[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 16.903452] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 25.898833] random: sshd: uninitialized urandom read (32 bytes read) [ 26.268264] random: sshd: uninitialized urandom read (32 bytes read) [ 26.645439] random: sshd: uninitialized urandom read (32 bytes read) [ 28.433066] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.39' (ECDSA) to the list of known hosts. [ 34.001606] random: sshd: uninitialized urandom read (32 bytes read) net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 34.086629] IPVS: ftp: loaded support on port[0] = 21 executing program [ 34.190665] ------------[ cut here ]------------ [ 34.195432] kernel BUG at net/ipv6/route.c:1268! [ 34.200214] invalid opcode: 0000 [#1] SMP KASAN [ 34.204871] CPU: 1 PID: 4353 Comm: syz-executor753 Not tainted 4.18.0-rc7+ #169 [ 34.212302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.221658] RIP: 0010:ip6_pol_route+0x9e3/0x1250 [ 34.226394] Code: 31 e4 e8 60 39 02 fc 4c 89 e0 f0 4c 0f b1 33 31 ff 49 89 c4 48 89 c6 e8 ab 1d c4 fb 4d 85 e4 0f 84 0d fa ff ff e8 6d 1c c4 fb <0f> 0b e8 66 1c c4 fb e8 81 8a ae fb 31 ff 89 c6 88 85 e0 fd ff ff [ 34.245724] RSP: 0018:ffff8801ac5b6d48 EFLAGS: 00010293 [ 34.251077] RAX: ffff8801ac72a380 RBX: ffffe8ffffd5d0d8 RCX: ffffffff85b7f965 [ 34.258335] RDX: 0000000000000000 RSI: ffffffff85b7f973 RDI: 0000000000000007 [ 34.265595] RBP: ffff8801ac5b6f78 R08: ffff8801ac72a380 R09: fffff91ffffaba1b [ 34.272864] R10: fffff91ffffaba1b R11: ffffe8ffffd5d0df R12: ffff8801b55922c0 [ 34.280120] R13: 0000000000000001 R14: ffff8801ad60ae80 R15: 0000000000000001 [ 34.287380] FS: 00007f0a6f13d700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 [ 34.295691] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.301564] CR2: 00000000205fafd2 CR3: 00000001b8ae0000 CR4: 00000000001406e0 [ 34.308818] Call Trace: [ 34.311397] ? ip6_pol_route_lookup+0x1120/0x1120 [ 34.316236] ? __nf_conntrack_find_get.part.43+0xfc3/0x1ac0 [ 34.321943] ? trace_hardirqs_on+0x10/0x10 [ 34.326168] ? ip6_finish_output2+0xcb5/0x2820 [ 34.330741] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 34.335749] ? trace_hardirqs_on+0x10/0x10 [ 34.339976] ip6_pol_route_output+0x54/0x70 [ 34.344284] fib6_rule_lookup+0x26e/0x700 [ 34.348422] ? ip6_pol_route_input+0x80/0x80 [ 34.352837] ? fib6_lookup+0x480/0x480 [ 34.356722] ? trace_hardirqs_on+0x10/0x10 [ 34.360961] ? kasan_check_read+0x11/0x20 [ 34.365102] ? do_raw_spin_unlock+0xa7/0x2f0 [ 34.369498] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 34.374091] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 34.378665] ip6_route_output_flags+0x2c5/0x350 [ 34.383418] ip6_dst_lookup_tail+0x1278/0x1da0 [ 34.387988] ? debug_object_activate+0x41a/0x690 [ 34.392734] ? lock_downgrade+0x8f0/0x8f0 [ 34.396878] ? kernel_text_address+0x79/0xf0 [ 34.401275] ? dst_output+0x180/0x180 [ 34.405067] ? do_raw_spin_unlock+0xa7/0x2f0 [ 34.409464] ? lock_acquire+0x1e4/0x540 [ 34.413426] ? debug_object_active_state+0x2f5/0x4d0 [ 34.418516] ? lock_downgrade+0x8f0/0x8f0 [ 34.422663] ? kasan_check_read+0x11/0x20 [ 34.426797] ? do_raw_spin_unlock+0xa7/0x2f0 [ 34.431187] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 34.435774] ? lock_acquire+0x1e4/0x540 [ 34.439757] ? inet6_csk_route_socket+0x69d/0x1030 [ 34.444674] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 34.450197] ? __sk_dst_check+0x1ef/0x410 [ 34.454333] ip6_dst_lookup_flow+0xc8/0x270 [ 34.458638] ? rcu_is_watching+0x8c/0x150 [ 34.462774] ? ip6_dst_lookup+0x60/0x60 [ 34.466749] ? kasan_kmalloc+0xc4/0xe0 [ 34.470624] inet6_csk_route_socket+0x8cb/0x1030 [ 34.475371] ? ip6_dst_check+0x475/0xaf0 [ 34.479435] ? inet6_csk_route_req+0x820/0x820 [ 34.484003] ? note_gp_changes+0x550/0x550 [ 34.488229] ? __kasan_slab_free+0x131/0x170 [ 34.492645] ? trace_hardirqs_on+0xd/0x10 [ 34.496787] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 34.502314] ? kasan_check_write+0x14/0x20 [ 34.506548] ? pskb_expand_head+0x6b3/0x10e0 [ 34.510943] ? kmem_cache_alloc_node_trace+0x302/0x770 [ 34.516219] ? __pskb_copy_fclone+0xeb0/0xeb0 [ 34.520721] inet6_csk_xmit+0x118/0x630 [ 34.524690] ? inet6_csk_xmit+0x118/0x630 [ 34.528821] ? call_rcu_sched+0x12/0x20 [ 34.532793] ? inet6_csk_update_pmtu+0x190/0x190 [ 34.537535] ? __sk_dst_check+0x1ef/0x410 [ 34.541674] ? sock_alloc_send_skb+0x40/0x40 [ 34.546096] l2tp_xmit_skb+0x1469/0x1830 [ 34.550163] ? l2tp_session_create+0xa70/0xa70 [ 34.554731] ? iov_iter_advance+0x14e0/0x14e0 [ 34.559220] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 34.564745] ? _copy_from_user+0xdf/0x150 [ 34.568884] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 34.573886] ? pppol2tp_sendmsg+0x45a/0x6c0 [ 34.578190] pppol2tp_sendmsg+0x4ae/0x6c0 [ 34.582325] ? move_addr_to_kernel.part.18+0x100/0x100 [ 34.587597] ? pppol2tp_getsockopt+0x950/0x950 [ 34.592169] sock_sendmsg+0xd5/0x120 [ 34.595872] ___sys_sendmsg+0x51d/0x930 [ 34.599827] ? kasan_check_write+0x14/0x20 [ 34.604055] ? copy_msghdr_from_user+0x580/0x580 [ 34.608808] ? __schedule+0x884/0x1ec0 [ 34.612678] ? pppol2tp_connect+0x895/0x2cb0 [ 34.617071] ? __sched_text_start+0x8/0x8 [ 34.621209] ? lock_acquire+0x1e4/0x540 [ 34.625169] ? __might_fault+0x12b/0x1e0 [ 34.629213] ? lock_downgrade+0x8f0/0x8f0 [ 34.633349] ? lock_release+0xa30/0xa30 [ 34.637325] ? check_same_owner+0x340/0x340 [ 34.641634] ? rcu_note_context_switch+0x730/0x730 [ 34.646543] ? check_same_owner+0x340/0x340 [ 34.650852] __sys_sendmmsg+0x240/0x6f0 [ 34.654810] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 34.659120] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 34.664641] ? fput+0x130/0x1a0 [ 34.667907] ? __sys_connect+0x1d1/0x4c0 [ 34.671970] ? __ia32_sys_accept+0xb0/0xb0 [ 34.676198] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 34.680791] __x64_sys_sendmmsg+0x9d/0x100 [ 34.685017] do_syscall_64+0x1b9/0x820 [ 34.688897] ? finish_task_switch+0x1d3/0x870 [ 34.693881] ? syscall_return_slowpath+0x5e0/0x5e0 [ 34.698796] ? syscall_return_slowpath+0x31d/0x5e0 [ 34.703711] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 34.708710] ? prepare_exit_to_usermode+0x291/0x3b0 [ 34.713713] ? perf_trace_sys_enter+0xb10/0xb10 [ 34.718380] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 34.723210] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 34.728382] RIP: 0033:0x4469f9 [ 34.731549] Code: e8 ac b8 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 34.750676] RSP: 002b:00007f0a6f13cdb8 EFLAGS: 00000297 ORIG_RAX: 0000000000000133 [ 34.758371] RAX: ffffffffffffffda RBX: 00000000006dbc48 RCX: 00000000004469f9 [ 34.765641] RDX: 00000000000003e8 RSI: 0000000020005fc0 RDI: 0000000000000004 [ 34.772928] RBP: 00000000006dbc40 R08: 0000000000000000 R09: 0000000000000000 [ 34.780185] R10: 0000000000000000 R11: 0000000000000297 R12: 00000000006dbc4c [ 34.787448] R13: 00007fff5cf09f8f R14: 00007f0a6f13d9c0 R15: 0000000000000000 [ 34.794706] Modules linked in: [ 34.797883] Dumping ftrace buffer: [ 34.801396] (ftrace buffer empty) [ 34.805123] ---[ end trace 77cd4bfdfeb77f7b ]--- [ 34.809882] RIP: 0010:ip6_pol_route+0x9e3/0x1250 [ 34.814634] Code: 31 e4 e8 60 39 02 fc 4c 89 e0 f0 4c 0f b1 33 31 ff 49 89 c4 48 89 c6 e8 ab 1d c4 fb 4d 85 e4 0f 84 0d fa ff ff e8 6d 1c c4 fb <0f> 0b e8 66 1c c4 fb e8 81 8a ae fb 31 ff 89 c6 88 85 e0 fd ff ff [ 34.833798] RSP: 0018:ffff8801ac5b6d48 EFLAGS: 00010293 [ 34.839161] RAX: ffff8801ac72a380 RBX: ffffe8ffffd5d0d8 RCX: ffffffff85b7f965 [ 34.846446] RDX: 0000000000000000 RSI: ffffffff85b7f973 RDI: 0000000000000007 [ 34.853718] RBP: ffff8801ac5b6f78 R08: ffff8801ac72a380 R09: fffff91ffffaba1b [ 34.860997] R10: fffff91ffffaba1b R11: ffffe8ffffd5d0df R12: ffff8801b55922c0 [ 34.868279] R13: 0000000000000001 R14: ffff8801ad60ae80 R15: 0000000000000001 [ 34.875561] FS: 00007f0a6f13d700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 [ 34.883798] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.889700] CR2: 00000000205fafd2 CR3: 00000001b8ae0000 CR4: 00000000001406e0 [ 34.896994] Kernel panic - not syncing: Fatal exception in interrupt [ 34.903793] Dumping ftrace buffer: [ 34.907317] (ftrace buffer empty) [ 34.911012] Kernel Offset: disabled [ 34.914631] Rebooting in 86400 seconds..