[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 13.695205] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 15.907769] random: sshd: uninitialized urandom read (32 bytes read) [ 16.130510] random: sshd: uninitialized urandom read (32 bytes read) [ 16.883446] random: sshd: uninitialized urandom read (32 bytes read) [ 21.952274] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.20' (ECDSA) to the list of known hosts. [ 27.367655] random: sshd: uninitialized urandom read (32 bytes read) 2018/05/12 04:03:57 parsed 1 programs 2018/05/12 04:03:57 executed programs: 0 [ 27.812436] IPVS: Creating netns size=2536 id=1 [ 31.989484] ================================================================== [ 31.996867] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 32.004118] Read of size 4 at addr ffff8801c3429900 by task syz-executor0/3952 [ 32.011443] [ 32.013043] CPU: 0 PID: 3952 Comm: syz-executor0 Not tainted 4.9.99-gc2f9bce #25 [ 32.020545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.029869] ffff8801d8957ca0 ffffffff81eb0f09 ffffea00070d0a00 ffff8801c3429900 [ 32.037862] 0000000000000000 ffff8801c3429900 ffffffff8300fbe0 ffff8801d8957cd8 [ 32.045834] ffffffff815652eb ffff8801c3429900 0000000000000004 0000000000000000 [ 32.053809] Call Trace: [ 32.056365] [] dump_stack+0xc1/0x128 [ 32.061707] [] ? sock_release+0x1c0/0x1c0 [ 32.067472] [] print_address_description+0x6c/0x234 [ 32.074114] [] ? sock_release+0x1c0/0x1c0 [ 32.079889] [] kasan_report.cold.6+0x242/0x2fe [ 32.086092] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 32.092818] [] __asan_report_load4_noabort+0x14/0x20 [ 32.099539] [] l2tp_session_queue_purge+0xf4/0x100 [ 32.106089] [] ? sock_release+0x1c0/0x1c0 [ 32.111865] [] pppol2tp_release+0x1fb/0x2e0 [ 32.117816] [] sock_release+0x96/0x1c0 [ 32.123333] [] sock_close+0x16/0x20 [ 32.128581] [] __fput+0x263/0x700 [ 32.133664] [] ____fput+0x15/0x20 [ 32.138740] [] task_work_run+0x10c/0x180 [ 32.144422] [] exit_to_usermode_loop+0xfc/0x120 [ 32.150710] [] do_fast_syscall_32+0x5c3/0x870 [ 32.156824] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 32.163460] [] entry_SYSENTER_compat+0x90/0xa2 [ 32.169659] [ 32.171254] Allocated by task 3952: [ 32.174850] save_stack_trace+0x16/0x20 [ 32.178791] save_stack+0x43/0xd0 [ 32.182211] kasan_kmalloc+0xc7/0xe0 [ 32.185893] __kmalloc+0x11d/0x300 [ 32.189403] l2tp_session_create+0x38/0x16f0 [ 32.193781] pppol2tp_connect+0x10d7/0x18f0 [ 32.198080] SYSC_connect+0x1b8/0x300 [ 32.201858] SyS_connect+0x24/0x30 [ 32.205367] do_fast_syscall_32+0x2f7/0x870 [ 32.209660] entry_SYSENTER_compat+0x90/0xa2 [ 32.214032] [ 32.215629] Freed by task 3951: [ 32.218877] save_stack_trace+0x16/0x20 [ 32.222818] save_stack+0x43/0xd0 [ 32.226241] kasan_slab_free+0x72/0xc0 [ 32.230095] kfree+0xfb/0x310 [ 32.233169] l2tp_session_free+0x166/0x200 [ 32.237371] l2tp_tunnel_closeall+0x284/0x350 [ 32.241843] l2tp_udp_encap_destroy+0x87/0xe0 [ 32.246306] udpv6_destroy_sock+0xb1/0xd0 [ 32.250423] sk_common_release+0x6d/0x300 [ 32.254546] udp_lib_close+0x15/0x20 [ 32.258235] inet_release+0xff/0x1d0 [ 32.261920] inet6_release+0x50/0x70 [ 32.265604] sock_release+0x96/0x1c0 [ 32.269288] sock_close+0x16/0x20 [ 32.272714] __fput+0x263/0x700 [ 32.275967] ____fput+0x15/0x20 [ 32.279216] task_work_run+0x10c/0x180 [ 32.283071] exit_to_usermode_loop+0xfc/0x120 [ 32.287549] do_fast_syscall_32+0x5c3/0x870 [ 32.291849] entry_SYSENTER_compat+0x90/0xa2 [ 32.296226] [ 32.297826] The buggy address belongs to the object at ffff8801c3429900 [ 32.297826] which belongs to the cache kmalloc-512 of size 512 [ 32.310451] The buggy address is located 0 bytes inside of [ 32.310451] 512-byte region [ffff8801c3429900, ffff8801c3429b00) [ 32.322120] The buggy address belongs to the page: [ 32.327027] page:ffffea00070d0a00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 32.337205] flags: 0x8000000000004080(slab|head) [ 32.341930] page dumped because: kasan: bad access detected [ 32.347605] [ 32.349203] Memory state around the buggy address: [ 32.354103] ffff8801c3429800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.361430] ffff8801c3429880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.368765] >ffff8801c3429900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.376091] ^ [ 32.379424] ffff8801c3429980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.386752] ffff8801c3429a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.394078] ================================================================== [ 32.401413] Disabling lock debugging due to kernel taint [ 32.407055] Kernel panic - not syncing: panic_on_warn set ... [ 32.407055] [ 32.414398] CPU: 0 PID: 3952 Comm: syz-executor0 Tainted: G B 4.9.99-gc2f9bce #25 [ 32.423119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.432709] ffff8801d8957c00 ffffffff81eb0f09 ffffffff843c5065 00000000ffffffff [ 32.440703] 0000000000000000 0000000000000000 ffffffff8300fbe0 ffff8801d8957cc0 [ 32.448692] ffffffff8141f855 0000000041b58ab3 ffffffff843b8768 ffffffff8141f696 [ 32.456668] Call Trace: [ 32.459229] [] dump_stack+0xc1/0x128 [ 32.464573] [] ? sock_release+0x1c0/0x1c0 [ 32.470342] [] panic+0x1bf/0x3bc [ 32.475333] [] ? add_taint.cold.6+0x16/0x16 [ 32.481283] [] ? ___preempt_schedule+0x16/0x18 [ 32.487484] [] kasan_end_report+0x47/0x4f [ 32.493251] [] kasan_report.cold.6+0x76/0x2fe [ 32.499368] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 32.506101] [] __asan_report_load4_noabort+0x14/0x20 [ 32.512826] [] l2tp_session_queue_purge+0xf4/0x100 [ 32.519376] [] ? sock_release+0x1c0/0x1c0 [ 32.525146] [] pppol2tp_release+0x1fb/0x2e0 [ 32.531086] [] sock_release+0x96/0x1c0 [ 32.536594] [] sock_close+0x16/0x20 [ 32.541840] [] __fput+0x263/0x700 [ 32.546913] [] ____fput+0x15/0x20 [ 32.551986] [] task_work_run+0x10c/0x180 [ 32.557670] [] exit_to_usermode_loop+0xfc/0x120 [ 32.563957] [] do_fast_syscall_32+0x5c3/0x870 [ 32.570074] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 32.576712] [] entry_SYSENTER_compat+0x90/0xa2 [ 32.583271] Dumping ftrace buffer: [ 32.586779] (ftrace buffer empty) [ 32.590461] Kernel Offset: disabled [ 32.594069] Rebooting in 86400 seconds..