[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.968535] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.637281] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 22.911164] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 23.601468] random: sshd: uninitialized urandom read (32 bytes read, 66 bits of entropy available) [ 85.725961] random: sshd: uninitialized urandom read (32 bytes read, 92 bits of entropy available) Warning: Permanently added '10.128.15.195' (ECDSA) to the list of known hosts. [ 91.253305] random: sshd: uninitialized urandom read (32 bytes read, 96 bits of entropy available) 2018/08/21 16:53:15 parsed 1 programs [ 92.860319] random: cc1: uninitialized urandom read (8 bytes read, 98 bits of entropy available) 2018/08/21 16:53:17 executed programs: 0 [ 94.162231] IPVS: Creating netns size=2552 id=1 [ 94.220256] IPVS: Creating netns size=2552 id=2 [ 94.264936] IPVS: Creating netns size=2552 id=3 [ 94.337608] IPVS: Creating netns size=2552 id=4 [ 94.390516] IPVS: Creating netns size=2552 id=5 [ 94.484870] IPVS: Creating netns size=2552 id=6 [ 94.577332] IPVS: Creating netns size=2552 id=7 [ 94.695479] IPVS: Creating netns size=2552 id=8 [ 94.720237] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 94.752078] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 94.845137] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 94.897149] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 94.981611] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 95.030547] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 95.054020] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 95.117181] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 95.125340] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 95.255908] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 95.313463] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 95.325889] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 95.336817] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 95.352966] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 95.365032] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 95.407489] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 95.416134] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 95.425445] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 95.503278] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 95.526278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 95.568303] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 95.603253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 95.616506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 95.651322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 95.662827] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 95.702416] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 95.715551] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 95.757020] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 95.764576] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 95.772545] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 95.786768] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 95.811579] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 95.854056] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 95.900958] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 95.932115] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 95.964067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 95.980316] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 95.995522] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 96.011374] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 96.051558] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 96.081397] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 96.088581] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 96.097117] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 96.141192] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 96.148942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 96.173744] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 96.192931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 96.222817] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 96.231511] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 96.248249] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 96.263342] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 96.299405] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 96.410831] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 96.456142] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 96.472601] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 96.521502] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 96.534517] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 96.549402] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 96.566169] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 96.588207] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 96.605188] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 96.654792] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 96.701786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 96.717845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 98.791121] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 99.009207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 99.046027] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 99.300440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 99.616259] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 99.635434] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 99.664241] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 99.878218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 99.887402] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 99.925087] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.040715] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 100.154287] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 100.178539] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 100.267156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.484430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.516603] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/08/21 16:53:24 executed programs: 8 2018/08/21 16:53:29 executed programs: 176 2018/08/21 16:53:34 executed programs: 388 2018/08/21 16:53:39 executed programs: 590 INIT: Id "3" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "1" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes 2018/08/21 16:53:44 executed programs: 777 2018/08/21 16:53:49 executed programs: 985 2018/08/21 16:53:54 executed programs: 1194 2018/08/21 16:53:59 executed programs: 1410 2018/08/21 16:54:04 executed programs: 1614 [ 141.263117] random: nonblocking pool is initialized 2018/08/21 16:54:09 executed programs: 1824 2018/08/21 16:54:14 executed programs: 2042 2018/08/21 16:54:19 executed programs: 2265 2018/08/21 16:54:24 executed programs: 2480 2018/08/21 16:54:29 executed programs: 2706 2018/08/21 16:54:34 executed programs: 2939 2018/08/21 16:54:39 executed programs: 3176 [ 176.550199] ================================================================== [ 176.557601] BUG: KASAN: use-after-free in __lock_acquire+0x3c66/0x5270 [ 176.564259] Read of size 8 at addr ffff8801cbe8bc20 by task syz-executor1/18666 [ 176.571694] [ 176.573320] CPU: 0 PID: 18666 Comm: syz-executor1 Not tainted 4.4.150-g5541782 #19 [ 176.581028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 176.590372] 0000000000000000 108e2956e268ce06 ffff8800ad337a30 ffffffff81e14e2d [ 176.598679] ffffea00072fa200 ffff8801cbe8bc20 0000000000000000 ffff8801cbe8bc20 [ 176.606691] 0000000000000000 ffff8800ad337a68 ffffffff8151a3f0 ffff8801cbe8bc20 [ 176.614708] Call Trace: [ 176.617285] [] dump_stack+0xc1/0x124 [ 176.622626] [] print_address_description+0x6c/0x216 [ 176.629274] [] kasan_report.cold.7+0x175/0x2f7 [ 176.635492] [] ? __lock_acquire+0x3c66/0x5270 [ 176.641626] [] __asan_report_load8_noabort+0x14/0x20 [ 176.648360] [] __lock_acquire+0x3c66/0x5270 [ 176.654332] [] ? dput+0x1f/0x30 [ 176.659250] [] ? __fput+0x401/0x6f0 [ 176.664512] [] ? ____fput+0x15/0x20 [ 176.669775] [] ? task_work_run+0x10f/0x190 [ 176.675634] [] ? exit_to_usermode_loop+0x13d/0x160 [ 176.682207] [] ? __lock_acquire+0xa86/0x5270 [ 176.688250] [] ? debug_check_no_locks_freed+0x210/0x210 [ 176.695252] [] ? debug_check_no_locks_freed+0x210/0x210 [ 176.702244] [] ? debug_check_no_obj_freed+0x2ec/0x940 [ 176.709063] [] lock_acquire+0x15e/0x450 [ 176.714689] [] ? lock_sock_nested+0x43/0x120 [ 176.720727] [] ? get_parent_ip+0xd/0x50 [ 176.726330] [] ? sock_release+0x1c0/0x1c0 [ 176.732274] [] _raw_spin_lock_bh+0x3a/0x50 [ 176.738133] [] ? lock_sock_nested+0x43/0x120 [ 176.744166] [] lock_sock_nested+0x43/0x120 [ 176.750037] [] pppol2tp_release+0x50/0x310 [ 176.755903] [] sock_release+0x96/0x1c0 [ 176.761432] [] sock_close+0x16/0x20 [ 176.766687] [] __fput+0x235/0x6f0 [ 176.771800] [] ____fput+0x15/0x20 [ 176.776900] [] task_work_run+0x10f/0x190 [ 176.782604] [] exit_to_usermode_loop+0x13d/0x160 [ 176.788993] [] do_fast_syscall_32+0x61e/0x8b0 [ 176.795139] [] sysenter_flags_fixed+0xd/0x1a [ 176.801182] [ 176.802801] Allocated by task 18675: [ 176.806492] [] save_stack_trace+0x26/0x50 [ 176.812408] [] save_stack+0x43/0xd0 [ 176.817802] [] kasan_kmalloc+0xc7/0xe0 [ 176.823438] [] __kmalloc+0x124/0x310 [ 176.828903] [] sk_prot_alloc+0x204/0x300 [ 176.834726] [] sk_alloc+0x3a/0x3a0 [ 176.840016] [] pppol2tp_create+0x33/0x1f0 [ 176.845923] [] pppox_create+0xf6/0x200 [ 176.851572] [] __sock_create+0x2f0/0x5f0 [ 176.857385] [] SyS_socket+0xf0/0x1b0 [ 176.862875] [] do_fast_syscall_32+0x324/0x8b0 [ 176.869165] [] sysenter_flags_fixed+0xd/0x1a [ 176.875339] [ 176.876942] Freed by task 18666: [ 176.880280] [] save_stack_trace+0x26/0x50 [ 176.886193] [] save_stack+0x43/0xd0 [ 176.891593] [] kasan_slab_free+0x72/0xc0 [ 176.897403] [] kfree+0xf4/0x310 [ 176.902442] [] sk_destruct+0x407/0x4c0 [ 176.908087] [] __sk_free+0x4f/0x220 [ 176.913463] [] sk_free+0x30/0x40 [ 176.918613] [] pppol2tp_session_sock_put+0x5f/0x70 [ 176.925321] [] l2tp_tunnel_closeall+0x23c/0x350 [ 176.931760] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 176.938195] [] udpv6_destroy_sock+0xb1/0xd0 [ 176.944263] [] sk_common_release+0x6d/0x300 [ 176.950342] [] udp_lib_close+0x15/0x20 [ 176.955978] [] inet_release+0xff/0x1d0 [ 176.961614] [] inet6_release+0x50/0x70 [ 176.967437] [] sock_release+0x96/0x1c0 [ 176.973076] [] sock_close+0x16/0x20 [ 176.978456] [] __fput+0x235/0x6f0 [ 176.983680] [] ____fput+0x15/0x20 [ 176.988886] [] task_work_run+0x10f/0x190 [ 176.994712] [] exit_to_usermode_loop+0x13d/0x160 [ 177.001232] [] do_fast_syscall_32+0x61e/0x8b0 [ 177.007479] [] sysenter_flags_fixed+0xd/0x1a [ 177.013645] [ 177.015262] The buggy address belongs to the object at ffff8801cbe8bb80 [ 177.015262] which belongs to the cache kmalloc-2048 of size 2048 [ 177.028073] The buggy address is located 160 bytes inside of [ 177.028073] 2048-byte region [ffff8801cbe8bb80, ffff8801cbe8c380) [ 177.040022] The buggy address belongs to the page: [ 177.046742] ------------[ cut here ]------------ [ 177.051579] WARNING: CPU: 1 PID: 3916 at kernel/locking/lockdep.c:3190 __lock_acquire+0x265f/0x5270() [ 177.060924] DEBUG_LOCKS_WARN_ON(id >= MAX_LOCKDEP_KEYS) [ 177.066108] Kernel panic - not syncing: panic_on_warn set ... [ 177.066108] [ 177.073774] CPU: 1 PID: 3916 Comm: syz-executor4 Not tainted 4.4.150-g5541782 #19 [ 177.081388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 177.090740] 0000000000000000 ee91e687c01b3346 ffff8801d88bf6e0 ffffffff81e14e2d [ 177.098822] ffffffff83a44e40 ffff8801d8f3b000 ffffffff83a56ca0 0000000000000009 [ 177.106894] 0000000000000c76 ffff8801d88bf7a0 ffffffff8140d3c4 0000000041b58ab3 [ 177.114972] Call Trace: [ 177.117556] [] dump_stack+0xc1/0x124 [ 177.122916] [] panic+0x19e/0x38d [ 177.127930] [] ? add_taint.cold.4+0x16/0x16 [ 177.133894] [] ? warn_slowpath_common.cold.6+0x5/0x20 [ 177.140726] [] warn_slowpath_common.cold.6+0x20/0x20 [ 177.147475] [] ? __lock_acquire+0x265f/0x5270 [ 177.153613] [] warn_slowpath_fmt+0xbf/0x100 [ 177.159580] [] ? warn_slowpath_common+0x120/0x120 [ 177.166064] [] ? __lock_acquire+0xa86/0x5270 [ 177.172127] [] __lock_acquire+0x265f/0x5270 [ 177.178093] [] ? __lock_is_held+0xa2/0xf0 [ 177.183886] [] ? debug_check_no_locks_freed+0x210/0x210 [ 177.190891] [] ? debug_check_no_locks_freed+0x210/0x210 [ 177.197901] [] ? __lock_is_held+0xa2/0xf0 [ 177.203695] [] lock_acquire+0x15e/0x450 [ 177.209315] [] ? add_wait_queue+0x3f/0xa0 [ 177.215107] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 177.221428] [] ? add_wait_queue+0x3f/0xa0 [ 177.227233] [] add_wait_queue+0x3f/0xa0 [ 177.232855] [] do_wait+0x1b5/0xa30 [ 177.238038] [] ? wait_consider_task+0x35f0/0x35f0 [ 177.244527] [] ? free_object+0x1e/0x2a0 [ 177.250147] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 177.257069] [] SyS_wait4+0x12b/0x1f0 [ 177.262431] [] ? SyS_waitid+0x2d0/0x2d0 [ 177.268053] [] ? kill_orphaned_pgrp+0x390/0x390 [ 177.274371] [] C_SYSC_wait4+0x237/0x280 [ 177.279990] [] ? ktime_get_ts64+0x251/0x310 [ 177.285953] [] ? posix_ktime_get_ts+0x15/0x20 [ 177.292103] [] ? put_compat_rusage+0x5c0/0x5c0 [ 177.298331] [] ? __might_fault+0x92/0x1d0 [ 177.304122] [] ? SyS_clock_gettime+0x11e/0x1e0 [ 177.310348] [] ? SyS_clock_settime+0x210/0x210 [ 177.316575] [] ? __compat_put_timespec.isra.12+0xd3/0x150 [ 177.323755] [] ? compat_put_timespec+0xc2/0xe0 [ 177.329986] [] ? compat_SyS_clock_gettime+0x115/0x1a0 [ 177.336820] [] compat_SyS_wait4+0x2c/0x40 [ 177.342612] [] sys32_waitpid+0x25/0x30 [ 177.348146] [] ? sys32_mmap+0x110/0x110 [ 177.353767] [] do_fast_syscall_32+0x324/0x8b0 [ 177.359902] [] sysenter_flags_fixed+0xd/0x1a [ 178.531389] Shutting down cpus with NMI [ 178.536567] Dumping ftrace buffer: [ 178.540093] (ftrace buffer empty) [ 178.543776] Kernel Offset: disabled [ 178.547391] Rebooting in 86400 seconds..