[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.829994] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.070777] random: sshd: uninitialized urandom read (32 bytes read) [ 23.385109] random: sshd: uninitialized urandom read (32 bytes read) [ 24.255054] random: sshd: uninitialized urandom read (32 bytes read) [ 24.400880] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.14' (ECDSA) to the list of known hosts. [ 29.798102] random: sshd: uninitialized urandom read (32 bytes read) 2018/07/09 14:00:41 parsed 1 programs [ 31.367272] random: cc1: uninitialized urandom read (8 bytes read) 2018/07/09 14:00:43 executed programs: 0 [ 32.610097] IPVS: ftp: loaded support on port[0] = 21 [ 32.794096] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.800542] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.807930] device bridge_slave_0 entered promiscuous mode [ 32.823638] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.829991] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.837046] device bridge_slave_1 entered promiscuous mode [ 32.851588] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 32.866680] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 32.905439] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 32.923199] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 32.980753] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 32.987957] team0: Port device team_slave_0 added [ 33.002252] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 33.009460] team0: Port device team_slave_1 added [ 33.023903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 33.039894] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 33.055787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 33.071590] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.146578] ip (4627) used greatest stack depth: 17000 bytes left [ 33.181653] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.188087] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.194975] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.201327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.586741] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 33.592833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.632368] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 33.671318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.679552] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 33.715090] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 33.721169] 8021q: adding VLAN 0 to HW filter on device team0 [ 33.740397] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 33.960869] BUG: unable to handle kernel paging request at ffffebe000000008 [ 33.967983] PGD 0 P4D 0 [ 33.970642] Oops: 0000 [#1] SMP KASAN [ 33.974420] CPU: 0 PID: 4797 Comm: syz-executor0 Not tainted 4.18.0-rc4+ #41 [ 33.981579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.990916] RIP: 0010:kfree+0xa0/0x260 [ 33.994776] Code: 82 cb 01 00 00 48 ba 00 00 00 80 ff 77 00 00 48 01 c2 48 89 df 48 b8 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 c2 <48> 8b 42 08 a8 01 48 8d 48 ff 48 0f 45 d1 4c 8b 6a 18 49 63 75 74 [ 34.013896] RSP: 0018:ffff8801d48974e0 EFLAGS: 00010086 [ 34.019236] RAX: ffffea0000000000 RBX: 0000000000000286 RCX: 0000000000000000 [ 34.026482] RDX: ffffebe000000000 RSI: 0000000000000000 RDI: 0000000000000286 [ 34.033761] RBP: ffff8801d4897500 R08: ffffed003b5c46d7 R09: ffffed003b5c46d6 [ 34.041012] R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: 0000000000000286 [ 34.048265] R13: ffffffff8766d6c3 R14: ffff8801d4897650 R15: ffff8801ab3c1680 [ 34.055771] FS: 0000000000000000(0000) GS:ffff8801dae00000(0063) knlGS:000000000971e900 [ 34.063973] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 34.069829] CR2: ffffebe000000008 CR3: 00000001b63a5000 CR4: 00000000001406f0 [ 34.077075] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.084324] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.091567] Call Trace: [ 34.094137] p9_client_create+0xf43/0x16c9 [ 34.098355] ? p9_client_read+0xc60/0xc60 [ 34.102483] ? find_held_lock+0x36/0x1c0 [ 34.106526] ? __lockdep_init_map+0x105/0x590 [ 34.111005] ? kasan_check_write+0x14/0x20 [ 34.115226] ? __init_rwsem+0x1cc/0x2a0 [ 34.119177] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 34.124169] ? rcu_read_lock_sched_held+0x108/0x120 [ 34.129161] ? __kmalloc_track_caller+0x5f5/0x760 [ 34.133986] ? save_stack+0xa9/0xd0 [ 34.137592] ? save_stack+0x43/0xd0 [ 34.141198] ? kasan_kmalloc+0xc4/0xe0 [ 34.145062] ? memcpy+0x45/0x50 [ 34.148322] v9fs_session_init+0x21a/0x1a80 [ 34.152634] ? find_held_lock+0x36/0x1c0 [ 34.156675] ? v9fs_show_options+0x7e0/0x7e0 [ 34.161061] ? kasan_check_read+0x11/0x20 [ 34.165186] ? rcu_is_watching+0x8c/0x150 [ 34.169310] ? rcu_pm_notify+0xc0/0xc0 [ 34.173174] ? rcu_pm_notify+0xc0/0xc0 [ 34.177046] ? v9fs_mount+0x61/0x900 [ 34.180737] ? rcu_read_lock_sched_held+0x108/0x120 [ 34.185731] ? kmem_cache_alloc_trace+0x616/0x780 [ 34.190553] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 34.196076] v9fs_mount+0x7c/0x900 [ 34.199598] mount_fs+0xae/0x328 [ 34.202944] vfs_kern_mount.part.34+0xdc/0x4e0 [ 34.207503] ? may_umount+0xb0/0xb0 [ 34.211111] ? _raw_read_unlock+0x22/0x30 [ 34.215237] ? __get_fs_type+0x97/0xc0 [ 34.219103] do_mount+0x581/0x30e0 [ 34.222622] ? copy_mount_string+0x40/0x40 [ 34.226837] ? copy_mount_options+0x5f/0x380 [ 34.231222] ? rcu_read_lock_sched_held+0x108/0x120 [ 34.236214] ? kmem_cache_alloc_trace+0x616/0x780 [ 34.241041] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 34.246559] ? copy_mount_options+0x285/0x380 [ 34.251049] __ia32_compat_sys_mount+0x5d5/0x860 [ 34.255788] do_fast_syscall_32+0x34d/0xfb2 [ 34.260087] ? do_int80_syscall_32+0x890/0x890 [ 34.264646] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 34.269380] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 34.274892] ? syscall_return_slowpath+0x31d/0x5e0 [ 34.279801] ? sysret32_from_system_call+0x5/0x46 [ 34.284622] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 34.289443] entry_SYSENTER_compat+0x70/0x7f [ 34.293827] RIP: 0023:0xf7ffccb9 [ 34.297174] Code: 55 08 8b 88 64 cd ff ff 8b 98 68 cd ff ff 89 c8 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 1c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 34.316307] RSP: 002b:00000000ffb6ce4c EFLAGS: 00000286 ORIG_RAX: 0000000000000015 [ 34.323989] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000200000c0 [ 34.331239] RDX: 0000000020000340 RSI: 0000000000000000 RDI: 00000000200001c0 [ 34.338485] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 34.345730] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 34.352974] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 34.360220] Modules linked in: [ 34.363389] Dumping ftrace buffer: [ 34.366900] (ftrace buffer empty) [ 34.370587] CR2: ffffebe000000008 [ 34.374025] ---[ end trace b2f77fda1ee13dca ]--- [ 34.378767] RIP: 0010:kfree+0xa0/0x260 [ 34.382623] Code: 82 cb 01 00 00 48 ba 00 00 00 80 ff 77 00 00 48 01 c2 48 89 df 48 b8 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 c2 <48> 8b 42 08 a8 01 48 8d 48 ff 48 0f 45 d1 4c 8b 6a 18 49 63 75 74 [ 34.401735] RSP: 0018:ffff8801d48974e0 EFLAGS: 00010086 [ 34.407073] RAX: ffffea0000000000 RBX: 0000000000000286 RCX: 0000000000000000 [ 34.414316] RDX: ffffebe000000000 RSI: 0000000000000000 RDI: 0000000000000286 [ 34.421561] RBP: ffff8801d4897500 R08: ffffed003b5c46d7 R09: ffffed003b5c46d6 [ 34.428810] R10: ffffed003b5c46d6 R11: ffff8801dae236b3 R12: 0000000000000286 [ 34.436062] R13: ffffffff8766d6c3 R14: ffff8801d4897650 R15: ffff8801ab3c1680 [ 34.443307] FS: 0000000000000000(0000) GS:ffff8801dae00000(0063) knlGS:000000000971e900 [ 34.451506] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 34.457361] CR2: ffffebe000000008 CR3: 00000001b63a5000 CR4: 00000000001406f0 [ 34.464616] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.471875] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.479120] Kernel panic - not syncing: Fatal exception [ 34.484851] Dumping ftrace buffer: [ 34.488365] (ftrace buffer empty) [ 34.492050] Kernel Offset: disabled [ 34.495651] Rebooting in 86400 seconds..