[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 15.294646] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.233097] random: sshd: uninitialized urandom read (32 bytes read) [ 19.428261] random: sshd: uninitialized urandom read (32 bytes read) [ 20.208421] random: sshd: uninitialized urandom read (32 bytes read) [ 20.347851] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts. [ 25.810677] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 25.914724] ================================================================== [ 25.922148] BUG: KASAN: slab-out-of-bounds in pdu_read+0x90/0xd0 [ 25.928284] Read of size 30360 at addr ffff8801c30519ed by task syz-executor651/4393 [ 25.936171] [ 25.937783] CPU: 1 PID: 4393 Comm: syz-executor651 Not tainted 4.18.0-rc5-next-20180720+ #12 [ 25.946335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.955680] Call Trace: [ 25.958254] dump_stack+0x1c9/0x2b4 [ 25.961871] ? dump_stack_print_info.cold.2+0x52/0x52 [ 25.967050] ? printk+0xa7/0xcf [ 25.970316] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 25.975066] ? pdu_read+0x90/0xd0 [ 25.978519] print_address_description+0x6c/0x20b [ 25.983350] ? pdu_read+0x90/0xd0 [ 25.986784] kasan_report.cold.7+0x242/0x30d [ 25.991178] check_memory_region+0x13e/0x1b0 [ 25.995590] memcpy+0x23/0x50 [ 25.998706] pdu_read+0x90/0xd0 [ 26.001968] p9pdu_readf+0x579/0x2170 [ 26.005762] ? p9pdu_writef+0xe0/0xe0 [ 26.009556] ? ksys_dup3+0x690/0x690 [ 26.013257] ? check_same_owner+0x340/0x340 [ 26.017573] ? p9_fd_poll+0x2b0/0x2b0 [ 26.021371] ? kasan_kmalloc+0xc4/0xe0 [ 26.025255] ? p9_fd_show_options+0x1c0/0x1c0 [ 26.029748] p9_client_create+0x6d0/0x1537 [ 26.033975] ? p9_client_read+0xbb0/0xbb0 [ 26.038119] ? lock_acquire+0x1e4/0x540 [ 26.042081] ? fs_reclaim_acquire+0x20/0x20 [ 26.046390] ? lock_release+0xa30/0xa30 [ 26.050346] ? __lockdep_init_map+0x105/0x590 [ 26.054833] ? kasan_check_write+0x14/0x20 [ 26.059052] ? __init_rwsem+0x1cc/0x2a0 [ 26.063011] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 26.068036] ? __kmalloc_track_caller+0x311/0x760 [ 26.072881] ? save_stack+0xa9/0xd0 [ 26.076493] ? save_stack+0x43/0xd0 [ 26.080103] ? kasan_kmalloc+0xc4/0xe0 [ 26.083990] ? memcpy+0x45/0x50 [ 26.087277] v9fs_session_init+0x21a/0x1a80 [ 26.091580] ? rcu_note_context_switch+0x730/0x730 [ 26.096487] ? legacy_parse_monolithic+0xde/0x1e0 [ 26.101314] ? v9fs_show_options+0x7e0/0x7e0 [ 26.105801] ? lock_release+0xa30/0xa30 [ 26.109754] ? lock_downgrade+0x8f0/0x8f0 [ 26.113882] ? check_same_owner+0x340/0x340 [ 26.118182] ? kasan_unpoison_shadow+0x35/0x50 [ 26.122743] ? kasan_kmalloc+0xc4/0xe0 [ 26.126610] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.131431] ? kasan_unpoison_shadow+0x35/0x50 [ 26.135994] ? kasan_kmalloc+0xc4/0xe0 [ 26.139876] v9fs_mount+0x7c/0x900 [ 26.143398] ? v9fs_drop_inode+0x150/0x150 [ 26.147617] legacy_get_tree+0x131/0x460 [ 26.151661] vfs_get_tree+0x1cb/0x5c0 [ 26.155467] do_mount+0x6f2/0x1e20 [ 26.159078] ? do_raw_spin_unlock+0xa7/0x2f0 [ 26.163481] ? copy_mount_string+0x40/0x40 [ 26.167698] ? kasan_kmalloc+0xc4/0xe0 [ 26.171576] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.176405] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 26.181930] ? copy_mount_options+0x285/0x380 [ 26.186406] ksys_mount+0x12d/0x140 [ 26.190022] __x64_sys_mount+0xbe/0x150 [ 26.193996] do_syscall_64+0x1b9/0x820 [ 26.197880] ? syscall_return_slowpath+0x5e0/0x5e0 [ 26.202788] ? syscall_return_slowpath+0x31d/0x5e0 [ 26.207705] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 26.212707] ? prepare_exit_to_usermode+0x291/0x3b0 [ 26.217704] ? perf_trace_sys_enter+0xb10/0xb10 [ 26.222369] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.227211] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 26.232388] RIP: 0033:0x4402d9 [ 26.235568] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 26.255509] RSP: 002b:00007ffd58213778 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 26.263223] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00000000004402d9 [ 26.270476] RDX: 0000000020000900 RSI: 0000000020000000 RDI: 0000000000000000 [ 26.277733] RBP: 0030656c69662f2e R08: 0000000020000840 R09: 00000000004002c8 [ 26.284984] R10: 0000000000000000 R11: 0000000000000206 R12: 64663d736e617274 [ 26.292242] R13: 0000000000401bf0 R14: 0000000000000000 R15: 0000000000000000 [ 26.299503] [ 26.301121] Allocated by task 4393: [ 26.304737] save_stack+0x43/0xd0 [ 26.308176] kasan_kmalloc+0xc4/0xe0 [ 26.311879] __kmalloc+0x14e/0x760 [ 26.315414] p9_fcall_alloc+0x1e/0x90 [ 26.319208] p9_client_prepare_req.part.8+0x132/0xa00 [ 26.324392] p9_client_rpc+0x242/0x1330 [ 26.328363] p9_client_create+0xca4/0x1537 [ 26.332585] v9fs_session_init+0x21a/0x1a80 [ 26.336884] v9fs_mount+0x7c/0x900 [ 26.340407] legacy_get_tree+0x131/0x460 [ 26.344451] vfs_get_tree+0x1cb/0x5c0 [ 26.348232] do_mount+0x6f2/0x1e20 [ 26.351758] ksys_mount+0x12d/0x140 [ 26.355363] __x64_sys_mount+0xbe/0x150 [ 26.359336] do_syscall_64+0x1b9/0x820 [ 26.363214] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 26.368383] [ 26.369991] Freed by task 0: [ 26.372986] (stack is not available) [ 26.376679] [ 26.378288] The buggy address belongs to the object at ffff8801c30519c0 [ 26.378288] which belongs to the cache kmalloc-16384 of size 16384 [ 26.391285] The buggy address is located 45 bytes inside of [ 26.391285] 16384-byte region [ffff8801c30519c0, ffff8801c30559c0) [ 26.403232] The buggy address belongs to the page: [ 26.408157] page:ffffea00070c1400 count:1 mapcount:0 mapping:ffff8801da802200 index:0x0 compound_mapcount: 0 [ 26.418105] flags: 0x2fffc0000010200(slab|head) [ 26.422757] raw: 02fffc0000010200 ffffea0007091408 ffff8801da801c48 ffff8801da802200 [ 26.430631] raw: 0000000000000000 ffff8801c30519c0 0000000100000001 0000000000000000 [ 26.438487] page dumped because: kasan: bad access detected [ 26.444174] [ 26.445786] Memory state around the buggy address: [ 26.450700] ffff8801c3053880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.458042] ffff8801c3053900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.465396] >ffff8801c3053980: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 26.472738] ^ [ 26.479220] ffff8801c3053a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.486568] ffff8801c3053a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.493907] ================================================================== [ 26.501791] Kernel panic - not syncing: panic_on_warn set ... [ 26.501791] [ 26.509176] CPU: 1 PID: 4393 Comm: syz-executor651 Tainted: G B 4.18.0-rc5-next-20180720+ #12 [ 26.519135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.528477] Call Trace: [ 26.531071] dump_stack+0x1c9/0x2b4 [ 26.534694] ? dump_stack_print_info.cold.2+0x52/0x52 [ 26.539959] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.544705] panic+0x238/0x4e7 [ 26.547884] ? add_taint.cold.5+0x16/0x16 [ 26.552023] ? do_raw_spin_unlock+0xa7/0x2f0 [ 26.556422] ? pdu_read+0x90/0xd0 [ 26.559854] kasan_end_report+0x47/0x4f [ 26.563819] kasan_report.cold.7+0x76/0x30d [ 26.568139] check_memory_region+0x13e/0x1b0 [ 26.572548] memcpy+0x23/0x50 [ 26.575640] pdu_read+0x90/0xd0 [ 26.578925] p9pdu_readf+0x579/0x2170 [ 26.582707] ? p9pdu_writef+0xe0/0xe0 [ 26.586498] ? ksys_dup3+0x690/0x690 [ 26.590194] ? check_same_owner+0x340/0x340 [ 26.594498] ? p9_fd_poll+0x2b0/0x2b0 [ 26.598282] ? kasan_kmalloc+0xc4/0xe0 [ 26.602164] ? p9_fd_show_options+0x1c0/0x1c0 [ 26.606663] p9_client_create+0x6d0/0x1537 [ 26.610887] ? p9_client_read+0xbb0/0xbb0 [ 26.615036] ? lock_acquire+0x1e4/0x540 [ 26.619002] ? fs_reclaim_acquire+0x20/0x20 [ 26.623316] ? lock_release+0xa30/0xa30 [ 26.627293] ? __lockdep_init_map+0x105/0x590 [ 26.631783] ? kasan_check_write+0x14/0x20 [ 26.636001] ? __init_rwsem+0x1cc/0x2a0 [ 26.639972] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 26.644981] ? __kmalloc_track_caller+0x311/0x760 [ 26.649811] ? save_stack+0xa9/0xd0 [ 26.653422] ? save_stack+0x43/0xd0 [ 26.657034] ? kasan_kmalloc+0xc4/0xe0 [ 26.660907] ? memcpy+0x45/0x50 [ 26.664170] v9fs_session_init+0x21a/0x1a80 [ 26.668472] ? rcu_note_context_switch+0x730/0x730 [ 26.673403] ? legacy_parse_monolithic+0xde/0x1e0 [ 26.678241] ? v9fs_show_options+0x7e0/0x7e0 [ 26.682632] ? lock_release+0xa30/0xa30 [ 26.686601] ? lock_downgrade+0x8f0/0x8f0 [ 26.690729] ? check_same_owner+0x340/0x340 [ 26.695037] ? kasan_unpoison_shadow+0x35/0x50 [ 26.699625] ? kasan_kmalloc+0xc4/0xe0 [ 26.703504] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.708671] ? kasan_unpoison_shadow+0x35/0x50 [ 26.713234] ? kasan_kmalloc+0xc4/0xe0 [ 26.717106] v9fs_mount+0x7c/0x900 [ 26.720640] ? v9fs_drop_inode+0x150/0x150 [ 26.724857] legacy_get_tree+0x131/0x460 [ 26.728900] vfs_get_tree+0x1cb/0x5c0 [ 26.732690] do_mount+0x6f2/0x1e20 [ 26.736208] ? do_raw_spin_unlock+0xa7/0x2f0 [ 26.740604] ? copy_mount_string+0x40/0x40 [ 26.744828] ? kasan_kmalloc+0xc4/0xe0 [ 26.748701] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.753527] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 26.759053] ? copy_mount_options+0x285/0x380 [ 26.763544] ksys_mount+0x12d/0x140 [ 26.767160] __x64_sys_mount+0xbe/0x150 [ 26.771128] do_syscall_64+0x1b9/0x820 [ 26.775008] ? syscall_return_slowpath+0x5e0/0x5e0 [ 26.779931] ? syscall_return_slowpath+0x31d/0x5e0 [ 26.784842] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 26.789852] ? prepare_exit_to_usermode+0x291/0x3b0 [ 26.794859] ? perf_trace_sys_enter+0xb10/0xb10 [ 26.799515] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.804345] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 26.809520] RIP: 0033:0x4402d9 [ 26.812690] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 26.831830] RSP: 002b:00007ffd58213778 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 26.839531] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00000000004402d9 [ 26.846783] RDX: 0000000020000900 RSI: 0000000020000000 RDI: 0000000000000000 [ 26.854038] RBP: 0030656c69662f2e R08: 0000000020000840 R09: 00000000004002c8 [ 26.861293] R10: 0000000000000000 R11: 0000000000000206 R12: 64663d736e617274 [ 26.868559] R13: 0000000000401bf0 R14: 0000000000000000 R15: 0000000000000000 [ 26.876363] Dumping ftrace buffer: [ 26.879892] (ftrace buffer empty) [ 26.883603] Kernel Offset: disabled [ 26.887217] Rebooting in 86400 seconds..