[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 21.073831] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.532308] random: sshd: uninitialized urandom read (32 bytes read) [ 24.845558] random: sshd: uninitialized urandom read (32 bytes read) [ 25.375277] random: sshd: uninitialized urandom read (32 bytes read) [ 25.543246] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.3' (ECDSA) to the list of known hosts. [ 31.113864] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 31.208799] ================================================================== [ 31.216227] BUG: KASAN: slab-out-of-bounds in _autofs_dev_ioctl+0x8f5/0x990 [ 31.223310] Read of size 4 at addr ffff8801d98bc340 by task syz-executor124/4446 [ 31.230819] [ 31.232441] CPU: 1 PID: 4446 Comm: syz-executor124 Not tainted 4.18.0-rc8+ #183 [ 31.239870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.249202] Call Trace: [ 31.251777] dump_stack+0x1c9/0x2b4 [ 31.255391] ? dump_stack_print_info.cold.2+0x52/0x52 [ 31.260562] ? printk+0xa7/0xcf [ 31.263828] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 31.268570] ? _autofs_dev_ioctl+0x8f5/0x990 [ 31.272964] print_address_description+0x6c/0x20b [ 31.277798] ? _autofs_dev_ioctl+0x8f5/0x990 [ 31.282189] kasan_report.cold.7+0x242/0x2fe [ 31.286584] ? find_autofs_mount.isra.5+0x2d0/0x2d0 [ 31.291585] __asan_report_load4_noabort+0x14/0x20 [ 31.296502] _autofs_dev_ioctl+0x8f5/0x990 [ 31.300728] ? autofs_dev_ioctl_closemount+0x90/0x90 [ 31.305839] ? trace_hardirqs_off+0xd/0x10 [ 31.310062] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 31.315152] ? _autofs_dev_ioctl+0x990/0x990 [ 31.319544] autofs_dev_ioctl+0x1b/0x30 [ 31.323504] do_vfs_ioctl+0x1de/0x1720 [ 31.327373] ? rcu_is_watching+0x8c/0x150 [ 31.331502] ? rcu_pm_notify+0xc0/0xc0 [ 31.335378] ? ioctl_preallocate+0x300/0x300 [ 31.339770] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.345290] ? __fget_light+0x2f7/0x440 [ 31.349252] ? fget_raw+0x20/0x20 [ 31.352690] ? kmem_cache_free+0x25c/0x2d0 [ 31.356911] ? putname+0xf7/0x130 [ 31.360357] ? do_sys_open+0x3cb/0x760 [ 31.364229] ? security_file_ioctl+0x94/0xc0 [ 31.368623] ksys_ioctl+0xa9/0xd0 [ 31.372066] __x64_sys_ioctl+0x73/0xb0 [ 31.375945] do_syscall_64+0x1b9/0x820 [ 31.379818] ? syscall_return_slowpath+0x5e0/0x5e0 [ 31.384732] ? syscall_return_slowpath+0x31d/0x5e0 [ 31.389647] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 31.394998] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.399839] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.405012] RIP: 0033:0x440139 [ 31.408193] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 31.427365] RSP: 002b:00007fff94b42b78 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ 31.435056] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000440139 [ 31.442312] RDX: 0000000020000180 RSI: 800000000000937e RDI: 0000000000000005 [ 31.449612] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 31.456873] R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004019c0 [ 31.464127] R13: 0000000000401a50 R14: 0000000000000000 R15: 0000000000000000 [ 31.471391] [ 31.473001] Allocated by task 4446: [ 31.476627] save_stack+0x43/0xd0 [ 31.480065] kasan_kmalloc+0xc4/0xe0 [ 31.483762] kmem_cache_alloc_trace+0x152/0x780 [ 31.488414] ramfs_fill_super+0xc4/0x580 [ 31.492458] mount_nodev+0x6b/0x110 [ 31.496078] ramfs_mount+0x2c/0x40 [ 31.499605] mount_fs+0xae/0x328 [ 31.502956] vfs_kern_mount.part.34+0xdc/0x4e0 [ 31.507529] do_mount+0x581/0x30e0 [ 31.511054] ksys_mount+0x12d/0x140 [ 31.514669] __x64_sys_mount+0xbe/0x150 [ 31.518625] do_syscall_64+0x1b9/0x820 [ 31.522499] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.527667] [ 31.529278] Freed by task 2730: [ 31.532543] save_stack+0x43/0xd0 [ 31.535982] __kasan_slab_free+0x11a/0x170 [ 31.540241] kasan_slab_free+0xe/0x10 [ 31.544042] kfree+0xd9/0x260 [ 31.547138] single_release+0x8f/0xb0 [ 31.550923] __fput+0x355/0x8b0 [ 31.554185] ____fput+0x15/0x20 [ 31.557449] task_work_run+0x1ec/0x2a0 [ 31.561327] exit_to_usermode_loop+0x313/0x370 [ 31.565935] do_syscall_64+0x6be/0x820 [ 31.569813] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.574979] [ 31.576593] The buggy address belongs to the object at ffff8801d98bc340 [ 31.576593] which belongs to the cache kmalloc-32 of size 32 [ 31.589065] The buggy address is located 0 bytes inside of [ 31.589065] 32-byte region [ffff8801d98bc340, ffff8801d98bc360) [ 31.600658] The buggy address belongs to the page: [ 31.605616] page:ffffea0007662f00 count:1 mapcount:0 mapping:ffff8801dac001c0 index:0xffff8801d98bcfc1 [ 31.615054] flags: 0x2fffc0000000100(slab) [ 31.619277] raw: 02fffc0000000100 ffffea00072a0088 ffffea00072fccc8 ffff8801dac001c0 [ 31.627144] raw: ffff8801d98bcfc1 ffff8801d98bc000 0000000100000022 0000000000000000 [ 31.635005] page dumped because: kasan: bad access detected [ 31.640705] [ 31.642312] Memory state around the buggy address: [ 31.647222] ffff8801d98bc200: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 31.654608] ffff8801d98bc280: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc [ 31.661956] >ffff8801d98bc300: fb fb fb fb fc fc fc fc 02 fc fc fc fc fc fc fc [ 31.669295] ^ [ 31.674726] ffff8801d98bc380: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 31.682070] ffff8801d98bc400: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 31.689409] ================================================================== [ 31.696747] Disabling lock debugging due to kernel taint [ 31.702273] Kernel panic - not syncing: panic_on_warn set ... [ 31.702273] [ 31.709644] CPU: 1 PID: 4446 Comm: syz-executor124 Tainted: G B 4.18.0-rc8+ #183 [ 31.718462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.727835] Call Trace: [ 31.730414] dump_stack+0x1c9/0x2b4 [ 31.734038] ? dump_stack_print_info.cold.2+0x52/0x52 [ 31.739224] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 31.743966] panic+0x238/0x4e7 [ 31.747143] ? add_taint.cold.5+0x16/0x16 [ 31.751274] ? do_raw_spin_unlock+0xa7/0x2f0 [ 31.755666] ? do_raw_spin_unlock+0xa7/0x2f0 [ 31.760062] ? _autofs_dev_ioctl+0x8f5/0x990 [ 31.764451] kasan_end_report+0x47/0x4f [ 31.768407] kasan_report.cold.7+0x76/0x2fe [ 31.772752] ? find_autofs_mount.isra.5+0x2d0/0x2d0 [ 31.777820] __asan_report_load4_noabort+0x14/0x20 [ 31.782741] _autofs_dev_ioctl+0x8f5/0x990 [ 31.786963] ? autofs_dev_ioctl_closemount+0x90/0x90 [ 31.792053] ? trace_hardirqs_off+0xd/0x10 [ 31.796273] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 31.801358] ? _autofs_dev_ioctl+0x990/0x990 [ 31.805750] autofs_dev_ioctl+0x1b/0x30 [ 31.809708] do_vfs_ioctl+0x1de/0x1720 [ 31.813578] ? rcu_is_watching+0x8c/0x150 [ 31.817709] ? rcu_pm_notify+0xc0/0xc0 [ 31.821682] ? ioctl_preallocate+0x300/0x300 [ 31.826144] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.831731] ? __fget_light+0x2f7/0x440 [ 31.835691] ? fget_raw+0x20/0x20 [ 31.839171] ? kmem_cache_free+0x25c/0x2d0 [ 31.843393] ? putname+0xf7/0x130 [ 31.846847] ? do_sys_open+0x3cb/0x760 [ 31.850717] ? security_file_ioctl+0x94/0xc0 [ 31.855105] ksys_ioctl+0xa9/0xd0 [ 31.858541] __x64_sys_ioctl+0x73/0xb0 [ 31.862412] do_syscall_64+0x1b9/0x820 [ 31.866289] ? syscall_return_slowpath+0x5e0/0x5e0 [ 31.871282] ? syscall_return_slowpath+0x31d/0x5e0 [ 31.876203] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 31.881550] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.886375] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.891551] RIP: 0033:0x440139 [ 31.894719] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 31.913836] RSP: 002b:00007fff94b42b78 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ 31.921523] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000440139 [ 31.928772] RDX: 0000000020000180 RSI: 800000000000937e RDI: 0000000000000005 [ 31.936031] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 31.943290] R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004019c0 [ 31.950543] R13: 0000000000401a50 R14: 0000000000000000 R15: 0000000000000000 [ 31.958170] Dumping ftrace buffer: [ 31.961693] (ftrace buffer empty) [ 31.965383] Kernel Offset: disabled [ 31.968989] Rebooting in 86400 seconds..