[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 14.798099] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 15.800785] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 16.099835] random: sshd: uninitialized urandom read (32 bytes read) [ 16.782387] random: sshd: uninitialized urandom read (32 bytes read) [ 30.893609] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.56' (ECDSA) to the list of known hosts. [ 36.345718] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 41.760042] ================================================================== [ 41.767428] BUG: KASAN: use-after-free in _copy_to_user+0xe9/0x110 [ 41.773722] Read of size 924 at addr ffff8801b87ffff2 by task syz-executor965/4418 [ 41.781396] [ 41.783006] CPU: 0 PID: 4418 Comm: syz-executor965 Not tainted 4.18.0-rc3-next-20180706+ #1 [ 41.791466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.800803] Call Trace: [ 41.803367] dump_stack+0x1c9/0x2b4 [ 41.806973] ? dump_stack_print_info.cold.2+0x52/0x52 [ 41.812139] ? printk+0xa7/0xcf [ 41.815396] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 41.820136] ? _copy_to_user+0xe9/0x110 [ 41.824089] print_address_description+0x6c/0x20b [ 41.828906] ? _copy_to_user+0xe9/0x110 [ 41.832854] kasan_report.cold.7+0x242/0x30d [ 41.837251] check_memory_region+0x13e/0x1b0 [ 41.841636] kasan_check_read+0x11/0x20 [ 41.845588] _copy_to_user+0xe9/0x110 [ 41.849369] bpf_test_finish.isra.7+0xee/0x1f0 [ 41.853927] ? bpf_test_init.isra.8+0x100/0x100 [ 41.858573] ? bpf_prog_e1612607a59b9886+0x50a/0x1000 [ 41.863760] ? bpf_test_run+0x238/0x3b0 [ 41.867712] ? bpf_test_run+0x2fc/0x3b0 [ 41.871665] bpf_prog_test_run_skb+0x7d7/0xa30 [ 41.876226] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 41.881049] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 41.886562] ? __bpf_prog_get+0x9b/0x290 [ 41.890600] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 41.895418] bpf_prog_test_run+0x130/0x1a0 [ 41.899629] __x64_sys_bpf+0x3d8/0x510 [ 41.903492] ? bpf_prog_get+0x20/0x20 [ 41.907273] ? do_page_fault+0xf6/0x8c0 [ 41.911225] do_syscall_64+0x1b9/0x820 [ 41.915091] ? syscall_return_slowpath+0x5e0/0x5e0 [ 41.919995] ? syscall_return_slowpath+0x31d/0x5e0 [ 41.924900] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 41.929894] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 41.935407] ? prepare_exit_to_usermode+0x291/0x3b0 [ 41.940399] ? perf_trace_sys_enter+0xb10/0xb10 [ 41.945045] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.949864] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.955047] RIP: 0033:0x4408d9 [ 41.958219] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 41.977334] RSP: 002b:00007ffc7c5abc48 EFLAGS: 00000213 ORIG_RAX: 0000000000000141 [ 41.985016] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9 [ 41.992269] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a [ 41.999513] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8 [ 42.006758] R10: 00000000016eb880 R11: 0000000000000213 R12: 0000000000401da0 [ 42.014006] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 42.021256] [ 42.022856] The buggy address belongs to the page: [ 42.027759] page:ffffea0006e1ffc0 count:0 mapcount:0 mapping:0000000000000000 index:0x1 [ 42.035886] flags: 0x2fffc0000000000() [ 42.039759] raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000 [ 42.047615] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 42.055465] page dumped because: kasan: bad access detected [ 42.061143] [ 42.062744] Memory state around the buggy address: [ 42.067650] ffff8801b87ffe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.074981] ffff8801b87fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.082315] >ffff8801b87fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 42.089646] ^ [ 42.096631] ffff8801b8800000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.103965] ffff8801b8800080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.111294] ================================================================== [ 42.118792] Kernel panic - not syncing: panic_on_warn set ... [ 42.118792] [ 42.126169] CPU: 0 PID: 4418 Comm: syz-executor965 Tainted: G B 4.18.0-rc3-next-20180706+ #1 [ 42.136024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.145354] Call Trace: [ 42.147945] dump_stack+0x1c9/0x2b4 [ 42.151551] ? dump_stack_print_info.cold.2+0x52/0x52 [ 42.156719] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 42.161453] panic+0x238/0x4e7 [ 42.164624] ? add_taint.cold.5+0x16/0x16 [ 42.168751] ? do_raw_spin_unlock+0xa7/0x2f0 [ 42.173137] ? do_raw_spin_unlock+0xa7/0x2f0 [ 42.177524] ? _copy_to_user+0xe9/0x110 [ 42.181476] kasan_end_report+0x47/0x4f [ 42.185427] kasan_report.cold.7+0x76/0x30d [ 42.189728] check_memory_region+0x13e/0x1b0 [ 42.194123] kasan_check_read+0x11/0x20 [ 42.198076] _copy_to_user+0xe9/0x110 [ 42.201857] bpf_test_finish.isra.7+0xee/0x1f0 [ 42.206417] ? bpf_test_init.isra.8+0x100/0x100 [ 42.211064] ? bpf_prog_e1612607a59b9886+0x50a/0x1000 [ 42.216230] ? bpf_test_run+0x238/0x3b0 [ 42.220184] ? bpf_test_run+0x2fc/0x3b0 [ 42.224149] bpf_prog_test_run_skb+0x7d7/0xa30 [ 42.228723] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 42.233558] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 42.239073] ? __bpf_prog_get+0x9b/0x290 [ 42.243113] ? bpf_test_finish.isra.7+0x1f0/0x1f0 [ 42.247935] bpf_prog_test_run+0x130/0x1a0 [ 42.252151] __x64_sys_bpf+0x3d8/0x510 [ 42.256030] ? bpf_prog_get+0x20/0x20 [ 42.259813] ? do_page_fault+0xf6/0x8c0 [ 42.263786] do_syscall_64+0x1b9/0x820 [ 42.267661] ? syscall_return_slowpath+0x5e0/0x5e0 [ 42.272569] ? syscall_return_slowpath+0x31d/0x5e0 [ 42.277476] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 42.282486] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 42.288017] ? prepare_exit_to_usermode+0x291/0x3b0 [ 42.293030] ? perf_trace_sys_enter+0xb10/0xb10 [ 42.297678] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 42.302508] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.307673] RIP: 0033:0x4408d9 [ 42.310836] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 42.329965] RSP: 002b:00007ffc7c5abc48 EFLAGS: 00000213 ORIG_RAX: 0000000000000141 [ 42.337649] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9 [ 42.344897] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a [ 42.352147] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8 [ 42.359397] R10: 00000000016eb880 R11: 0000000000000213 R12: 0000000000401da0 [ 42.366643] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000 [ 42.374331] Dumping ftrace buffer: [ 42.377847] (ftrace buffer empty) [ 42.381532] Kernel Offset: disabled [ 42.385134] Rebooting in 86400 seconds..