[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 15.691085] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.802335] random: sshd: uninitialized urandom read (32 bytes read) [ 22.058369] random: sshd: uninitialized urandom read (32 bytes read) [ 22.777110] random: sshd: uninitialized urandom read (32 bytes read) [ 22.910100] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.15.197' (ECDSA) to the list of known hosts. [ 28.583942] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program executing program executing program executing program [ 28.829742] ================================================================== [ 28.837155] BUG: KASAN: slab-out-of-bounds in pdu_read+0x90/0xd0 [ 28.843282] Read of size 42402 at addr ffff8801cad0076d by task syz-executor853/4471 [ 28.851134] [ 28.852745] CPU: 1 PID: 4471 Comm: syz-executor853 Not tainted 4.18.0-rc5-next-20180720+ #12 [ 28.861297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.870634] Call Trace: [ 28.873209] dump_stack+0x1c9/0x2b4 [ 28.876819] ? dump_stack_print_info.cold.2+0x52/0x52 [ 28.881990] ? printk+0xa7/0xcf [ 28.885253] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 28.889996] ? pdu_read+0x90/0xd0 [ 28.893442] print_address_description+0x6c/0x20b [ 28.898268] ? pdu_read+0x90/0xd0 [ 28.901702] kasan_report.cold.7+0x242/0x30d [ 28.906093] check_memory_region+0x13e/0x1b0 [ 28.910493] memcpy+0x23/0x50 [ 28.913580] pdu_read+0x90/0xd0 [ 28.916841] p9pdu_readf+0x579/0x2170 [ 28.920622] ? p9pdu_writef+0xe0/0xe0 [ 28.924405] ? ksys_dup3+0x690/0x690 [ 28.928099] ? do_raw_spin_lock+0xc1/0x200 [ 28.932316] ? finish_wait+0x430/0x430 [ 28.936195] ? p9_fd_show_options+0x1c0/0x1c0 [ 28.940676] p9_client_create+0x6d0/0x1537 [ 28.944908] ? p9_client_read+0xbb0/0xbb0 [ 28.949045] ? lock_acquire+0x1e4/0x540 [ 28.953005] ? fs_reclaim_acquire+0x20/0x20 [ 28.957332] ? lock_release+0xa30/0xa30 [ 28.961292] ? __lockdep_init_map+0x105/0x590 [ 28.965774] ? kasan_check_write+0x14/0x20 [ 28.969988] ? __init_rwsem+0x1cc/0x2a0 [ 28.973949] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 28.978947] ? __kmalloc_track_caller+0x311/0x760 [ 28.983767] ? save_stack+0xa9/0xd0 [ 28.987375] ? save_stack+0x43/0xd0 [ 28.990989] ? kasan_kmalloc+0xc4/0xe0 [ 28.994859] ? memcpy+0x45/0x50 [ 28.998128] v9fs_session_init+0x21a/0x1a80 [ 29.002432] ? rcu_note_context_switch+0x730/0x730 [ 29.007344] ? legacy_parse_monolithic+0xde/0x1e0 [ 29.012181] ? v9fs_show_options+0x7e0/0x7e0 [ 29.016570] ? lock_release+0xa30/0xa30 [ 29.020546] ? check_same_owner+0x340/0x340 [ 29.024860] ? lock_downgrade+0x8f0/0x8f0 [ 29.029002] ? kasan_unpoison_shadow+0x35/0x50 [ 29.033567] ? kasan_kmalloc+0xc4/0xe0 [ 29.037521] ? kmem_cache_alloc_trace+0x318/0x780 [ 29.042343] ? kasan_unpoison_shadow+0x35/0x50 [ 29.046902] ? kasan_kmalloc+0xc4/0xe0 [ 29.050801] v9fs_mount+0x7c/0x900 [ 29.054327] ? v9fs_drop_inode+0x150/0x150 [ 29.058543] legacy_get_tree+0x131/0x460 [ 29.062587] vfs_get_tree+0x1cb/0x5c0 [ 29.066369] do_mount+0x6f2/0x1e20 [ 29.069894] ? do_raw_spin_unlock+0xa7/0x2f0 [ 29.074318] ? copy_mount_string+0x40/0x40 [ 29.078536] ? kasan_kmalloc+0xc4/0xe0 [ 29.082413] ? kmem_cache_alloc_trace+0x318/0x780 [ 29.087243] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.092764] ? copy_mount_options+0x285/0x380 [ 29.097253] ksys_mount+0x12d/0x140 [ 29.100861] __x64_sys_mount+0xbe/0x150 [ 29.104817] do_syscall_64+0x1b9/0x820 [ 29.108694] ? finish_task_switch+0x1d3/0x870 [ 29.113179] ? syscall_return_slowpath+0x5e0/0x5e0 [ 29.118089] ? syscall_return_slowpath+0x31d/0x5e0 [ 29.123011] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 29.128035] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.133571] ? prepare_exit_to_usermode+0x291/0x3b0 [ 29.138574] ? perf_trace_sys_enter+0xb10/0xb10 [ 29.143234] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.148071] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.153264] RIP: 0033:0x446239 [ 29.156435] Code: e8 dc bb 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab 0e fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 29.175555] RSP: 002b:00007fd6b8a86ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 29.183241] RAX: ffffffffffffffda RBX: 00000000006dbc44 RCX: 0000000000446239 [ 29.190489] RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000 [ 29.197737] RBP: 00000000006dbc40 R08: 00000000200001c0 R09: 0000000000000000 [ 29.204989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.212250] R13: 00007ffcd514351f R14: 00007fd6b8a879c0 R15: 0000000000000001 [ 29.219501] [ 29.221108] Allocated by task 4471: [ 29.224728] save_stack+0x43/0xd0 [ 29.228158] kasan_kmalloc+0xc4/0xe0 [ 29.231848] __kmalloc+0x14e/0x760 [ 29.235369] p9_fcall_alloc+0x1e/0x90 [ 29.239148] p9_client_prepare_req.part.8+0x132/0xa00 [ 29.244315] p9_client_rpc+0x242/0x1330 [ 29.248282] p9_client_create+0xca4/0x1537 [ 29.252500] v9fs_session_init+0x21a/0x1a80 [ 29.256803] v9fs_mount+0x7c/0x900 [ 29.260323] legacy_get_tree+0x131/0x460 [ 29.264366] vfs_get_tree+0x1cb/0x5c0 [ 29.268147] do_mount+0x6f2/0x1e20 [ 29.271663] ksys_mount+0x12d/0x140 [ 29.275282] __x64_sys_mount+0xbe/0x150 [ 29.279240] do_syscall_64+0x1b9/0x820 [ 29.283123] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.288284] [ 29.289887] Freed by task 0: [ 29.292876] (stack is not available) [ 29.296570] [ 29.298187] The buggy address belongs to the object at ffff8801cad00740 [ 29.298187] which belongs to the cache kmalloc-16384 of size 16384 [ 29.311170] The buggy address is located 45 bytes inside of [ 29.311170] 16384-byte region [ffff8801cad00740, ffff8801cad04740) [ 29.323109] The buggy address belongs to the page: [ 29.328021] page:ffffea00072b4000 count:1 mapcount:0 mapping:ffff8801da802200 index:0x0 compound_mapcount: 0 [ 29.337976] flags: 0x2fffc0000010200(slab|head) [ 29.342626] raw: 02fffc0000010200 ffffea000729fe08 ffff8801da801c48 ffff8801da802200 [ 29.350487] raw: 0000000000000000 ffff8801cad00740 0000000100000001 0000000000000000 [ 29.358343] page dumped because: kasan: bad access detected [ 29.364028] [ 29.365630] Memory state around the buggy address: [ 29.370546] ffff8801cad02600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.377883] ffff8801cad02680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.385218] >ffff8801cad02700: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 29.392553] ^ [ 29.399026] ffff8801cad02780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.406365] ffff8801cad02800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.413696] ================================================================== [ 29.421294] Kernel panic - not syncing: panic_on_warn set ... [ 29.421294] [ 29.428671] CPU: 1 PID: 4471 Comm: syz-executor853 Tainted: G B 4.18.0-rc5-next-20180720+ #12 [ 29.438613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.447942] Call Trace: [ 29.450513] dump_stack+0x1c9/0x2b4 [ 29.454123] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.459294] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 29.464037] panic+0x238/0x4e7 [ 29.467215] ? add_taint.cold.5+0x16/0x16 [ 29.471347] ? do_raw_spin_unlock+0xa7/0x2f0 [ 29.475736] ? pdu_read+0x90/0xd0 [ 29.479173] kasan_end_report+0x47/0x4f [ 29.483137] kasan_report.cold.7+0x76/0x30d [ 29.487440] check_memory_region+0x13e/0x1b0 [ 29.491830] memcpy+0x23/0x50 [ 29.494915] pdu_read+0x90/0xd0 [ 29.498179] p9pdu_readf+0x579/0x2170 [ 29.501986] ? p9pdu_writef+0xe0/0xe0 [ 29.505778] ? ksys_dup3+0x690/0x690 [ 29.509473] ? do_raw_spin_lock+0xc1/0x200 [ 29.513685] ? finish_wait+0x430/0x430 [ 29.517559] ? p9_fd_show_options+0x1c0/0x1c0 [ 29.522047] p9_client_create+0x6d0/0x1537 [ 29.526278] ? p9_client_read+0xbb0/0xbb0 [ 29.530413] ? lock_acquire+0x1e4/0x540 [ 29.534365] ? fs_reclaim_acquire+0x20/0x20 [ 29.538679] ? lock_release+0xa30/0xa30 [ 29.542647] ? __lockdep_init_map+0x105/0x590 [ 29.547138] ? kasan_check_write+0x14/0x20 [ 29.551378] ? __init_rwsem+0x1cc/0x2a0 [ 29.555358] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 29.560363] ? __kmalloc_track_caller+0x311/0x760 [ 29.565193] ? save_stack+0xa9/0xd0 [ 29.568801] ? save_stack+0x43/0xd0 [ 29.572407] ? kasan_kmalloc+0xc4/0xe0 [ 29.576275] ? memcpy+0x45/0x50 [ 29.579536] v9fs_session_init+0x21a/0x1a80 [ 29.583854] ? rcu_note_context_switch+0x730/0x730 [ 29.588776] ? legacy_parse_monolithic+0xde/0x1e0 [ 29.593602] ? v9fs_show_options+0x7e0/0x7e0 [ 29.597993] ? lock_release+0xa30/0xa30 [ 29.601952] ? check_same_owner+0x340/0x340 [ 29.606271] ? lock_downgrade+0x8f0/0x8f0 [ 29.610398] ? kasan_unpoison_shadow+0x35/0x50 [ 29.614956] ? kasan_kmalloc+0xc4/0xe0 [ 29.618822] ? kmem_cache_alloc_trace+0x318/0x780 [ 29.623649] ? kasan_unpoison_shadow+0x35/0x50 [ 29.628224] ? kasan_kmalloc+0xc4/0xe0 [ 29.632105] v9fs_mount+0x7c/0x900 [ 29.635630] ? v9fs_drop_inode+0x150/0x150 [ 29.639845] legacy_get_tree+0x131/0x460 [ 29.643902] vfs_get_tree+0x1cb/0x5c0 [ 29.647683] do_mount+0x6f2/0x1e20 [ 29.651205] ? do_raw_spin_unlock+0xa7/0x2f0 [ 29.655596] ? copy_mount_string+0x40/0x40 [ 29.659820] ? kasan_kmalloc+0xc4/0xe0 [ 29.663690] ? kmem_cache_alloc_trace+0x318/0x780 [ 29.668517] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.674044] ? copy_mount_options+0x285/0x380 [ 29.678525] ksys_mount+0x12d/0x140 [ 29.682134] __x64_sys_mount+0xbe/0x150 [ 29.686088] do_syscall_64+0x1b9/0x820 [ 29.689959] ? finish_task_switch+0x1d3/0x870 [ 29.694439] ? syscall_return_slowpath+0x5e0/0x5e0 [ 29.699355] ? syscall_return_slowpath+0x31d/0x5e0 [ 29.704267] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 29.709264] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.714779] ? prepare_exit_to_usermode+0x291/0x3b0 [ 29.719781] ? perf_trace_sys_enter+0xb10/0xb10 [ 29.724439] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.729283] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.734450] RIP: 0033:0x446239 [ 29.737628] Code: e8 dc bb 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab 0e fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 29.756749] RSP: 002b:00007fd6b8a86ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 29.764440] RAX: ffffffffffffffda RBX: 00000000006dbc44 RCX: 0000000000446239 [ 29.771689] RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000 [ 29.778947] RBP: 00000000006dbc40 R08: 00000000200001c0 R09: 0000000000000000 [ 29.786196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.793447] R13: 00007ffcd514351f R14: 00007fd6b8a879c0 R15: 0000000000000001 [ 29.801146] Dumping ftrace buffer: [ 29.804673] (ftrace buffer empty) [ 29.808369] Kernel Offset: disabled [ 29.811973] Rebooting in 86400 seconds..