ntaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 37.784045] random: sshd: uninitialized urandom read (32 bytes read) [ 38.082990] audit: type=1400 audit(1584417323.350:35): avc: denied { map } for pid=7448 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 38.163427] random: sshd: uninitialized urandom read (32 bytes read) [ 38.915359] random: sshd: uninitialized urandom read (32 bytes read) [ 908.089227] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.193' (ECDSA) to the list of known hosts. [ 913.697609] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program executing program executing program executing program [ 913.825112] audit: type=1400 audit(1584418199.090:36): avc: denied { map } for pid=7460 comm="syz-executor039" path="/root/syz-executor039918608" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program [ 1144.790161] INFO: task syz-executor039:7469 blocked for more than 140 seconds. [ 1144.790169] Not tainted 4.14.173-syzkaller #0 [ 1144.790173] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1144.790178] syz-executor039 D28688 7469 7462 0x00000004 [ 1144.790196] Call Trace: [ 1144.790378] ? __schedule+0x7b8/0x1ca0 [ 1144.790439] ? lock_acquire+0x170/0x3f0 [ 1144.790453] ? __sched_text_start+0x8/0x8 [ 1144.790466] schedule+0x8d/0x1b0 [ 1144.790474] schedule_timeout+0x946/0xe40 [ 1144.790485] ? usleep_range+0x130/0x130 [ 1144.790493] ? find_held_lock+0x2d/0x110 [ 1144.790502] ? __down+0x158/0x290 [ 1144.790514] ? lock_downgrade+0x6e0/0x6e0 [ 1144.790523] ? _raw_spin_unlock_irq+0x24/0x80 [ 1144.790535] __down+0x160/0x290 [ 1144.790546] ? ww_mutex_lock+0xb0/0xb0 [ 1144.790552] ? down+0xd/0x80 [ 1144.790566] down+0x57/0x80 [ 1144.790597] console_lock+0x24/0x70 [ 1144.790649] do_fb_ioctl+0x36a/0x940 [ 1144.790657] ? lock_downgrade+0x6e0/0x6e0 [ 1144.790664] ? fb_read+0x520/0x520 [ 1144.790709] ? avc_has_extended_perms+0x802/0xd40 [ 1144.790719] ? lock_downgrade+0x6e0/0x6e0 [ 1144.790765] ? pud_val+0xd0/0xd0 [ 1144.790772] ? avc_ss_reset+0x100/0x100 [ 1144.790782] ? put_page+0x88/0x1b0 [ 1144.790789] ? wp_page_copy+0x9d4/0x1300 [ 1144.790801] ? follow_pfn+0x200/0x200 [ 1144.790827] fb_ioctl+0xdd/0x130 [ 1144.790834] ? do_fb_ioctl+0x940/0x940 [ 1144.790882] do_vfs_ioctl+0x75a/0xfe0 [ 1144.790898] ? selinux_file_mprotect+0x5c0/0x5c0 [ 1144.790908] ? ioctl_preallocate+0x1a0/0x1a0 [ 1144.790920] ? lock_downgrade+0x6e0/0x6e0 [ 1144.790948] ? security_file_ioctl+0x76/0xb0 [ 1144.790956] ? security_file_ioctl+0x83/0xb0 [ 1144.790966] SyS_ioctl+0x7f/0xb0 [ 1144.790974] ? do_vfs_ioctl+0xfe0/0xfe0 [ 1144.791007] do_syscall_64+0x1d5/0x640 [ 1144.791020] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1144.791027] RIP: 0033:0x441419 [ 1144.791031] RSP: 002b:00007ffd589870f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1144.791041] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441419 [ 1144.791046] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000003 [ 1144.791051] RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 [ 1144.791056] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402190 [ 1144.791060] R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000 [ 1144.791078] INFO: task syz-executor039:7470 blocked for more than 140 seconds. [ 1144.791082] Not tainted 4.14.173-syzkaller #0 [ 1144.791085] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1144.791090] syz-executor039 D28688 7470 7465 0x00000004 [ 1144.791106] Call Trace: [ 1144.791117] ? __schedule+0x7b8/0x1ca0 [ 1144.791123] ? lock_acquire+0x170/0x3f0 [ 1144.791135] ? __sched_text_start+0x8/0x8 [ 1144.791148] schedule+0x8d/0x1b0 [ 1144.791155] schedule_timeout+0x946/0xe40 [ 1144.791164] ? usleep_range+0x130/0x130 [ 1144.791171] ? find_held_lock+0x2d/0x110 [ 1144.791179] ? __down+0x158/0x290 [ 1144.791192] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791200] ? _raw_spin_unlock_irq+0x24/0x80 [ 1144.791212] __down+0x160/0x290 [ 1144.791223] ? ww_mutex_lock+0xb0/0xb0 [ 1144.791229] ? down+0xd/0x80 [ 1144.791243] down+0x57/0x80 [ 1144.791250] console_lock+0x24/0x70 [ 1144.791257] do_fb_ioctl+0x36a/0x940 [ 1144.791264] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791272] ? fb_read+0x520/0x520 [ 1144.791282] ? avc_has_extended_perms+0x802/0xd40 [ 1144.791292] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791300] ? pud_val+0xd0/0xd0 [ 1144.791308] ? avc_ss_reset+0x100/0x100 [ 1144.791317] ? put_page+0x88/0x1b0 [ 1144.791324] ? wp_page_copy+0x9d4/0x1300 [ 1144.791336] ? follow_pfn+0x200/0x200 [ 1144.791362] fb_ioctl+0xdd/0x130 [ 1144.791369] ? do_fb_ioctl+0x940/0x940 [ 1144.791377] do_vfs_ioctl+0x75a/0xfe0 [ 1144.791386] ? selinux_file_mprotect+0x5c0/0x5c0 [ 1144.791395] ? ioctl_preallocate+0x1a0/0x1a0 [ 1144.791407] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791418] ? security_file_ioctl+0x76/0xb0 [ 1144.791426] ? security_file_ioctl+0x83/0xb0 [ 1144.791436] SyS_ioctl+0x7f/0xb0 [ 1144.791444] ? do_vfs_ioctl+0xfe0/0xfe0 [ 1144.791454] do_syscall_64+0x1d5/0x640 [ 1144.791466] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1144.791472] RIP: 0033:0x441419 [ 1144.791477] RSP: 002b:00007ffd589870f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1144.791485] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441419 [ 1144.791489] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000003 [ 1144.791494] RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 [ 1144.791499] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402190 [ 1144.791503] R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000 [ 1144.791520] INFO: task syz-executor039:7471 blocked for more than 140 seconds. [ 1144.791524] Not tainted 4.14.173-syzkaller #0 [ 1144.791527] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1144.791531] syz-executor039 D28688 7471 7463 0x00000004 [ 1144.791545] Call Trace: [ 1144.791557] ? __schedule+0x7b8/0x1ca0 [ 1144.791564] ? lock_acquire+0x170/0x3f0 [ 1144.791576] ? __sched_text_start+0x8/0x8 [ 1144.791589] schedule+0x8d/0x1b0 [ 1144.791597] schedule_timeout+0x946/0xe40 [ 1144.791607] ? usleep_range+0x130/0x130 [ 1144.791614] ? find_held_lock+0x2d/0x110 [ 1144.791623] ? __down+0x158/0x290 [ 1144.791635] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791644] ? _raw_spin_unlock_irq+0x24/0x80 [ 1144.791656] __down+0x160/0x290 [ 1144.791667] ? ww_mutex_lock+0xb0/0xb0 [ 1144.791673] ? down+0xd/0x80 [ 1144.791687] down+0x57/0x80 [ 1144.791694] console_lock+0x24/0x70 [ 1144.791700] do_fb_ioctl+0x36a/0x940 [ 1144.791708] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791715] ? fb_read+0x520/0x520 [ 1144.791726] ? avc_has_extended_perms+0x802/0xd40 [ 1144.791736] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791744] ? pud_val+0xd0/0xd0 [ 1144.791751] ? avc_ss_reset+0x100/0x100 [ 1144.791760] ? put_page+0x88/0x1b0 [ 1144.791768] ? wp_page_copy+0x9d4/0x1300 [ 1144.791780] ? follow_pfn+0x200/0x200 [ 1144.791818] fb_ioctl+0xdd/0x130 [ 1144.791824] ? do_fb_ioctl+0x940/0x940 [ 1144.791833] do_vfs_ioctl+0x75a/0xfe0 [ 1144.791841] ? selinux_file_mprotect+0x5c0/0x5c0 [ 1144.791851] ? ioctl_preallocate+0x1a0/0x1a0 [ 1144.791863] ? lock_downgrade+0x6e0/0x6e0 [ 1144.791878] ? security_file_ioctl+0x76/0xb0 [ 1144.791886] ? security_file_ioctl+0x83/0xb0 [ 1144.791901] SyS_ioctl+0x7f/0xb0 [ 1144.791908] ? do_vfs_ioctl+0xfe0/0xfe0 [ 1144.791921] do_syscall_64+0x1d5/0x640 [ 1144.791938] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1144.791943] RIP: 0033:0x441419 [ 1144.791947] RSP: 002b:00007ffd589870f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1144.791955] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441419 [ 1144.791960] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000003 [ 1144.791964] RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 [ 1144.791969] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402190 [ 1144.791973] R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000 [ 1144.791993] [ 1144.791993] Showing all locks held in the system: [ 1144.792003] 1 lock held by khungtaskd/1057: [ 1144.792007] #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a [ 1144.792055] 1 lock held by rsyslogd/7314: [ 1144.792058] #0: (&f->f_pos_lock){+.+.}, at: [] __fdget_pos+0xa6/0xc0 [ 1144.792104] 2 locks held by getty/7436: [ 1144.792106] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 1144.792148] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 1144.792187] 2 locks held by getty/7437: [ 1144.792189] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 1144.792206] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 1144.792229] 2 locks held by getty/7438: [ 1144.792235] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 1144.792259] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 1144.792279] 2 locks held by getty/7439: [ 1144.792281] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 1144.792299] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 1144.792318] 2 locks held by getty/7440: [ 1144.792321] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 1144.792342] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 1144.792362] 2 locks held by getty/7441: [ 1144.792368] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 1144.792388] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 1144.792407] 2 locks held by getty/7442: [ 1144.792410] #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 [ 1144.792426] #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1e4/0x16f0 [ 1144.792448] 1 lock held by syz-executor039/7473: [ 1144.792451] #0: (&fb_info->lock){+.+.}, at: [] fb_open+0xb7/0x400 [ 1144.792469] 1 lock held by syz-executor039/7474: [ 1144.792472] #0: (&fb_info->lock){+.+.}, at: [] fb_open+0xb7/0x400 [ 1144.792488] [ 1144.792491] ============================================= [ 1144.792491] [ 1144.792496] NMI backtrace for cpu 1 [ 1144.792503] CPU: 1 PID: 1057 Comm: khungtaskd Not tainted 4.14.173-syzkaller #0 [ 1144.792508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1144.792511] Call Trace: [ 1144.792579] dump_stack+0x13e/0x194 [ 1144.792590] nmi_cpu_backtrace.cold+0x57/0x93 [ 1144.792653] ? irq_force_complete_move.cold+0x7b/0x7b [ 1144.792661] nmi_trigger_cpumask_backtrace+0x139/0x17e [ 1144.792692] watchdog+0x5e2/0xb80 [ 1144.792718] ? kthread_flush_work_fn+0x20/0x20 [ 1144.792727] ? hungtask_pm_notify+0x50/0x50 [ 1144.792735] kthread+0x30d/0x420 [ 1144.792743] ? kthread_create_on_node+0xd0/0xd0 [ 1144.792752] ret_from_fork+0x24/0x30 [ 1144.792769] Sending NMI from CPU 1 to CPUs 0: [ 1144.793299] NMI backtrace for cpu 0 [ 1144.793303] CPU: 0 PID: 7467 Comm: syz-executor039 Not tainted 4.14.173-syzkaller #0 [ 1144.793307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1144.793310] task: ffff888080c18100 task.stack: ffff8880803d8000 [ 1144.793312] RIP: 0010:__sanitizer_cov_trace_pc+0x15/0x50 [ 1144.793315] RSP: 0018:ffff8880803df310 EFLAGS: 00000286 [ 1144.793319] RAX: ffff888080c18100 RBX: ffff8880000a0280 RCX: 0000000000000000 [ 1144.793326] RDX: 0000000080000000 RSI: ffff8880000a0000 RDI: 0000000000001400 [ 1144.793330] RBP: 0000000000000000 R08: 0000000000001400 R09: 0000000000000040 [ 1144.793333] R10: ffffed104323b96b R11: ffff8882191dcb5f R12: 0000000000000000 [ 1144.793336] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1144.793339] FS: 0000000001e12880(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 [ 1144.793341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1144.793345] CR2: 0000000020000180 CR3: 000000008fdac000 CR4: 00000000001406f0 [ 1144.793348] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1144.793350] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1144.793352] Call Trace: [ 1144.793354] bitfill_aligned+0x10a/0x190 [ 1144.793356] cfb_fillrect+0x3d5/0x720 [ 1144.793358] ? cfb_fillrect+0x720/0x720 [ 1144.793360] vga16fb_fillrect+0x61e/0x1880 [ 1144.793362] ? fb_copy_cmap+0x28e/0x350 [ 1144.793364] ? vga16fb_setcolreg+0xfe/0x360 [ 1144.793366] bit_clear_margins+0x2a4/0x480 [ 1144.793368] ? bit_bmove+0x1e0/0x1e0 [ 1144.793370] fbcon_clear_margins+0x285/0x310 [ 1144.793372] fbcon_switch+0xcdf/0x1780 [ 1144.793374] ? fbcon_set_def_font+0x370/0x370 [ 1144.793376] ? fbcon_cursor+0x4be/0x690 [ 1144.793378] ? bit_clear+0x460/0x460 [ 1144.793380] ? fbcon_set_origin+0x1c/0x40 [ 1144.793382] ? fbcon_scrolldelta+0x10c0/0x10c0 [ 1144.793384] redraw_screen+0x331/0x770 [ 1144.793386] ? con_flush_chars+0x80/0x80 [ 1144.793392] ? fbcon_set_palette+0x470/0x590 [ 1144.793394] fbcon_modechanged+0x59d/0x890 [ 1144.793396] fbcon_event_notify+0x11a/0x1746 [ 1144.793398] ? lock_acquire+0x170/0x3f0 [ 1144.793400] notifier_call_chain+0x107/0x1a0 [ 1144.793403] blocking_notifier_call_chain+0x79/0x90 [ 1144.793404] fb_set_var+0xaad/0xc70 [ 1144.793406] ? fb_set_suspend+0x110/0x110 [ 1144.793408] ? lock_acquire+0x170/0x3f0 [ 1144.793410] ? lock_fb_info+0x1a/0x70 [ 1144.793412] ? lock_fb_info+0x1a/0x70 [ 1144.793414] ? __mutex_lock+0x36a/0x1470 [ 1144.793416] ? trace_hardirqs_on+0x10/0x10 [ 1144.793418] ? mutex_trylock+0x1a0/0x1a0 [ 1144.793420] ? do_fb_ioctl+0x36a/0x940 [ 1144.793422] do_fb_ioctl+0x3cc/0x940 [ 1144.793424] ? lock_downgrade+0x6e0/0x6e0 [ 1144.793426] ? fb_read+0x520/0x520 [ 1144.793428] ? avc_has_extended_perms+0x802/0xd40 [ 1144.793430] ? lock_downgrade+0x6e0/0x6e0 [ 1144.793432] ? pud_val+0xd0/0xd0 [ 1144.793434] ? avc_ss_reset+0x100/0x100 [ 1144.793436] ? put_page+0x88/0x1b0 [ 1144.793438] ? wp_page_copy+0x9d4/0x1300 [ 1144.793439] ? follow_pfn+0x200/0x200 [ 1144.793441] fb_ioctl+0xdd/0x130 [ 1144.793443] ? do_fb_ioctl+0x940/0x940 [ 1144.793445] do_vfs_ioctl+0x75a/0xfe0 [ 1144.793447] ? selinux_file_mprotect+0x5c0/0x5c0 [ 1144.793449] ? ioctl_preallocate+0x1a0/0x1a0 [ 1144.793451] ? lock_downgrade+0x6e0/0x6e0 [ 1144.793453] ? security_file_ioctl+0x76/0xb0 [ 1144.793455] ? security_file_ioctl+0x83/0xb0 [ 1144.793457] SyS_ioctl+0x7f/0xb0 [ 1144.793459] ? do_vfs_ioctl+0xfe0/0xfe0 [ 1144.793461] do_syscall_64+0x1d5/0x640 [ 1144.793464] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 1144.793465] RIP: 0033:0x441419 [ 1144.793467] RSP: 002b:00007ffd589870f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1144.793472] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441419 [ 1144.793476] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000003 [ 1144.793479] RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 [ 1144.793481] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402190 [ 1144.793484] R13: 0000000000402220 R14: 0000000000000000 R15: 0000000000000000 [ 1144.793486] Code: e8 fc bd ee ff 48 c7 05 c6 b0 fe 08 00 00 00 00 e9 be ed ff ff 90 65 48 8b 04 25 40 ee 01 00 48 85 c0 74 1a 65 8b 15 3b a8 a7 7e <81> e2 00 01 1f 00 75 0b 8b 90 50 13 00 00 83 fa 01 74 01 c3 48 [ 1144.793783] Kernel panic - not syncing: hung_task: blocked tasks [ 1144.793790] CPU: 1 PID: 1057 Comm: khungtaskd Not tainted 4.14.173-syzkaller #0 [ 1144.793795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1144.793798] Call Trace: [ 1144.793807] dump_stack+0x13e/0x194 [ 1144.793843] panic+0x1f9/0x42d [ 1144.793851] ? add_taint.cold+0x16/0x16 [ 1144.793861] ? printk_safe_flush+0xac/0x110 [ 1144.793874] watchdog+0x5f3/0xb80 [ 1144.793882] ? kthread_flush_work_fn+0x20/0x20 [ 1144.793895] ? hungtask_pm_notify+0x50/0x50 [ 1144.793904] kthread+0x30d/0x420 [ 1144.793911] ? kthread_create_on_node+0xd0/0xd0 [ 1144.793920] ret_from_fork+0x24/0x30 [ 1144.795555] Kernel Offset: disabled