[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.952630] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 29.645561] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 29.967287] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 30.531748] random: sshd: uninitialized urandom read (32 bytes read, 71 bits of entropy available) [ 90.583469] random: sshd: uninitialized urandom read (32 bytes read, 94 bits of entropy available) Warning: Permanently added '10.128.15.192' (ECDSA) to the list of known hosts. [ 96.176520] random: sshd: uninitialized urandom read (32 bytes read, 98 bits of entropy available) 2018/08/14 19:06:21 parsed 1 programs [ 97.183292] random: cc1: uninitialized urandom read (8 bytes read, 100 bits of entropy available) 2018/08/14 19:06:23 executed programs: 0 [ 98.489482] IPVS: Creating netns size=2552 id=1 [ 98.545931] IPVS: Creating netns size=2552 id=2 [ 98.594510] IPVS: Creating netns size=2552 id=3 [ 98.671352] IPVS: Creating netns size=2552 id=4 [ 98.743998] IPVS: Creating netns size=2552 id=5 [ 98.858967] IPVS: Creating netns size=2552 id=6 [ 98.947761] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 98.958893] IPVS: Creating netns size=2552 id=7 [ 98.986338] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 99.055983] IPVS: Creating netns size=2552 id=8 [ 99.064478] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 99.133043] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 99.205134] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 99.272921] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 99.385768] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 99.420520] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 99.447735] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 99.459855] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 99.520661] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 99.575576] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 99.600094] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 99.623764] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 99.639158] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 99.664707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 99.711882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 99.720757] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 99.729260] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 99.755846] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 99.765660] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 99.823912] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 99.849934] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 99.891932] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 99.917394] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 99.925652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 99.986662] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 100.027511] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 100.041958] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 100.077865] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 100.096478] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 100.117039] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 100.141759] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 100.163299] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 100.176502] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 100.207888] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 100.220523] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 100.230248] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 100.343459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 100.375095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 100.447376] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 100.519143] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 100.553974] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 100.648220] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 100.740889] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 100.804983] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 100.831529] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 100.873547] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 100.885419] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 100.905365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 100.934159] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 100.947206] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 100.992759] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 101.001937] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 101.057643] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 101.088592] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 101.120236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 101.156788] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 101.183770] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 101.285867] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 101.597070] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 101.645822] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 101.738316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 101.801240] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 103.567415] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.614130] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.674876] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.833946] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.845590] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.883246] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.933037] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.129893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.514589] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 104.565952] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 104.706625] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 104.735497] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.802557] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.029665] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.249072] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 105.490724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/08/14 19:06:30 executed programs: 8 2018/08/14 19:06:35 executed programs: 216 2018/08/14 19:06:40 executed programs: 492 INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "3" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes 2018/08/14 19:06:45 executed programs: 762 2018/08/14 19:06:50 executed programs: 1044 2018/08/14 19:06:55 executed programs: 1316 2018/08/14 19:07:00 executed programs: 1593 [ 139.425980] random: nonblocking pool is initialized 2018/08/14 19:07:05 executed programs: 1878 2018/08/14 19:07:10 executed programs: 2158 2018/08/14 19:07:15 executed programs: 2452 2018/08/14 19:07:20 executed programs: 2742 2018/08/14 19:07:25 executed programs: 3046 2018/08/14 19:07:30 executed programs: 3332 2018/08/14 19:07:35 executed programs: 3636 2018/08/14 19:07:40 executed programs: 3941 2018/08/14 19:07:45 executed programs: 4231 2018/08/14 19:07:50 executed programs: 4536 2018/08/14 19:07:55 executed programs: 4826 2018/08/14 19:08:00 executed programs: 5129 2018/08/14 19:08:05 executed programs: 5420 2018/08/14 19:08:10 executed programs: 5719 2018/08/14 19:08:15 executed programs: 6021 2018/08/14 19:08:20 executed programs: 6338 2018/08/14 19:08:25 executed programs: 6650 2018/08/14 19:08:30 executed programs: 6936 2018/08/14 19:08:35 executed programs: 7232 2018/08/14 19:08:40 executed programs: 7514 2018/08/14 19:08:45 executed programs: 7819 2018/08/14 19:08:50 executed programs: 8114 2018/08/14 19:08:55 executed programs: 8421 2018/08/14 19:09:01 executed programs: 8735 2018/08/14 19:09:06 executed programs: 9044 2018/08/14 19:09:11 executed programs: 9354 [ 267.812606] ================================================================== [ 267.820139] BUG: KASAN: use-after-free in __lock_acquire+0x3c66/0x5270 [ 267.826802] Read of size 8 at addr ffff8800b23c4d20 by task syz-executor6/11124 [ 267.834233] [ 267.835864] CPU: 1 PID: 11124 Comm: syz-executor6 Not tainted 4.4.147-ga5fc665 #80 [ 267.843652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 267.853024] 0000000000000000 b2bdaaf2b799a6ac ffff8801cc01fa70 ffffffff81e12a4d [ 267.861069] ffffea0002c8f000 ffff8800b23c4d20 0000000000000000 ffff8800b23c4d20 [ 267.869295] 0000000000000000 ffff8801cc01faa8 ffffffff81517fd6 ffff8800b23c4d20 [ 267.877315] Call Trace: [ 267.879936] [] dump_stack+0xc1/0x124 [ 267.885306] [] print_address_description+0x6c/0x216 [ 267.891955] [] kasan_report.cold.7+0x175/0x2f7 [ 267.898213] [] ? __lock_acquire+0x3c66/0x5270 [ 267.904355] [] __asan_report_load8_noabort+0x14/0x20 [ 267.911103] [] __lock_acquire+0x3c66/0x5270 [ 267.917069] [] ? dput.part.26+0x587/0x760 [ 267.922844] [] ? dput+0x1f/0x30 [ 267.927752] [] ? __fput+0x401/0x6f0 [ 267.933013] [] ? ____fput+0x15/0x20 [ 267.938293] [] ? task_work_run+0x10f/0x190 [ 267.944158] [] ? __lock_acquire+0xa86/0x5270 [ 267.950189] [] ? debug_check_no_locks_freed+0x210/0x210 [ 267.957187] [] ? debug_check_no_locks_freed+0x210/0x210 [ 267.964231] [] ? debug_check_no_obj_freed+0x2ec/0x940 [ 267.971064] [] ? quarantine_put+0xda/0x180 [ 267.976927] [] lock_acquire+0x15e/0x450 [ 267.982561] [] ? lock_sock_nested+0x43/0x120 [ 267.988604] [] ? get_parent_ip+0xd/0x50 [ 267.994227] [] ? sock_release+0x1c0/0x1c0 [ 268.000039] [] _raw_spin_lock_bh+0x3a/0x50 [ 268.005993] [] ? lock_sock_nested+0x43/0x120 [ 268.012039] [] lock_sock_nested+0x43/0x120 [ 268.017954] [] pppol2tp_release+0x50/0x310 [ 268.023827] [] sock_release+0x96/0x1c0 [ 268.029339] [] sock_close+0x16/0x20 [ 268.034597] [] __fput+0x235/0x6f0 [ 268.039678] [] ____fput+0x15/0x20 [ 268.044760] [] task_work_run+0x10f/0x190 [ 268.050490] [] exit_to_usermode_loop+0x13d/0x160 [ 268.056886] [] syscall_return_slowpath+0x1b5/0x1f0 [ 268.063444] [] int_ret_from_sys_call+0x25/0xa3 [ 268.069658] [ 268.071308] Allocated by task 11134: [ 268.075005] [] save_stack_trace+0x26/0x50 [ 268.080964] [] save_stack+0x43/0xd0 [ 268.086387] [] kasan_kmalloc+0xc7/0xe0 [ 268.092045] [] __kmalloc+0x124/0x310 [ 268.097523] [] sk_prot_alloc+0x204/0x300 [ 268.103357] [] sk_alloc+0x3a/0x3a0 [ 268.108671] [] pppol2tp_create+0x33/0x1f0 [ 268.114585] [] pppox_create+0xf6/0x200 [ 268.120290] [] __sock_create+0x2f0/0x5f0 [ 268.126125] [] SyS_socket+0xf0/0x1b0 [ 268.131596] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 268.138277] [ 268.139882] Freed by task 11124: [ 268.143219] [] save_stack_trace+0x26/0x50 [ 268.149141] [] save_stack+0x43/0xd0 [ 268.154537] [] kasan_slab_free+0x72/0xc0 [ 268.160387] [] kfree+0xf4/0x310 [ 268.165431] [] sk_destruct+0x407/0x4c0 [ 268.171117] [] __sk_free+0x4f/0x220 [ 268.176522] [] sk_free+0x30/0x40 [ 268.181660] [] pppol2tp_session_sock_put+0x5f/0x70 [ 268.188358] [] l2tp_tunnel_closeall+0x23c/0x350 [ 268.194795] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 268.201216] [] udpv6_destroy_sock+0xb1/0xd0 [ 268.207369] [] sk_common_release+0x6d/0x300 [ 268.213448] [] udp_lib_close+0x15/0x20 [ 268.219118] [] inet_release+0xff/0x1d0 [ 268.224819] [] inet6_release+0x50/0x70 [ 268.230478] [] sock_release+0x96/0x1c0 [ 268.236118] [] sock_close+0x16/0x20 [ 268.241513] [] __fput+0x235/0x6f0 [ 268.246734] [] ____fput+0x15/0x20 [ 268.251967] [] task_work_run+0x10f/0x190 [ 268.257774] [] exit_to_usermode_loop+0x13d/0x160 [ 268.264279] [] syscall_return_slowpath+0x1b5/0x1f0 [ 268.270956] [] int_ret_from_sys_call+0x25/0xa3 [ 268.277306] [ 268.278912] The buggy address belongs to the object at ffff8800b23c4c80 [ 268.278912] which belongs to the cache kmalloc-2048 of size 2048 [ 268.291716] The buggy address is located 160 bytes inside of [ 268.291716] 2048-byte region [ffff8800b23c4c80, ffff8800b23c5480) [ 268.303669] The buggy address belongs to the page: [ 268.311552] BUG: unable to handle kernel paging request at fffffffde4ad6880 [ 268.318988] IP: [] cpuacct_charge+0x155/0x380 [ 268.325180] PGD 440f067 PUD 0 [ 268.328635] Oops: 0000 [#1] PREEMPT SMP KASAN [ 268.333717] Dumping ftrace buffer: [ 268.337242] (ftrace buffer empty) [ 268.341104] Modules linked in: [ 268.344443] CPU: 0 PID: 3794 Comm: syz-executor4 Not tainted 4.4.147-ga5fc665 #80 [ 268.352055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 268.361412] task: ffff8801d9a86000 task.stack: ffff8801d6c50000 [ 268.367498] RIP: 0010:[] [] cpuacct_charge+0x155/0x380 [ 268.376126] RSP: 0018:ffff8801d6c578b8 EFLAGS: 00010046 [ 268.381574] RAX: 1ffffffff089521f RBX: 00000000000185a8 RCX: ffffffff84a16600 [ 268.388831] RDX: fffffbffbc95ad10 RSI: fffffffde4ad6880 RDI: ffffffff844a90f8 [ 268.396121] RBP: ffff8801d6c578f8 R08: ffff8801d9a869c8 R09: 0000000000000001 [ 268.403396] R10: 0000000000000001 R11: ffff8801d9a86000 R12: ffffffff844a9020 [ 268.410867] R13: dffffc0000000000 R14: 000000001b9af0cb R15: ffffffffcc018050 [ 268.418150] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 268.426364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 268.432237] CR2: fffffffde4ad6880 CR3: 000000000440c000 CR4: 00000000001606f0 [ 268.439511] Stack: [ 268.441643] ffffffff81226e50 0000000000000046 0000000000000003 ffff8800ae6ab060 [ 268.449697] ffff8800ae6ab000 000000001b9af0cb ffff8800ae6ab0b0 0000000000000000 [ 268.457754] ffff8801d6c57940 ffffffff811db4c9 0000000000000005 ffff8801db31f558 [ 268.465820] Call Trace: [ 268.468408] [] ? cpuacct_charge+0x60/0x380 [ 268.474288] [] update_curr+0x2c9/0x6d0 [ 268.479817] [] enqueue_task_fair+0x2fa/0x2790 [ 268.486004] [] activate_task+0x14d/0x280 [ 268.491715] [] ttwu_do_activate.constprop.109+0xbf/0x1e0 [ 268.498806] [] try_to_wake_up+0x660/0xf00 [ 268.504593] [] ? check_preemption_disabled+0x3b/0x170 [ 268.511420] [] wake_up_state+0x10/0x20 [ 268.517005] [] signal_wake_up_state+0x44/0x70 [ 268.523160] [] complete_signal+0x62b/0x790 [ 268.529040] [] __send_signal+0x4d5/0x11b0 [ 268.534843] [] send_signal+0x4a/0xc0 [ 268.540222] [] do_send_sig_info+0xa4/0x130 [ 268.546096] [] ? __lock_task_sighand+0x470/0x470 [ 268.552495] [] send_sig_info+0x33/0x50 [ 268.558090] [] zap_pid_ns_processes+0x28d/0x690 [ 268.564401] [] ? zap_pid_ns_processes+0x1d1/0x690 [ 268.570903] [] ? copy_pid_ns+0x920/0x920 [ 268.576644] [] ? _raw_write_unlock_irq+0x27/0x50 [ 268.583045] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 268.589878] [] do_exit+0x1c21/0x26b0 [ 268.595231] [] ? setup_sigcontext+0x780/0x780 [ 268.601367] [] ? release_task.part.17+0x1200/0x1200 [ 268.608076] [] ? __bad_area_nosemaphore+0x21e/0x310 [ 268.614753] [] ? retint_user+0x18/0x3c [ 268.620292] [] do_group_exit+0x111/0x330 [ 268.625994] [] ? trace_hardirqs_on_thunk+0x17/0x19 [ 268.632558] [] SyS_exit_group+0x1d/0x20 [ 268.638173] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 268.644736] Code: 49 8d bc 24 d8 00 00 00 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 c4 01 00 00 49 8b 9c 24 d8 00 00 00 80 3a 00 0f 85 8f 01 00 00 <4a> 03 1c f9 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 be 01 00 [ 268.672597] RIP [] cpuacct_charge+0x155/0x380 [ 268.678876] RSP [ 268.682483] CR2: fffffffde4ad6880 [ 268.685927] ---[ end trace fd6ed9200f55fbfb ]--- [ 268.690687] Kernel panic - not syncing: Fatal exception [ 269.867841] Shutting down cpus with NMI [ 269.872160] Dumping ftrace buffer: [ 269.875685] (ftrace buffer empty) [ 269.879368] Kernel Offset: disabled [ 269.882982] Rebooting in 86400 seconds..