[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.421947] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.355591] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 24.869820] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [ 26.320240] random: sshd: uninitialized urandom read (32 bytes read, 109 bits of entropy available) [ 76.004542] random: nonblocking pool is initialized Warning: Permanently added '10.128.0.13' (ECDSA) to the list of known hosts. [ 81.625387] IPVS: Creating netns size=2552 id=1 RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported Error: argument "bridge0" is wrong: Device does not exist Error: argument "bridge0" is wrong: Device does not exist [ 81.775569] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 81.789568] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready Error: argument "bond0" is wrong: Device does not exist Error: argument "bond0" is wrong: Device does not exist [ 81.852191] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 81.865742] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready Error: argument "team0" is wrong: Device does not exist Error: argument "team0" is wrong: Device does not exist [ 81.929053] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 81.942899] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 81.958407] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.974731] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready RTNETLINK answers: Operation not supported Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "vcan0" RTNETLINK answers: Operation not supported Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gretap0" Cannot find device "gretap0" Cannot find device "gretap0" Cannot find device "gretap0" Cannot find device "ip_vti0" Cannot find device "ip_vti0" Cannot find device "ip_vti0" Cannot find device "ip_vti0" Cannot find device "ip6_vti0" Cannot find device "ip6_vti0" Cannot find device "ip6_vti0" Cannot find device "ip6_vti0" RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "team0" Cannot find device "team0" Cannot find device "team0" Cannot find device "team0" [ 82.439831] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 82.474395] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready executing program [ 82.721946] IPv4: Oversized IP packet from 127.0.0.1 [ 82.727288] IPv4: Oversized IP packet from 127.0.0.1 [ 82.734353] IPv4: Oversized IP packet from 127.0.0.1 [ 82.739616] IPv4: Oversized IP packet from 127.0.0.1 umount(./0/file0) failed (errno 22) [ 112.806369] ================================================================== [ 112.813779] BUG: KASAN: use-after-free in nf_nat_cleanup_conntrack+0x1ec/0x210 [ 112.821142] Write of size 8 at addr ffff8800ad887fe0 by task swapper/1/0 [ 112.827957] [ 112.829573] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.138-gcf21a9a #64 [ 112.836561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 112.845898] 0000000000000000 1026c8b0aa603825 ffff8801db307a38 ffffffff81e0ed0d [ 112.853945] ffffea0002b621c0 ffff8800ad887fe0 0000000000000001 ffff8800ad887fe0 [ 112.862007] ffff8801da244000 ffff8801db307a70 ffffffff81515a16 ffff8800ad887fe0 [ 112.870050] Call Trace: [ 112.872610] [] dump_stack+0xc1/0x124 [ 112.878700] [] print_address_description+0x6c/0x216 [ 112.885353] [] kasan_report.cold.7+0x175/0x2f7 [ 112.891573] [] ? nf_nat_cleanup_conntrack+0x1ec/0x210 [ 112.898394] [] __asan_report_store8_noabort+0x17/0x20 [ 112.905221] [] nf_nat_cleanup_conntrack+0x1ec/0x210 [ 112.911869] [] ? nf_log_dump_tcp_header+0xaa0/0xaa0 [ 112.918518] [] __nf_ct_ext_destroy+0x140/0x2a0 [ 112.924731] [] ? __nf_ct_ext_destroy+0x87/0x2a0 [ 112.931037] [] ? inet_frag_destroy+0x182/0x2e0 [ 112.937253] [] nf_conntrack_free+0x77/0x130 [ 112.943206] [] destroy_conntrack+0x26a/0x380 [ 112.949256] [] ? destroy_conntrack+0x70/0x380 [ 112.955472] [] ? nf_ct_invert_tuplepr+0x2a0/0x2a0 [ 112.961943] [] nf_conntrack_destroy+0x99/0x1a0 [ 112.968158] [] ? nf_register_hooks+0xa0/0xa0 [ 112.974197] [] skb_release_head_state+0x158/0x210 [ 112.980681] [] skb_release_all+0x15/0x60 [ 112.986371] [] __kfree_skb+0x15/0x20 [ 112.991715] [] kfree_skb+0xf7/0x3e0 [ 112.996973] [] inet_frag_destroy+0x182/0x2e0 [ 113.003011] [] ip_expire+0x154/0x770 [ 113.008356] [] ? ip_expire+0x3b/0x770 [ 113.013788] [] call_timer_fn+0x18c/0x870 [ 113.019477] [] ? call_timer_fn+0xda/0x870 [ 113.025257] [] ? debug_object_deactivate+0x214/0x340 [ 113.031994] [] ? ipv4_frags_init_net+0x3a0/0x3a0 [ 113.038384] [] ? process_timeout+0x20/0x20 [ 113.044250] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 113.050553] [] ? trace_hardirqs_on_caller+0x266/0x590 [ 113.057376] [] run_timer_softirq+0x642/0xb90 [ 113.063412] [] ? ipv4_frags_init_net+0x3a0/0x3a0 [ 113.069801] [] ? call_timer_fn+0x870/0x870 [ 113.075666] [] __do_softirq+0x22c/0xa1a [ 113.081275] [] irq_exit+0x10d/0x140 [ 113.086631] [] smp_apic_timer_interrupt+0x81/0xa0 [ 113.093104] [] apic_timer_interrupt+0xa0/0xb0 [ 113.099226] [] ? native_safe_halt+0x6/0x10 [ 113.105831] [] default_idle+0x55/0x3c0 [ 113.111350] [] arch_cpu_idle+0x10/0x20 [ 113.116870] [] default_idle_call+0x57/0x70 [ 113.122734] [] cpu_startup_entry+0x6af/0x780 [ 113.128772] [] ? call_cpuidle+0xe0/0xe0 [ 113.134376] [] start_secondary+0x324/0x400 [ 113.140240] [] ? set_cpu_sibling_map+0x1180/0x1180 [ 113.146817] [ 113.148422] The buggy address belongs to the page: [ 113.153332] page:ffffea0002b621c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 113.161536] flags: 0x4000000000000000() [ 113.165626] page dumped because: kasan: bad access detected [ 113.171314] [ 113.172921] Memory state around the buggy address: [ 113.177833] ffff8800ad887e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 113.185184] ffff8800ad887f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 113.192522] >ffff8800ad887f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 113.199858] ^ [ 113.206329] ffff8800ad888000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 113.213665] ffff8800ad888080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 113.221000] ================================================================== [ 113.228336] Disabling lock debugging due to kernel taint [ 113.233786] Kernel panic - not syncing: panic_on_warn set ... [ 113.233786] [ 113.241133] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 4.4.138-gcf21a9a #64 [ 113.249338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 113.258675] 0000000000000000 1026c8b0aa603825 ffff8801db307998 ffffffff81e0ed0d [ 113.266696] ffffffff841ed4ef 0000000000000008 0000000000000001 ffff8800ad887fe0 [ 113.274710] ffff8801da244000 ffff8801db307a58 ffffffff8140a184 0000000041b58ab3 [ 113.282725] Call Trace: [ 113.285285] [] dump_stack+0xc1/0x124 [ 113.291372] [] panic+0x19e/0x38d [ 113.296371] [] ? add_taint.cold.4+0x16/0x16 [ 113.302324] [] kasan_end_report+0x47/0x4f [ 113.308107] [] kasan_report.cold.7+0x192/0x2f7 [ 113.314319] [] ? nf_nat_cleanup_conntrack+0x1ec/0x210 [ 113.321143] [] __asan_report_store8_noabort+0x17/0x20 [ 113.327968] [] nf_nat_cleanup_conntrack+0x1ec/0x210 [ 113.334613] [] ? nf_log_dump_tcp_header+0xaa0/0xaa0 [ 113.341260] [] __nf_ct_ext_destroy+0x140/0x2a0 [ 113.347481] [] ? __nf_ct_ext_destroy+0x87/0x2a0 [ 113.353779] [] ? inet_frag_destroy+0x182/0x2e0 [ 113.359991] [] nf_conntrack_free+0x77/0x130 [ 113.365948] [] destroy_conntrack+0x26a/0x380 [ 113.371983] [] ? destroy_conntrack+0x70/0x380 [ 113.378115] [] ? nf_ct_invert_tuplepr+0x2a0/0x2a0 [ 113.384587] [] nf_conntrack_destroy+0x99/0x1a0 [ 113.390801] [] ? nf_register_hooks+0xa0/0xa0 [ 113.396838] [] skb_release_head_state+0x158/0x210 [ 113.403309] [] skb_release_all+0x15/0x60 [ 113.409002] [] __kfree_skb+0x15/0x20 [ 113.414342] [] kfree_skb+0xf7/0x3e0 [ 113.419599] [] inet_frag_destroy+0x182/0x2e0 [ 113.425636] [] ip_expire+0x154/0x770 [ 113.430978] [] ? ip_expire+0x3b/0x770 [ 113.436415] [] call_timer_fn+0x18c/0x870 [ 113.442107] [] ? call_timer_fn+0xda/0x870 [ 113.447888] [] ? debug_object_deactivate+0x214/0x340 [ 113.454623] [] ? ipv4_frags_init_net+0x3a0/0x3a0 [ 113.461010] [] ? process_timeout+0x20/0x20 [ 113.466876] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 113.473177] [] ? trace_hardirqs_on_caller+0x266/0x590 [ 113.479995] [] run_timer_softirq+0x642/0xb90 [ 113.490550] [] ? ipv4_frags_init_net+0x3a0/0x3a0 [ 113.496943] [] ? call_timer_fn+0x870/0x870 [ 113.502813] [] __do_softirq+0x22c/0xa1a [ 113.508421] [] irq_exit+0x10d/0x140 [ 113.513693] [] smp_apic_timer_interrupt+0x81/0xa0 [ 113.520167] [] apic_timer_interrupt+0xa0/0xb0 [ 113.526291] [] ? native_safe_halt+0x6/0x10 [ 113.532916] [] default_idle+0x55/0x3c0 [ 113.538435] [] arch_cpu_idle+0x10/0x20 [ 113.543968] [] default_idle_call+0x57/0x70 [ 113.549946] [] cpu_startup_entry+0x6af/0x780 [ 113.556076] [] ? call_cpuidle+0xe0/0xe0 [ 113.561685] [] start_secondary+0x324/0x400 [ 113.567550] [] ? set_cpu_sibling_map+0x1180/0x1180 [ 113.574563] Dumping ftrace buffer: [ 113.578090] (ftrace buffer empty) [ 113.581776] Kernel Offset: disabled [ 113.585379] Rebooting in 86400 seconds..