[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 10.634458] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 11.571265] random: crng init done Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.84' (ECDSA) to the list of known hosts. 2018/09/22 17:27:49 parsed 1 programs 2018/09/22 17:27:51 executed programs: 0 syzkaller login: [ 47.983517] audit: type=1400 audit(1537637275.934:5): avc: denied { associate } for pid=2084 comm="syz-executor4" name="syz4" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 48.090435] pts pts0: tty_release: tty->count(2) != #fd's(1) [ 48.103881] pts pts1: tty_release: tty->count(2) != #fd's(1) [ 48.116919] pts pts2: tty_release: tty->count(2) != #fd's(1) [ 48.127344] pts pts3: tty_release: tty->count(2) != #fd's(1) [ 48.141638] pts pts4: tty_release: tty->count(2) != #fd's(1) [ 48.141721] pts pts5: tty_release: tty->count(2) != #fd's(1) [ 48.176451] ================================================================== [ 48.176464] BUG: KASAN: user-memory-access in n_tty_set_termios+0xf6/0xd30 [ 48.176470] Write of size 512 at addr 0000000000001060 by task syz-executor4/4690 [ 48.176471] [ 48.176478] CPU: 1 PID: 4690 Comm: syz-executor4 Not tainted 4.9.128+ #41 [ 48.176490] ffff8801c420f708 ffffffff81af2469 0000000000001060 0000000000000200 [ 48.176499] 0000000000000001 000000000000005d ffff8801c420f848 ffff8801c420f750 [ 48.176508] ffffffff814e1600 ffffffff81cd72c6 0000000000000286 1ea2fdbc9100f710 [ 48.176509] Call Trace: [ 48.176519] [] dump_stack+0xc1/0x128 [ 48.176540] [] kasan_report.cold.6+0x6d/0x2fe [ 48.176547] [] ? n_tty_set_termios+0xf6/0xd30 [ 48.176554] [] check_memory_region+0x14d/0x1b0 [ 48.176560] [] memset+0x23/0x40 [ 48.176567] [] n_tty_set_termios+0xf6/0xd30 [ 48.176574] [] ? process_echoes+0x150/0x150 [ 48.176581] [] tty_set_termios+0x626/0x8a0 [ 48.176588] [] ? tty_wait_until_sent+0x4d0/0x4d0 [ 48.176594] [] ? tty_ldisc_ref+0x71/0x80 [ 48.176601] [] ? ldsem_up_read+0x3a/0x70 [ 48.176608] [] set_termios+0x38f/0x620 [ 48.176615] [] ? __tty_perform_flush+0x220/0x220 [ 48.176623] [] tty_mode_ioctl+0x4f9/0x980 [ 48.176630] [] ? tty_perform_flush+0x80/0x80 [ 48.176638] [] ? __ldsem_down_read_nested+0xce/0x4f0 [ 48.176647] [] ? ldsem_down_read+0x32/0x40 [ 48.176655] [] ? __ldsem_wake+0x330/0x330 [ 48.176662] [] n_tty_ioctl_helper+0x44/0x370 [ 48.176669] [] n_tty_ioctl+0x46/0x2e0 [ 48.176676] [] ? ldsem_down_read+0x32/0x40 [ 48.176683] [] tty_ioctl+0x440/0x2190 [ 48.176690] [] ? n_tty_receive_buf+0x40/0x40 [ 48.176696] [] ? no_tty+0xa0/0xa0 [ 48.176704] [] ? avc_ss_reset+0x110/0x110 [ 48.176713] [] ? do_futex+0x175/0x1840 [ 48.176721] [] ? __lock_acquire+0x654/0x4a10 [ 48.176728] [] ? exit_robust_list+0x220/0x220 [ 48.176737] [] ? __might_sleep+0x95/0x1a0 [ 48.176743] [] ? no_tty+0xa0/0xa0 [ 48.176752] [] do_vfs_ioctl+0x1ac/0x11a0 [ 48.176774] [] ? ioctl_preallocate+0x220/0x220 [ 48.176783] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 48.176792] [] ? check_preemption_disabled+0x3b/0x170 [ 48.176799] [] ? __fget+0x214/0x3d0 [ 48.176806] [] ? __fget+0x23b/0x3d0 [ 48.176813] [] ? __fget+0x47/0x3d0 [ 48.176821] [] ? security_file_ioctl+0x8f/0xc0 [ 48.176829] [] SyS_ioctl+0x8f/0xc0 [ 48.176836] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 48.176844] [] do_syscall_64+0x19f/0x480 [ 48.176853] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 48.176856] ================================================================== [ 48.176858] Disabling lock debugging due to kernel taint [ 48.176883] Kernel panic - not syncing: panic_on_warn set ... [ 48.176883] [ 48.176891] CPU: 1 PID: 4690 Comm: syz-executor4 Tainted: G B 4.9.128+ #41 [ 48.176902] ffff8801c420f630 ffffffff81af2469 ffffffff82c34968 00000000ffffffff [ 48.176911] 0000000000000000 0000000000000001 ffff8801c420f848 ffff8801c420f6f0 [ 48.176920] ffffffff813df985 0000000041b58ab3 ffffffff82c2896b ffffffff813df7c6 [ 48.176922] Call Trace: [ 48.176931] [] dump_stack+0xc1/0x128 [ 48.176939] [] panic+0x1bf/0x39f [ 48.176946] [] ? add_taint.cold.6+0x16/0x16 [ 48.176955] [] kasan_end_report+0x47/0x4f [ 48.176962] [] kasan_report.cold.6+0x76/0x2fe [ 48.176969] [] ? n_tty_set_termios+0xf6/0xd30 [ 48.176977] [] check_memory_region+0x14d/0x1b0 [ 48.176983] [] memset+0x23/0x40 [ 48.176990] [] n_tty_set_termios+0xf6/0xd30 [ 48.176997] [] ? process_echoes+0x150/0x150 [ 48.177004] [] tty_set_termios+0x626/0x8a0 [ 48.177011] [] ? tty_wait_until_sent+0x4d0/0x4d0 [ 48.177018] [] ? tty_ldisc_ref+0x71/0x80 [ 48.177025] [] ? ldsem_up_read+0x3a/0x70 [ 48.177033] [] set_termios+0x38f/0x620 [ 48.177040] [] ? __tty_perform_flush+0x220/0x220 [ 48.177047] [] tty_mode_ioctl+0x4f9/0x980 [ 48.177055] [] ? tty_perform_flush+0x80/0x80 [ 48.177063] [] ? __ldsem_down_read_nested+0xce/0x4f0 [ 48.177070] [] ? ldsem_down_read+0x32/0x40 [ 48.177077] [] ? __ldsem_wake+0x330/0x330 [ 48.177085] [] n_tty_ioctl_helper+0x44/0x370 [ 48.177091] [] n_tty_ioctl+0x46/0x2e0 [ 48.177099] [] ? ldsem_down_read+0x32/0x40 [ 48.177105] [] tty_ioctl+0x440/0x2190 [ 48.177113] [] ? n_tty_receive_buf+0x40/0x40 [ 48.177119] [] ? no_tty+0xa0/0xa0 [ 48.177126] [] ? avc_ss_reset+0x110/0x110 [ 48.177134] [] ? do_futex+0x175/0x1840 [ 48.177141] [] ? __lock_acquire+0x654/0x4a10 [ 48.177149] [] ? exit_robust_list+0x220/0x220 [ 48.177158] [] ? __might_sleep+0x95/0x1a0 [ 48.177164] [] ? no_tty+0xa0/0xa0 [ 48.177172] [] do_vfs_ioctl+0x1ac/0x11a0 [ 48.177179] [] ? ioctl_preallocate+0x220/0x220 [ 48.177187] [] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 48.177194] [] ? check_preemption_disabled+0x3b/0x170 [ 48.177201] [] ? __fget+0x214/0x3d0 [ 48.177209] [] ? __fget+0x23b/0x3d0 [ 48.177215] [] ? __fget+0x47/0x3d0 [ 48.177222] [] ? security_file_ioctl+0x8f/0xc0 [ 48.177230] [] SyS_ioctl+0x8f/0xc0 [ 48.177237] [] ? do_vfs_ioctl+0x11a0/0x11a0 [ 48.177251] [] do_syscall_64+0x19f/0x480 [ 48.177261] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 48.177545] Kernel Offset: disabled [ 48.799070] Rebooting in 86400 seconds..