[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 23.534232] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 29.329777] random: sshd: uninitialized urandom read (32 bytes read) [ 29.806619] random: sshd: uninitialized urandom read (32 bytes read) [ 30.359302] random: sshd: uninitialized urandom read (32 bytes read) [ 30.538203] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.16' (ECDSA) to the list of known hosts. [ 36.044005] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 36.142164] ================================================================== [ 36.149607] BUG: KASAN: slab-out-of-bounds in _autofs_dev_ioctl+0x8f5/0x990 [ 36.156693] Read of size 4 at addr ffff8801d798bd40 by task syz-executor597/4480 [ 36.164207] [ 36.165826] CPU: 0 PID: 4480 Comm: syz-executor597 Not tainted 4.18.0-next-20180816+ #41 [ 36.174034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.183445] Call Trace: [ 36.186555] dump_stack+0x1c9/0x2b4 [ 36.190190] ? dump_stack_print_info.cold.2+0x52/0x52 [ 36.195369] ? printk+0xa7/0xcf [ 36.198649] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 36.203396] ? _autofs_dev_ioctl+0x8f5/0x990 [ 36.207796] print_address_description+0x6c/0x20b [ 36.212628] ? _autofs_dev_ioctl+0x8f5/0x990 [ 36.217024] kasan_report.cold.7+0x242/0x30d [ 36.221420] ? find_autofs_mount.isra.5+0x2d0/0x2d0 [ 36.226432] __asan_report_load4_noabort+0x14/0x20 [ 36.231363] _autofs_dev_ioctl+0x8f5/0x990 [ 36.235599] ? autofs_dev_ioctl_closemount+0x90/0x90 [ 36.240694] ? trace_hardirqs_off+0xb8/0x2b0 [ 36.245093] ? _autofs_dev_ioctl+0x990/0x990 [ 36.249493] autofs_dev_ioctl+0x1b/0x30 [ 36.253473] do_vfs_ioctl+0x1de/0x1720 [ 36.257357] ? rcu_is_watching+0x8c/0x150 [ 36.261494] ? trace_hardirqs_on+0xbd/0x2c0 [ 36.265806] ? ioctl_preallocate+0x300/0x300 [ 36.270201] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.275768] ? __fget_light+0x2f7/0x440 [ 36.279750] ? fget_raw+0x20/0x20 [ 36.283197] ? putname+0xf2/0x130 [ 36.286658] ? rcu_read_lock_sched_held+0x108/0x120 [ 36.291705] ? kmem_cache_free+0x246/0x280 [ 36.295927] ? putname+0xf7/0x130 [ 36.299370] ? do_syscall_64+0x9a/0x820 [ 36.303338] ? do_syscall_64+0x9a/0x820 [ 36.307311] ? lockdep_hardirqs_on+0x421/0x5c0 [ 36.311905] ? security_file_ioctl+0x94/0xc0 [ 36.316318] ksys_ioctl+0xa9/0xd0 [ 36.319772] __x64_sys_ioctl+0x73/0xb0 [ 36.323648] do_syscall_64+0x1b9/0x820 [ 36.327522] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 36.332889] ? syscall_return_slowpath+0x5e0/0x5e0 [ 36.337807] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 36.342633] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 36.347634] ? prepare_exit_to_usermode+0x291/0x3b0 [ 36.352652] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 36.357490] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.362663] RIP: 0033:0x440139 [ 36.365844] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 36.384742] RSP: 002b:00007ffdfa09e8b8 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ 36.392435] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000440139 [ 36.399698] RDX: 0000000020000180 RSI: 800000000000937e RDI: 0000000000000005 [ 36.406961] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 36.414226] R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004019c0 [ 36.421486] R13: 0000000000401a50 R14: 0000000000000000 R15: 0000000000000000 [ 36.428748] [ 36.430358] Allocated by task 4480: [ 36.433988] save_stack+0x43/0xd0 [ 36.437425] kasan_kmalloc+0xc4/0xe0 [ 36.441131] kmem_cache_alloc_trace+0x152/0x730 [ 36.445813] ramfs_fill_super+0xc4/0x580 [ 36.449855] mount_nodev+0x73/0x120 [ 36.453466] ramfs_mount+0x34/0x40 [ 36.456993] legacy_get_tree+0x131/0x460 [ 36.461035] vfs_get_tree+0x1cb/0x5c0 [ 36.464817] do_mount+0x6f9/0x1e30 [ 36.468338] ksys_mount+0x12d/0x140 [ 36.471949] __x64_sys_mount+0xbe/0x150 [ 36.475907] do_syscall_64+0x1b9/0x820 [ 36.479782] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.484948] [ 36.486555] Freed by task 2749: [ 36.489817] save_stack+0x43/0xd0 [ 36.493287] __kasan_slab_free+0x11a/0x170 [ 36.497519] kasan_slab_free+0xe/0x10 [ 36.501310] kfree+0xd9/0x210 [ 36.504400] single_release+0x8f/0xb0 [ 36.508183] __fput+0x376/0x8a0 [ 36.511462] ____fput+0x15/0x20 [ 36.514743] task_work_run+0x1e8/0x2a0 [ 36.518615] exit_to_usermode_loop+0x318/0x380 [ 36.523182] do_syscall_64+0x6be/0x820 [ 36.527058] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.532239] [ 36.533852] The buggy address belongs to the object at ffff8801d798bd40 [ 36.533852] which belongs to the cache kmalloc-32 of size 32 [ 36.546319] The buggy address is located 0 bytes inside of [ 36.546319] 32-byte region [ffff8801d798bd40, ffff8801d798bd60) [ 36.557913] The buggy address belongs to the page: [ 36.562825] page:ffffea00075e62c0 count:1 mapcount:0 mapping:ffff8801dac001c0 index:0xffff8801d798bfc1 [ 36.572254] flags: 0x2fffc0000000100(slab) [ 36.576498] raw: 02fffc0000000100 ffffea00075ea088 ffffea0006b77008 ffff8801dac001c0 [ 36.584363] raw: ffff8801d798bfc1 ffff8801d798b000 0000000100000020 0000000000000000 [ 36.592221] page dumped because: kasan: bad access detected [ 36.597907] [ 36.599512] Memory state around the buggy address: [ 36.604424] ffff8801d798bc00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 36.611776] ffff8801d798bc80: 00 fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [ 36.619117] >ffff8801d798bd00: 00 00 fc fc fc fc fc fc 02 fc fc fc fc fc fc fc [ 36.626463] ^ [ 36.631912] ffff8801d798bd80: 00 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 36.639251] ffff8801d798be00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 36.646593] ================================================================== [ 36.653945] Disabling lock debugging due to kernel taint [ 36.659530] Kernel panic - not syncing: panic_on_warn set ... [ 36.659530] [ 36.666911] CPU: 0 PID: 4480 Comm: syz-executor597 Tainted: G B 4.18.0-next-20180816+ #41 [ 36.676518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.685850] Call Trace: [ 36.688446] dump_stack+0x1c9/0x2b4 [ 36.692072] ? dump_stack_print_info.cold.2+0x52/0x52 [ 36.697246] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 36.701990] panic+0x238/0x4e7 [ 36.705166] ? add_taint.cold.5+0x16/0x16 [ 36.709305] ? trace_hardirqs_on+0x9a/0x2c0 [ 36.713611] ? trace_hardirqs_on+0xb4/0x2c0 [ 36.717915] ? trace_hardirqs_on+0xb4/0x2c0 [ 36.722218] ? trace_hardirqs_on+0x9a/0x2c0 [ 36.726527] ? _autofs_dev_ioctl+0x8f5/0x990 [ 36.730918] kasan_end_report+0x47/0x4f [ 36.734872] kasan_report.cold.7+0x76/0x30d [ 36.739176] ? find_autofs_mount.isra.5+0x2d0/0x2d0 [ 36.744171] __asan_report_load4_noabort+0x14/0x20 [ 36.749082] _autofs_dev_ioctl+0x8f5/0x990 [ 36.753309] ? autofs_dev_ioctl_closemount+0x90/0x90 [ 36.758396] ? trace_hardirqs_off+0xb8/0x2b0 [ 36.762811] ? _autofs_dev_ioctl+0x990/0x990 [ 36.767200] autofs_dev_ioctl+0x1b/0x30 [ 36.771156] do_vfs_ioctl+0x1de/0x1720 [ 36.775064] ? rcu_is_watching+0x8c/0x150 [ 36.779203] ? trace_hardirqs_on+0xbd/0x2c0 [ 36.783508] ? ioctl_preallocate+0x300/0x300 [ 36.787918] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.793445] ? __fget_light+0x2f7/0x440 [ 36.797403] ? fget_raw+0x20/0x20 [ 36.800834] ? putname+0xf2/0x130 [ 36.804278] ? rcu_read_lock_sched_held+0x108/0x120 [ 36.809303] ? kmem_cache_free+0x246/0x280 [ 36.813542] ? putname+0xf7/0x130 [ 36.817003] ? do_syscall_64+0x9a/0x820 [ 36.820962] ? do_syscall_64+0x9a/0x820 [ 36.824923] ? lockdep_hardirqs_on+0x421/0x5c0 [ 36.829493] ? security_file_ioctl+0x94/0xc0 [ 36.833900] ksys_ioctl+0xa9/0xd0 [ 36.837338] __x64_sys_ioctl+0x73/0xb0 [ 36.841207] do_syscall_64+0x1b9/0x820 [ 36.845081] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 36.850425] ? syscall_return_slowpath+0x5e0/0x5e0 [ 36.855346] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 36.860171] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 36.865175] ? prepare_exit_to_usermode+0x291/0x3b0 [ 36.870175] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 36.875004] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.880182] RIP: 0033:0x440139 [ 36.883361] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 36.902256] RSP: 002b:00007ffdfa09e8b8 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ 36.909956] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000440139 [ 36.917207] RDX: 0000000020000180 RSI: 800000000000937e RDI: 0000000000000005 [ 36.924461] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 36.931716] R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004019c0 [ 36.938964] R13: 0000000000401a50 R14: 0000000000000000 R15: 0000000000000000 [ 36.946564] Dumping ftrace buffer: [ 36.950092] (ftrace buffer empty) [ 36.953778] Kernel Offset: disabled [ 36.957384] Rebooting in 86400 seconds..