] save_stack_trace_tsk+0x48/0x70 [ 40.213310] [] proc_pid_stack+0x148/0x220 [ 40.219082] [] ? lock_trace+0xc0/0xc0 [ 40.224509] [] proc_single_show+0xfd/0x170 [ 40.230368] [] seq_read+0x4b6/0x12e0 [ 40.235706] [] ? seq_dentry+0x290/0x290 [ 40.241311] [] ? __fsnotify_update_child_dentry_flags.part.1+0x300/0x300 [ 40.249795] [] ? fsnotify+0x1100/0x1100 [ 40.255408] [] do_loop_readv_writev.part.18+0xd5/0x280 [ 40.262311] [] do_readv_writev+0x565/0x7a0 [ 40.268174] [] ? vfs_write+0x530/0x530 [ 40.273704] [] ? kasan_unpoison_shadow+0x35/0x50 [ 40.280092] [] ? push_pipe+0x3f4/0x780 [ 40.285610] [] ? iov_iter_get_pages_alloc+0x2bb/0xf10 [ 40.292441] [] vfs_readv+0x84/0xc0 [ 40.297619] [] default_file_splice_read+0x44b/0x7e0 [ 40.304274] [] ? do_splice_direct+0x270/0x270 [ 40.310398] [] ? __might_sleep+0x95/0x1a0 [ 40.316193] [] ? futex_wait_queue_me+0x3d1/0x5c0 [ 40.322576] [] ? refill_pi_state_cache.part.8+0x200/0x200 [ 40.329747] [] ? rw_verify_area+0xe5/0x2b0 [ 40.335607] [] ? do_splice_direct+0x270/0x270 [ 40.341727] [] do_splice_to+0x10c/0x170 [ 40.347326] [] splice_direct_to_actor+0x23f/0x7e0 [ 40.353802] [] ? pipe_to_sendpage+0x330/0x330 [ 40.359923] [] ? do_splice_to+0x170/0x170 [ 40.365697] [] ? security_file_permission+0x8f/0x1f0 [ 40.372424] [] ? rw_verify_area+0xe5/0x2b0 [ 40.378284] [] do_splice_direct+0x1a3/0x270 [ 40.384230] [] ? splice_direct_to_actor+0x7e0/0x7e0 [ 40.390870] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 40.397425] [] ? __sb_start_write+0x161/0x300 [ 40.403546] [] do_sendfile+0x4f0/0xc60 [ 40.409058] [] ? do_compat_pwritev64+0x180/0x180 [ 40.415439] [] ? __might_fault+0x114/0x1d0 [ 40.421302] [] compat_SyS_sendfile+0xd1/0x160 [ 40.427422] [] ? SyS_sendfile64+0x160/0x160 [ 40.433376] [] ? do_fast_syscall_32+0xcf/0x870 [ 40.439593] [] ? SyS_sendfile64+0x160/0x160 [ 40.445535] [] do_fast_syscall_32+0x2f7/0x870 [ 40.451654] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 40.458305] [] entry_SYSENTER_compat+0x90/0xa2 [ 40.465098] Dumping ftrace buffer: [ 40.468619] (ftrace buffer empty) [ 40.472302] Kernel Offset: disabled [ 40.476380] Rebooting in 86400 seconds..