[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 14.148181] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.834124] random: sshd: uninitialized urandom read (32 bytes read) [ 19.142382] random: sshd: uninitialized urandom read (32 bytes read) [ 19.963764] random: sshd: uninitialized urandom read (32 bytes read) [ 23.062304] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.43' (ECDSA) to the list of known hosts. [ 28.468162] random: sshd: uninitialized urandom read (32 bytes read) 2018/05/11 23:34:39 parsed 1 programs 2018/05/11 23:34:39 executed programs: 0 [ 29.042596] IPVS: Creating netns size=2536 id=1 [ 29.074120] IPVS: Creating netns size=2536 id=2 [ 29.097609] IPVS: Creating netns size=2536 id=3 [ 29.119457] IPVS: Creating netns size=2536 id=4 [ 29.146030] IPVS: Creating netns size=2536 id=5 [ 29.171359] IPVS: Creating netns size=2536 id=6 [ 29.195637] IPVS: Creating netns size=2536 id=7 [ 29.225324] IPVS: Creating netns size=2536 id=8 2018/05/11 23:34:44 executed programs: 137 [ 34.170497] ================================================================== [ 34.177924] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 34.184670] Read of size 8 at addr ffff8801d6ffb860 by task blkid/4220 [ 34.191328] [ 34.192958] CPU: 0 PID: 4220 Comm: blkid Not tainted 4.9.99-gc2f9bce #25 [ 34.199817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.209170] ffff8801cd1b76d8 ffffffff81eb0f09 ffffea00075bfe00 ffff8801d6ffb860 [ 34.217223] 0000000000000000 ffff8801d6ffb860 0000000000000000 ffff8801cd1b7710 [ 34.225309] ffffffff815652eb ffff8801d6ffb860 0000000000000008 0000000000000000 [ 34.233463] Call Trace: [ 34.236045] [] dump_stack+0xc1/0x128 [ 34.241404] [] print_address_description+0x6c/0x234 [ 34.248070] [] kasan_report.cold.6+0x242/0x2fe [ 34.254310] [] ? disk_unblock_events+0x51/0x60 [ 34.260544] [] __asan_report_load8_noabort+0x14/0x20 [ 34.267302] [] disk_unblock_events+0x51/0x60 [ 34.273365] [] __blkdev_get+0x6b6/0xd60 [ 34.279012] [] ? __blkdev_put+0x840/0x840 [ 34.284811] [] ? fsnotify+0x114/0x1100 [ 34.290352] [] blkdev_get+0x2da/0x920 [ 34.295808] [] ? bd_may_claim+0xd0/0xd0 [ 34.301435] [] ? bd_acquire+0x27/0x250 [ 34.307058] [] ? bd_acquire+0x88/0x250 [ 34.312600] [] ? _raw_spin_unlock+0x2c/0x50 [ 34.318573] [] blkdev_open+0x1a5/0x250 [ 34.324113] [] do_dentry_open+0x703/0xc80 [ 34.329915] [] ? blkdev_get_by_dev+0x70/0x70 [ 34.335982] [] vfs_open+0x11c/0x210 [ 34.341279] [] ? may_open.isra.57+0x14f/0x2a0 [ 34.347441] [] path_openat+0x758/0x3590 [ 34.353078] [] ? save_stack+0xa9/0xd0 [ 34.358541] [] ? path_lookupat.isra.41+0x410/0x410 [ 34.365129] [] ? __lock_is_held+0xa2/0xf0 [ 34.370942] [] do_filp_open+0x197/0x270 [ 34.376582] [] ? may_open_dev+0xe0/0xe0 [ 34.382210] [] ? _raw_spin_unlock+0x2c/0x50 [ 34.388182] [] ? __alloc_fd+0x1d7/0x4a0 [ 34.393816] [] do_sys_open+0x30d/0x5c0 [ 34.399354] [] ? filp_open+0x70/0x70 [ 34.404724] [] ? up_read+0x1a/0x40 [ 34.409923] [] ? __do_page_fault+0x183/0xd50 [ 34.415983] [] SyS_open+0x2d/0x40 [ 34.421096] [] ? do_sys_open+0x5c0/0x5c0 [ 34.426818] [] do_syscall_64+0x1a6/0x490 [ 34.432550] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 34.439476] [ 34.441095] Allocated by task 4218: [ 34.444719] save_stack_trace+0x16/0x20 [ 34.448700] save_stack+0x43/0xd0 [ 34.452151] kasan_kmalloc+0xc7/0xe0 [ 34.455864] kmem_cache_alloc_trace+0xfd/0x2b0 [ 34.460454] alloc_disk_node+0x54/0x3a0 [ 34.464425] alloc_disk+0x18/0x20 [ 34.467873] loop_add+0x33b/0x770 [ 34.471319] loop_probe+0x14f/0x180 [ 34.474942] kobj_lookup+0x223/0x410 [ 34.478656] get_gendisk+0x39/0x2d0 [ 34.482286] blkdev_get+0xf6/0x920 [ 34.485828] blkdev_open+0x1a5/0x250 [ 34.489544] do_dentry_open+0x703/0xc80 [ 34.493523] vfs_open+0x11c/0x210 [ 34.496979] path_openat+0x758/0x3590 [ 34.500775] do_filp_open+0x197/0x270 [ 34.504573] do_sys_open+0x30d/0x5c0 [ 34.508283] compat_SyS_open+0x2a/0x40 [ 34.512167] do_fast_syscall_32+0x2f7/0x870 [ 34.516485] entry_SYSENTER_compat+0x90/0xa2 [ 34.520882] [ 34.522511] Freed by task 4220: [ 34.525795] save_stack_trace+0x16/0x20 [ 34.529785] save_stack+0x43/0xd0 [ 34.533240] kasan_slab_free+0x72/0xc0 [ 34.537123] kfree+0xfb/0x310 [ 34.540222] disk_release+0x259/0x330 [ 34.544022] device_release+0x7e/0x220 [ 34.548078] kobject_release+0x103/0x1b0 [ 34.552136] kobject_put+0x6d/0xd0 [ 34.555670] put_disk+0x23/0x30 [ 34.558947] __blkdev_get+0x616/0xd60 [ 34.562764] blkdev_get+0x2da/0x920 [ 34.566382] blkdev_open+0x1a5/0x250 [ 34.570090] do_dentry_open+0x703/0xc80 [ 34.574056] vfs_open+0x11c/0x210 [ 34.577510] path_openat+0x758/0x3590 [ 34.577516] do_filp_open+0x197/0x270 [ 34.577523] do_sys_open+0x30d/0x5c0 [ 34.577528] SyS_open+0x2d/0x40 [ 34.577535] do_syscall_64+0x1a6/0x490 [ 34.577542] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 34.577543] [ 34.577548] The buggy address belongs to the object at ffff8801d6ffb300 [ 34.577548] which belongs to the cache kmalloc-2048 of size 2048 [ 34.577553] The buggy address is located 1376 bytes inside of [ 34.577553] 2048-byte region [ffff8801d6ffb300, ffff8801d6ffbb00) [ 34.577555] The buggy address belongs to the page: [ 34.577564] page:ffffea00075bfe00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 34.577569] flags: 0x8000000000004080(slab|head) [ 34.577572] page dumped because: kasan: bad access detected [ 34.577573] [ 34.577575] Memory state around the buggy address: [ 34.577581] ffff8801d6ffb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.577586] ffff8801d6ffb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.577590] >ffff8801d6ffb800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.577592] ^ [ 34.577596] ffff8801d6ffb880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.577601] ffff8801d6ffb900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.577603] ================================================================== [ 34.577605] Disabling lock debugging due to kernel taint [ 34.588410] Kernel panic - not syncing: panic_on_warn set ... [ 34.588410] [ 34.588421] CPU: 0 PID: 4220 Comm: blkid Tainted: G B 4.9.99-gc2f9bce #25 [ 34.588424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.588437] ffff8801cd1b7638 ffffffff81eb0f09 ffffffff843c5065 00000000ffffffff [ 34.588446] 0000000000000000 0000000000000000 0000000000000000 ffff8801cd1b76f8 [ 34.588455] ffffffff8141f855 0000000041b58ab3 ffffffff843b8768 ffffffff8141f696 [ 34.588457] Call Trace: [ 34.588470] [] dump_stack+0xc1/0x128 [ 34.588478] [] panic+0x1bf/0x3bc [ 34.588485] [] ? add_taint.cold.6+0x16/0x16 [ 34.588493] [] ? ___preempt_schedule+0x16/0x18 [ 34.588501] [] kasan_end_report+0x47/0x4f [ 34.588507] [] kasan_report.cold.6+0x76/0x2fe [ 34.588516] [] ? disk_unblock_events+0x51/0x60 [ 34.588524] [] __asan_report_load8_noabort+0x14/0x20 [ 34.588530] [] disk_unblock_events+0x51/0x60 [ 34.588539] [] __blkdev_get+0x6b6/0xd60 [ 34.588545] [] ? __blkdev_put+0x840/0x840 [ 34.588552] [] ? fsnotify+0x114/0x1100 [ 34.588558] [] blkdev_get+0x2da/0x920 [ 34.588565] [] ? bd_may_claim+0xd0/0xd0 [ 34.588571] [] ? bd_acquire+0x27/0x250 [ 34.588577] [] ? bd_acquire+0x88/0x250 [ 34.588588] [] ? _raw_spin_unlock+0x2c/0x50 [ 34.588594] [] blkdev_open+0x1a5/0x250 [ 34.588601] [] do_dentry_open+0x703/0xc80 [ 34.588607] [] ? blkdev_get_by_dev+0x70/0x70 [ 34.588614] [] vfs_open+0x11c/0x210 [ 34.588622] [] ? may_open.isra.57+0x14f/0x2a0 [ 34.588629] [] path_openat+0x758/0x3590 [ 34.588635] [] ? save_stack+0xa9/0xd0 [ 34.588643] [] ? path_lookupat.isra.41+0x410/0x410 [ 34.588651] [] ? __lock_is_held+0xa2/0xf0 [ 34.588658] [] do_filp_open+0x197/0x270 [ 34.588666] [] ? may_open_dev+0xe0/0xe0 [ 34.588673] [] ? _raw_spin_unlock+0x2c/0x50 [ 34.588681] [] ? __alloc_fd+0x1d7/0x4a0 [ 34.588688] [] do_sys_open+0x30d/0x5c0 [ 34.588694] [] ? filp_open+0x70/0x70 [ 34.588701] [] ? up_read+0x1a/0x40 [ 34.588711] [] ? __do_page_fault+0x183/0xd50 [ 34.588717] [] SyS_open+0x2d/0x40 [ 34.588724] [] ? do_sys_open+0x5c0/0x5c0 [ 34.588740] [] do_syscall_64+0x1a6/0x490 [ 34.588747] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 34.589338] Dumping ftrace buffer: [ 34.589342] (ftrace buffer empty) [ 34.589344] Kernel Offset: disabled [ 35.007318] Rebooting in 86400 seconds..