Warning: Permanently added '10.128.0.10' (ECDSA) to the list of known hosts. [ 28.239057] random: sshd: uninitialized urandom read (32 bytes read, 113 bits of entropy available) 2018/03/09 04:44:08 parsed 1 programs 2018/03/09 04:44:08 executed programs: 0 [ 28.581591] IPVS: Creating netns size=2552 id=1 [ 29.666739] ================================================================== [ 29.674124] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x1a2c/0x1a70 [ 29.680587] Read of size 8 at addr ffff8801d1e59798 by task syz-executor0/4063 [ 29.687913] [ 29.689520] CPU: 1 PID: 4063 Comm: syz-executor0 Not tainted 4.4.120-gd63fdf6 #29 [ 29.697109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.706436] 0000000000000000 cad613fd92debb13 ffff8801d70bf628 ffffffff81d0408d [ 29.714413] ffffea0007479640 ffff8801d1e59798 0000000000000000 ffff8801d1e59798 [ 29.722397] 0000000000000040 ffff8801d70bf660 ffffffff814fe143 ffff8801d1e59798 [ 29.730364] Call Trace: [ 29.732934] [] dump_stack+0xc1/0x124 [ 29.738268] [] print_address_description+0x73/0x260 [ 29.744903] [] kasan_report+0x285/0x370 [ 29.750500] [] ? ip6_xmit+0x1a2c/0x1a70 [ 29.756091] [] __asan_report_load8_noabort+0x14/0x20 [ 29.762811] [] ip6_xmit+0x1a2c/0x1a70 [ 29.768231] [] ? kfree+0xfc/0x300 [ 29.773305] [] ? pskb_expand_head+0x28b/0x980 [ 29.779422] [] ? l2tp_xmit_skb+0xa5e/0xea0 [ 29.785279] [] ? ip6_finish_output2+0x1c60/0x1c60 [ 29.791743] [] ? __lock_is_held+0xa1/0xf0 [ 29.797510] [] ? ipv4_dst_check+0x111/0x160 [ 29.803452] [] ? __sk_dst_check+0x148/0x260 [ 29.809395] [] inet6_csk_xmit+0x246/0x480 [ 29.815165] [] ? inet6_csk_xmit+0x100/0x480 [ 29.821112] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 29.827666] [] ? udp6_set_csum+0x336/0xa80 [ 29.833519] [] l2tp_xmit_skb+0xc2f/0xea0 [ 29.839209] [] pppol2tp_sendmsg+0x584/0x7f0 [ 29.845163] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 29.851624] [] ? pppol2tp_release+0x310/0x310 [ 29.857744] [] sock_sendmsg+0xca/0x110 [ 29.863256] [] ___sys_sendmsg+0x6c1/0x7c0 [ 29.869024] [] ? copy_msghdr_from_user+0x550/0x550 [ 29.875573] [] ? __alloc_pages_direct_compact+0x250/0x250 [ 29.882728] [] ? do_futex+0x3f4/0x15d0 [ 29.888240] [] ? __wake_up_locked_key+0x20/0x20 [ 29.894530] [] ? exit_robust_list+0x240/0x240 [ 29.900646] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 29.907369] [] ? __fget_light+0xa3/0x1e0 [ 29.913048] [] ? __fdget+0x18/0x20 [ 29.918208] [] ? sockfd_lookup_light+0x118/0x160 [ 29.924582] [] __sys_sendmsg+0xd3/0x190 [ 29.930178] [] ? SyS_shutdown+0x1b0/0x1b0 [ 29.935948] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 29.942068] [] ? __do_page_fault+0x380/0xa00 [ 29.948102] [] compat_SyS_sendmsg+0x2a/0x40 [ 29.954044] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 29.960592] [] do_fast_syscall_32+0x321/0x8a0 [ 29.966708] [] sysenter_flags_fixed+0xd/0x17 [ 29.972731] [ 29.974330] Allocated by task 0: [ 29.977663] (stack is not available) [ 29.981341] [ 29.982941] Freed by task 0: [ 29.985925] (stack is not available) [ 29.989604] [ 29.991201] The buggy address belongs to the object at ffff8801d1e59780 [ 29.991201] which belongs to the cache ip_dst_cache of size 208 [ 30.003911] The buggy address is located 24 bytes inside of [ 30.003911] 208-byte region [ffff8801d1e59780, ffff8801d1e59850) [ 30.015664] The buggy address belongs to the page: [ 30.033145] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) [ 30.040826] BUG: unable to handle kernel paging request at ffffea0007479640 [ 30.048246] IP: [] 0xffffea0007479640 [ 30.053772] PGD 21f7fa067 PUD 21f7f9067 PMD 800000021e2000e3 [ 30.060126] Oops: 0011 [#1] PREEMPT SMP KASAN [ 30.065239] Dumping ftrace buffer: [ 30.068788] (ftrace buffer empty) [ 30.072503] Modules linked in: [ 30.075847] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.120-gd63fdf6 #29 [ 30.082852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.092186] task: ffffffff84217840 task.stack: ffffffff84200000 [ 30.098220] RIP: 0010:[] [ [ 6.505616] PTP clock support registered [ 6.507432] ioremap error for 0xbfffd000-0xc0000000, requested 0x2, got 0x0 [ 6.508663] dmi: Firmware registration failed. [ 6.510163] Advanced Linux Sound Architecture Driver Initialized. [ 6.511957] PCI: Using ACPI for IRQ routing [ 6.519444] NetLabel: Initializing [ 6.519952] NetLabel: domain hash size = 128 [ 6.520551] NetLabel: protocols = UNLABELED CIPSOv4 [ 6.521497] NetLabel: unlabeled traffic allowed by default [ 6.524577] amd_nb: Cannot enumerate AMD northbridges [ 6.525458] clocksource: Switched to clocksource kvm-clock [ 6.682589] pnp: PnP ACPI init [ 6.704595] pnp: PnP ACPI: found 7 devices [ 6.718365] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns [ 6.719937] NET: Registered protocol family 2 [ 6.722397] TCP established hash table entries: 65536 (order: 7, 524288 bytes) [ 6.723969] TCP bind hash table entries: 65536 (order: 10, 4194304 bytes) [ 6.731643] TCP: Hash tables configured (established 65536 bind 65536) [ 6.732851] UDP hash table entries: 4096 (order: 7, 655360 bytes) [ 6.734474] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes) [ 6.737744] NET: Registered protocol family 1 [ 6.738481] pci 0000:00:00.0: Limiting direct PCI/PCI transfers [ 6.740237] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) [ 6.741192] software IO TLB [mem 0xbbff3000-0xbfff3000] (64MB) mapped at [ffff8800bbff3000-ffff8800bfff2fff] [ 6.743119] RAPL PMU detected, API unit is 2^-32 Joules, 3 fixed counters 10737418240 ms ovfl timer [ 6.744450] hw unit of domain pp0-core 2^-0 Joules [ 6.745126] hw unit of domain package 2^-0 Joules [ 6.745909] hw unit of domain dram 2^-16 Joules [ 6.751545] Scanning for low memory corruption every 60 seconds [ 6.759385] audit: initializing netlink subsys (disabled) [ 6.760835] audit: type=2000 audit(1520570659.671:1): initialized [ 6.768196] HugeTLB registered 2 MB page size, pre-allocated 0 pages [ 6.897281] VFS: Disk quotas dquot_6.6.0 [ 6.898877] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) [ 6.920968] fuse init (API version 7.23) [ 6.924196] 9p: Installing v9fs 9p2000 file system support [ 6.938312] async_tx: api initialized (async) [ 6.940027] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 249) [ 6.941501] io scheduler noop registered [ 6.942077] io scheduler deadline registered [ 6.944421] io scheduler cfq registered (default) [ 6.953583] pci_hotplug: PCI Hot Plug PCI Core version: 0.5 [ 6.957303] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 [ 6.958537] ACPI: Power Button [PWRF] [ 6.960203] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1 [ 6.961249] ACPI: Sleep Button [SLPF] [ 6.984567] ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11 [ 6.986975] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver [ 7.008298] ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 10 [ 7.009169] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver