[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 14.411410] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 17.429473] random: sshd: uninitialized urandom read (32 bytes read) [ 17.801151] random: sshd: uninitialized urandom read (32 bytes read) [ 18.659985] random: sshd: uninitialized urandom read (32 bytes read) [ 100.430503] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.51' (ECDSA) to the list of known hosts. [ 105.942063] random: sshd: uninitialized urandom read (32 bytes read) 2018/07/10 23:19:10 parsed 1 programs [ 107.338076] random: cc1: uninitialized urandom read (8 bytes read) 2018/07/10 23:19:12 executed programs: 0 [ 108.680626] IPVS: Creating netns size=2536 id=1 [ 108.714139] IPVS: Creating netns size=2536 id=2 [ 108.738327] IPVS: Creating netns size=2536 id=3 [ 108.758939] IPVS: Creating netns size=2536 id=4 [ 108.788686] IPVS: Creating netns size=2536 id=5 [ 108.823100] IPVS: Creating netns size=2536 id=6 [ 108.847968] IPVS: Creating netns size=2536 id=7 [ 108.893812] IPVS: Creating netns size=2536 id=8 [ 108.944134] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 108.965047] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.091166] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.133286] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.165713] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 109.192501] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 109.206255] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.223828] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.279377] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 109.307307] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.334963] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 109.354700] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 109.369810] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 109.381773] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.411107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 109.432881] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.440250] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.449685] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 109.463795] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 109.472051] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.492817] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 109.502405] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.510580] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.518062] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.527977] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 109.540779] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 109.548082] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.555491] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.567938] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.591686] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.679965] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.702055] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 109.710128] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.718285] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 109.727127] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 109.735533] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.745929] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.754938] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 109.763781] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 109.775619] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 109.783936] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 109.792034] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 109.803171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 109.810822] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 109.828609] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 109.840492] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 109.848630] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 109.863047] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 109.872984] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 109.885530] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 109.893520] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 109.901245] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 109.908866] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 109.917212] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 109.924778] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 109.933448] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 109.942696] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 109.951443] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 109.962986] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 109.975782] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 109.987161] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 109.997607] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 110.005550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 110.015344] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 110.026852] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 110.037620] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 110.055632] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 110.064340] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 110.075415] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 110.085244] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 110.092795] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 110.101293] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 110.109553] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 110.117452] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 110.127556] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 110.134985] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 110.142642] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 110.150568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 110.158052] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 110.165418] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 110.175369] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 110.187322] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 110.194367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 110.205124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 110.213247] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 110.221198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 112.514218] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 112.648621] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 112.659571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 112.666790] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 112.796071] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 112.829761] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 112.950244] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 112.966181] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 112.974977] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 112.989703] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 112.999786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.007847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.020127] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 113.027405] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 113.052975] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 113.066706] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 113.127709] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 113.155764] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 113.162200] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.169587] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.181273] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 113.188797] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 113.196091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.205736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.214716] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.221653] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.267437] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 113.273609] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.283099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.339546] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 113.349325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.360237] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/07/10 23:19:17 executed programs: 8 INIT: Id "6" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "3" respawning too fast: disabled for 5 minutes 2018/07/10 23:19:25 executed programs: 429 2018/07/10 23:19:30 executed programs: 926 2018/07/10 23:19:35 executed programs: 1426 2018/07/10 23:19:40 executed programs: 1648 2018/07/10 23:19:45 executed programs: 2129 [ 141.504071] ================================================================== [ 141.511511] BUG: KASAN: use-after-free in p9_conn_cancel+0x3f3/0x4c0 [ 141.518001] Read of size 4 at addr ffff8801bd8af6a8 by task kworker/0:3/1836 [ 141.525177] [ 141.526807] CPU: 0 PID: 1836 Comm: kworker/0:3 Not tainted 4.9.111-g03c70fe #6 [ 141.534156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 141.543512] Workqueue: events p9_poll_workfn [ 141.548037] ffff8801cea67aa0 ffffffff81eb2729 ffffea0006f62b80 ffff8801bd8af6a8 [ 141.556064] 0000000000000000 ffff8801bd8af6a8 00000000ffffff87 ffff8801cea67ad8 [ 141.564057] ffffffff81567b59 ffff8801bd8af6a8 0000000000000004 0000000000000000 [ 141.572059] Call Trace: [ 141.574625] [] dump_stack+0xc1/0x128 [ 141.579974] [] print_address_description+0x6c/0x234 [ 141.586625] [] kasan_report.cold.6+0x242/0x2fe [ 141.592844] [] ? p9_conn_cancel+0x3f3/0x4c0 [ 141.598813] [] __asan_report_load4_noabort+0x14/0x20 [ 141.605549] [] p9_conn_cancel+0x3f3/0x4c0 [ 141.611337] [] ? p9_pollwake+0x110/0x110 [ 141.617120] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 141.624034] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 141.630857] [] ? p9_fd_poll+0x246/0x310 [ 141.636481] [] p9_poll_workfn+0x222/0x330 [ 141.642257] [] process_one_work+0x7e1/0x1500 [ 141.648483] [] ? process_one_work+0x728/0x1500 [ 141.654715] [] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 141.661185] [] worker_thread+0xd6/0x10a0 [ 141.666882] [] ? __schedule+0x655/0x1bd0 [ 141.672577] [] kthread+0x26d/0x300 [ 141.677748] [] ? process_one_work+0x1500/0x1500 [ 141.684047] [] ? kthread_park+0xa0/0xa0 [ 141.689662] [] ? kthread_park+0xa0/0xa0 [ 141.695272] [] ? kthread_park+0xa0/0xa0 [ 141.700883] [] ret_from_fork+0x5c/0x70 [ 141.706400] [ 141.708014] Allocated by task 14810: [ 141.711703] save_stack_trace+0x16/0x20 [ 141.715650] save_stack+0x43/0xd0 [ 141.719088] kasan_kmalloc+0xc7/0xe0 [ 141.722871] kmem_cache_alloc_trace+0xfd/0x2b0 [ 141.727426] p9_fd_create+0xf3/0x330 [ 141.731116] p9_client_create+0x6ff/0x10a0 [ 141.735340] v9fs_session_init+0x333/0x13a0 [ 141.739634] v9fs_mount+0x7d/0x810 [ 141.743150] mount_fs+0x28c/0x370 [ 141.746579] vfs_kern_mount.part.29+0xd1/0x3d0 [ 141.751143] do_mount+0x3c9/0x2740 [ 141.754663] SyS_mount+0xfe/0x110 [ 141.758093] do_syscall_64+0x1a6/0x490 [ 141.761956] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 141.767027] [ 141.768628] Freed by task 14810: [ 141.771971] save_stack_trace+0x16/0x20 [ 141.775919] save_stack+0x43/0xd0 [ 141.779345] kasan_slab_free+0x72/0xc0 [ 141.783223] kfree+0xfb/0x310 [ 141.786305] p9_fd_close+0x298/0x330 [ 141.790003] p9_client_destroy+0x73/0x570 [ 141.794129] v9fs_session_close+0x46/0x110 [ 141.798344] v9fs_kill_super+0x4e/0xa0 [ 141.802217] deactivate_locked_super+0x75/0xd0 [ 141.806780] v9fs_mount+0x3c6/0x810 [ 141.810381] mount_fs+0x28c/0x370 [ 141.813813] vfs_kern_mount.part.29+0xd1/0x3d0 [ 141.818372] do_mount+0x3c9/0x2740 [ 141.821898] SyS_mount+0xfe/0x110 [ 141.825333] do_syscall_64+0x1a6/0x490 [ 141.829198] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 141.834271] [ 141.835875] The buggy address belongs to the object at ffff8801bd8af680 [ 141.835875] which belongs to the cache kmalloc-512 of size 512 [ 141.848506] The buggy address is located 40 bytes inside of [ 141.848506] 512-byte region [ffff8801bd8af680, ffff8801bd8af880) [ 141.860282] The buggy address belongs to the page: [ 141.865211] page:ffffea0006f62b80 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 141.875411] flags: 0x8000000000004080(slab|head) [ 141.880141] page dumped because: kasan: bad access detected [ 141.885833] [ 141.887435] Memory state around the buggy address: [ 141.892347] ffff8801bd8af580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.899681] ffff8801bd8af600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 141.907015] >ffff8801bd8af680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.914352] ^ [ 141.919010] ffff8801bd8af700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.926347] ffff8801bd8af780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.933683] ================================================================== [ 141.941018] Disabling lock debugging due to kernel taint [ 141.946796] Kernel panic - not syncing: panic_on_warn set ... [ 141.946796] [ 141.954228] CPU: 0 PID: 1836 Comm: kworker/0:3 Tainted: G B 4.9.111-g03c70fe #6 [ 141.962777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 141.972120] Workqueue: events p9_poll_workfn [ 141.976634] ffff8801cea67a00 ffffffff81eb2729 ffffffff843c71a7 00000000ffffffff [ 141.984656] 0000000000000000 0000000000000000 00000000ffffff87 ffff8801cea67ac0 [ 141.992744] ffffffff814219f5 0000000041b58ab3 ffffffff843ba8c0 ffffffff81421836 [ 142.000745] Call Trace: [ 142.003317] [] dump_stack+0xc1/0x128 [ 142.008657] [] panic+0x1bf/0x3bc [ 142.013647] [] ? add_taint.cold.6+0x16/0x16 [ 142.019594] [] ? kasan_end_report+0x32/0x4f [ 142.025537] [] kasan_end_report+0x47/0x4f [ 142.031320] [] kasan_report.cold.6+0x76/0x2fe [ 142.037617] [] ? p9_conn_cancel+0x3f3/0x4c0 [ 142.043567] [] __asan_report_load4_noabort+0x14/0x20 [ 142.050391] [] p9_conn_cancel+0x3f3/0x4c0 [ 142.056188] [] ? p9_pollwake+0x110/0x110 [ 142.061882] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 142.068787] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 142.075614] [] ? p9_fd_poll+0x246/0x310 [ 142.081222] [] p9_poll_workfn+0x222/0x330 [ 142.087003] [] process_one_work+0x7e1/0x1500 [ 142.093037] [] ? process_one_work+0x728/0x1500 [ 142.099244] [] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 142.105806] [] worker_thread+0xd6/0x10a0 [ 142.111506] [] ? __schedule+0x655/0x1bd0 [ 142.117300] [] kthread+0x26d/0x300 [ 142.122497] [] ? process_one_work+0x1500/0x1500 [ 142.128794] [] ? kthread_park+0xa0/0xa0 [ 142.134391] [] ? kthread_park+0xa0/0xa0 [ 142.140086] [] ? kthread_park+0xa0/0xa0 [ 142.145695] [] ret_from_fork+0x5c/0x70 [ 142.151822] Dumping ftrace buffer: [ 142.155347] (ftrace buffer empty) [ 142.159186] Kernel Offset: disabled [ 142.162786] Rebooting in 86400 seconds..