[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 15.940342] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.187576] random: sshd: uninitialized urandom read (32 bytes read) [ 19.620673] random: sshd: uninitialized urandom read (32 bytes read) [ 20.360338] random: sshd: uninitialized urandom read (32 bytes read) [ 20.498764] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.53' (ECDSA) to the list of known hosts. [ 25.996774] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 26.127179] ================================================================== [ 26.134604] BUG: KASAN: slab-out-of-bounds in pdu_read+0x90/0xd0 [ 26.140749] Read of size 60719 at addr ffff8801ad0384ed by task syz-executor022/4479 [ 26.148609] [ 26.150239] CPU: 1 PID: 4479 Comm: syz-executor022 Not tainted 4.18.0-rc5-next-20180719+ #11 [ 26.158813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.168161] Call Trace: [ 26.170739] dump_stack+0x1c9/0x2b4 [ 26.174369] ? dump_stack_print_info.cold.2+0x52/0x52 [ 26.179539] ? printk+0xa7/0xcf [ 26.182800] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 26.187555] ? pdu_read+0x90/0xd0 [ 26.190992] print_address_description+0x6c/0x20b [ 26.195829] ? pdu_read+0x90/0xd0 [ 26.199275] kasan_report.cold.7+0x242/0x30d [ 26.203688] check_memory_region+0x13e/0x1b0 [ 26.208099] memcpy+0x23/0x50 [ 26.211209] pdu_read+0x90/0xd0 [ 26.214494] p9pdu_readf+0x579/0x2170 [ 26.218310] ? p9pdu_writef+0xe0/0xe0 [ 26.222126] ? ksys_dup3+0x690/0x690 [ 26.225840] ? check_same_owner+0x340/0x340 [ 26.230146] ? p9_fd_poll+0x2b0/0x2b0 [ 26.233958] ? finish_wait+0x430/0x430 [ 26.237836] ? p9_fd_show_options+0x1c0/0x1c0 [ 26.242327] p9_client_create+0x6d0/0x1537 [ 26.246546] ? p9_client_read+0xbb0/0xbb0 [ 26.250676] ? lock_acquire+0x1e4/0x540 [ 26.254629] ? fs_reclaim_acquire+0x20/0x20 [ 26.258934] ? lock_release+0xa30/0xa30 [ 26.262887] ? __lockdep_init_map+0x105/0x590 [ 26.267369] ? kasan_check_write+0x14/0x20 [ 26.271587] ? __init_rwsem+0x1cc/0x2a0 [ 26.275543] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 26.280550] ? __kmalloc_track_caller+0x311/0x760 [ 26.285394] ? save_stack+0xa9/0xd0 [ 26.289362] ? save_stack+0x43/0xd0 [ 26.292966] ? kasan_kmalloc+0xc4/0xe0 [ 26.296841] ? memcpy+0x45/0x50 [ 26.300106] v9fs_session_init+0x21a/0x1a80 [ 26.304412] ? rcu_note_context_switch+0x730/0x730 [ 26.309800] ? legacy_parse_monolithic+0xde/0x1e0 [ 26.314626] ? v9fs_show_options+0x7e0/0x7e0 [ 26.319016] ? lock_release+0xa30/0xa30 [ 26.322969] ? check_same_owner+0x340/0x340 [ 26.327270] ? lock_downgrade+0x8f0/0x8f0 [ 26.331398] ? kasan_unpoison_shadow+0x35/0x50 [ 26.335958] ? kasan_kmalloc+0xc4/0xe0 [ 26.339827] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.344647] ? kasan_unpoison_shadow+0x35/0x50 [ 26.349217] ? kasan_kmalloc+0xc4/0xe0 [ 26.353084] v9fs_mount+0x7c/0x900 [ 26.356604] ? v9fs_drop_inode+0x150/0x150 [ 26.360816] legacy_get_tree+0x131/0x460 [ 26.364858] vfs_get_tree+0x1cb/0x5c0 [ 26.368772] do_mount+0x6f2/0x1e20 [ 26.372296] ? check_same_owner+0x340/0x340 [ 26.376628] ? lock_release+0xa30/0xa30 [ 26.380585] ? copy_mount_string+0x40/0x40 [ 26.384829] ? kasan_kmalloc+0xc4/0xe0 [ 26.388698] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.393997] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 26.399515] ? _copy_from_user+0xdf/0x150 [ 26.403644] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 26.409163] ? copy_mount_options+0x285/0x380 [ 26.413637] ksys_mount+0x12d/0x140 [ 26.417247] __x64_sys_mount+0xbe/0x150 [ 26.421207] do_syscall_64+0x1b9/0x820 [ 26.425075] ? finish_task_switch+0x1d3/0x870 [ 26.429551] ? syscall_return_slowpath+0x5e0/0x5e0 [ 26.434462] ? syscall_return_slowpath+0x31d/0x5e0 [ 26.439376] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 26.444377] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 26.449897] ? prepare_exit_to_usermode+0x291/0x3b0 [ 26.454894] ? perf_trace_sys_enter+0xb10/0xb10 [ 26.459548] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.464377] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 26.469571] RIP: 0033:0x445ec9 [ 26.472737] Code: e8 ac e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 26.491867] RSP: 002b:00007fd1fe371da8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 26.499555] RAX: ffffffffffffffda RBX: 00000000006dbc24 RCX: 0000000000445ec9 [ 26.506818] RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000 [ 26.514066] RBP: 0000000000000000 R08: 00000000200001c0 R09: 0000000000000000 [ 26.521315] R10: 0000000000000000 R11: 0000000000000202 R12: 00000000006dbc20 [ 26.528565] R13: 0030656c69662f2e R14: 64663d736e617274 R15: 0000000000000006 [ 26.535816] [ 26.537435] Allocated by task 4479: [ 26.541047] save_stack+0x43/0xd0 [ 26.544477] kasan_kmalloc+0xc4/0xe0 [ 26.548181] __kmalloc+0x14e/0x760 [ 26.551699] p9_fcall_alloc+0x1e/0x90 [ 26.555476] p9_client_prepare_req.part.8+0x132/0xa00 [ 26.560645] p9_client_rpc+0x242/0x1330 [ 26.564605] p9_client_create+0xca4/0x1537 [ 26.568822] v9fs_session_init+0x21a/0x1a80 [ 26.573130] v9fs_mount+0x7c/0x900 [ 26.576648] legacy_get_tree+0x131/0x460 [ 26.580687] vfs_get_tree+0x1cb/0x5c0 [ 26.584465] do_mount+0x6f2/0x1e20 [ 26.587980] ksys_mount+0x12d/0x140 [ 26.591584] __x64_sys_mount+0xbe/0x150 [ 26.595552] do_syscall_64+0x1b9/0x820 [ 26.599425] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 26.604585] [ 26.606187] Freed by task 0: [ 26.609186] (stack is not available) [ 26.612881] [ 26.614487] The buggy address belongs to the object at ffff8801ad0384c0 [ 26.614487] which belongs to the cache kmalloc-16384 of size 16384 [ 26.627470] The buggy address is located 45 bytes inside of [ 26.627470] 16384-byte region [ffff8801ad0384c0, ffff8801ad03c4c0) [ 26.639404] The buggy address belongs to the page: [ 26.644313] page:ffffea0006b40e00 count:1 mapcount:0 mapping:ffff8801da802200 index:0x0 compound_mapcount: 0 [ 26.654265] flags: 0x2fffc0000010200(slab|head) [ 26.658913] raw: 02fffc0000010200 ffffea0006b41008 ffffea0006b48208 ffff8801da802200 [ 26.666774] raw: 0000000000000000 ffff8801ad0384c0 0000000100000001 0000000000000000 [ 26.674627] page dumped because: kasan: bad access detected [ 26.680311] [ 26.681915] Memory state around the buggy address: [ 26.686819] ffff8801ad03a380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.694163] ffff8801ad03a400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.701497] >ffff8801ad03a480: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 26.708830] ^ [ 26.715308] ffff8801ad03a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.722642] ffff8801ad03a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.729974] ================================================================== [ 26.737439] Kernel panic - not syncing: panic_on_warn set ... [ 26.737439] [ 26.744787] CPU: 1 PID: 4479 Comm: syz-executor022 Tainted: G B 4.18.0-rc5-next-20180719+ #11 [ 26.754727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.764059] Call Trace: [ 26.766629] dump_stack+0x1c9/0x2b4 [ 26.770234] ? dump_stack_print_info.cold.2+0x52/0x52 [ 26.775405] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.780152] panic+0x238/0x4e7 [ 26.783324] ? add_taint.cold.5+0x16/0x16 [ 26.787452] ? do_raw_spin_unlock+0xa7/0x2f0 [ 26.791845] ? pdu_read+0x90/0xd0 [ 26.795294] kasan_end_report+0x47/0x4f [ 26.799251] kasan_report.cold.7+0x76/0x30d [ 26.803557] check_memory_region+0x13e/0x1b0 [ 26.807954] memcpy+0x23/0x50 [ 26.811040] pdu_read+0x90/0xd0 [ 26.814297] p9pdu_readf+0x579/0x2170 [ 26.818080] ? p9pdu_writef+0xe0/0xe0 [ 26.821863] ? ksys_dup3+0x690/0x690 [ 26.825556] ? check_same_owner+0x340/0x340 [ 26.829868] ? p9_fd_poll+0x2b0/0x2b0 [ 26.833648] ? finish_wait+0x430/0x430 [ 26.837517] ? p9_fd_show_options+0x1c0/0x1c0 [ 26.841993] p9_client_create+0x6d0/0x1537 [ 26.846211] ? p9_client_read+0xbb0/0xbb0 [ 26.850340] ? lock_acquire+0x1e4/0x540 [ 26.854309] ? fs_reclaim_acquire+0x20/0x20 [ 26.858610] ? lock_release+0xa30/0xa30 [ 26.862563] ? __lockdep_init_map+0x105/0x590 [ 26.867042] ? kasan_check_write+0x14/0x20 [ 26.871270] ? __init_rwsem+0x1cc/0x2a0 [ 26.875225] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 26.880237] ? __kmalloc_track_caller+0x311/0x760 [ 26.885060] ? save_stack+0xa9/0xd0 [ 26.888665] ? save_stack+0x43/0xd0 [ 26.892268] ? kasan_kmalloc+0xc4/0xe0 [ 26.896135] ? memcpy+0x45/0x50 [ 26.899412] v9fs_session_init+0x21a/0x1a80 [ 26.904069] ? rcu_note_context_switch+0x730/0x730 [ 26.908981] ? legacy_parse_monolithic+0xde/0x1e0 [ 26.913806] ? v9fs_show_options+0x7e0/0x7e0 [ 26.918199] ? lock_release+0xa30/0xa30 [ 26.922254] ? check_same_owner+0x340/0x340 [ 26.926555] ? lock_downgrade+0x8f0/0x8f0 [ 26.930686] ? kasan_unpoison_shadow+0x35/0x50 [ 26.935249] ? kasan_kmalloc+0xc4/0xe0 [ 26.939118] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.943952] ? kasan_unpoison_shadow+0x35/0x50 [ 26.948525] ? kasan_kmalloc+0xc4/0xe0 [ 26.952393] v9fs_mount+0x7c/0x900 [ 26.955928] ? v9fs_drop_inode+0x150/0x150 [ 26.960148] legacy_get_tree+0x131/0x460 [ 26.964193] vfs_get_tree+0x1cb/0x5c0 [ 26.967974] do_mount+0x6f2/0x1e20 [ 26.971494] ? check_same_owner+0x340/0x340 [ 26.975803] ? lock_release+0xa30/0xa30 [ 26.979756] ? copy_mount_string+0x40/0x40 [ 26.983971] ? kasan_kmalloc+0xc4/0xe0 [ 26.987842] ? kmem_cache_alloc_trace+0x318/0x780 [ 26.992757] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 26.998275] ? _copy_from_user+0xdf/0x150 [ 27.002406] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 27.007934] ? copy_mount_options+0x285/0x380 [ 27.012412] ksys_mount+0x12d/0x140 [ 27.016021] __x64_sys_mount+0xbe/0x150 [ 27.019975] do_syscall_64+0x1b9/0x820 [ 27.023852] ? finish_task_switch+0x1d3/0x870 [ 27.028327] ? syscall_return_slowpath+0x5e0/0x5e0 [ 27.033241] ? syscall_return_slowpath+0x31d/0x5e0 [ 27.038150] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 27.043157] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 27.048673] ? prepare_exit_to_usermode+0x291/0x3b0 [ 27.053668] ? perf_trace_sys_enter+0xb10/0xb10 [ 27.058315] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.063142] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.068312] RIP: 0033:0x445ec9 [ 27.071490] Code: e8 ac e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 27.090622] RSP: 002b:00007fd1fe371da8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 27.098575] RAX: ffffffffffffffda RBX: 00000000006dbc24 RCX: 0000000000445ec9 [ 27.105823] RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000 [ 27.113082] RBP: 0000000000000000 R08: 00000000200001c0 R09: 0000000000000000 [ 27.120328] R10: 0000000000000000 R11: 0000000000000202 R12: 00000000006dbc20 [ 27.127588] R13: 0030656c69662f2e R14: 64663d736e617274 R15: 0000000000000006 [ 27.135212] Dumping ftrace buffer: [ 27.138733] (ftrace buffer empty) [ 27.142433] Kernel Offset: disabled [ 27.146036] Rebooting in 86400 seconds..