[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 15.668643] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.841527] random: sshd: uninitialized urandom read (32 bytes read) [ 22.384351] random: sshd: uninitialized urandom read (32 bytes read) [ 23.158144] random: sshd: uninitialized urandom read (32 bytes read) [ 23.298321] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.63' (ECDSA) to the list of known hosts. [ 28.637818] random: sshd: uninitialized urandom read (32 bytes read) 2018/05/12 10:59:12 parsed 1 programs 2018/05/12 10:59:12 executed programs: 0 [ 29.119576] IPVS: Creating netns size=2536 id=1 [ 29.140908] IPVS: Creating netns size=2536 id=2 [ 29.171765] IPVS: Creating netns size=2536 id=3 [ 29.193773] IPVS: Creating netns size=2536 id=4 [ 29.242392] IPVS: Creating netns size=2536 id=5 [ 29.286618] IPVS: Creating netns size=2536 id=6 [ 29.302261] IPVS: Creating netns size=2536 id=7 [ 29.329874] IPVS: Creating netns size=2536 id=8 [ 29.778550] ================================================================== [ 29.785965] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 29.792707] Read of size 8 at addr ffff8801d7111660 by task blkid/4035 [ 29.799616] [ 29.801237] CPU: 1 PID: 4035 Comm: blkid Not tainted 4.9.99-gc2f9bce #25 [ 29.808060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.817405] ffff8801d732f6d8 ffffffff81eb0f09 ffffea00075c4400 ffff8801d7111660 [ 29.826150] 0000000000000000 ffff8801d7111660 0000000000000000 ffff8801d732f710 [ 29.834189] ffffffff815652eb ffff8801d7111660 0000000000000008 0000000000000000 [ 29.842248] Call Trace: [ 29.844830] [] dump_stack+0xc1/0x128 [ 29.850187] [] print_address_description+0x6c/0x234 [ 29.856844] [] kasan_report.cold.6+0x242/0x2fe [ 29.863072] [] ? disk_unblock_events+0x51/0x60 [ 29.869298] [] __asan_report_load8_noabort+0x14/0x20 [ 29.876045] [] disk_unblock_events+0x51/0x60 [ 29.882100] [] __blkdev_get+0x6b6/0xd60 [ 29.887721] [] ? __blkdev_put+0x840/0x840 [ 29.893515] [] ? fsnotify+0x114/0x1100 [ 29.899045] [] blkdev_get+0x2da/0x920 [ 29.904486] [] ? bd_may_claim+0xd0/0xd0 [ 29.910102] [] ? bd_acquire+0x27/0x250 [ 29.915628] [] ? bd_acquire+0x88/0x250 [ 29.921164] [] ? _raw_spin_unlock+0x2c/0x50 [ 29.927126] [] blkdev_open+0x1a5/0x250 [ 29.932651] [] do_dentry_open+0x703/0xc80 [ 29.938440] [] ? blkdev_get_by_dev+0x70/0x70 [ 29.944478] [] vfs_open+0x11c/0x210 [ 29.949736] [] ? may_open.isra.57+0x14f/0x2a0 [ 29.955873] [] path_openat+0x758/0x3590 [ 29.961484] [] ? save_stack+0xa9/0xd0 [ 29.966924] [] ? path_lookupat.isra.41+0x410/0x410 [ 29.973493] [] ? __lock_is_held+0xa2/0xf0 [ 29.979286] [] do_filp_open+0x197/0x270 [ 29.984897] [] ? may_open_dev+0xe0/0xe0 [ 29.990502] [] ? _raw_spin_unlock+0x2c/0x50 [ 29.996456] [] ? __alloc_fd+0x1d7/0x4a0 [ 30.002055] [] do_sys_open+0x30d/0x5c0 [ 30.007585] [] ? filp_open+0x70/0x70 [ 30.012934] [] ? up_read+0x1a/0x40 [ 30.018101] [] ? __do_page_fault+0x183/0xd50 [ 30.024133] [] SyS_open+0x2d/0x40 [ 30.029216] [] ? do_sys_open+0x5c0/0x5c0 [ 30.034902] [] do_syscall_64+0x1a6/0x490 [ 30.040589] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 30.047493] [ 30.049093] Allocated by task 4025: [ 30.052695] save_stack_trace+0x16/0x20 [ 30.056642] save_stack+0x43/0xd0 [ 30.060073] kasan_kmalloc+0xc7/0xe0 [ 30.063757] kmem_cache_alloc_trace+0xfd/0x2b0 [ 30.068321] alloc_disk_node+0x54/0x3a0 [ 30.072266] alloc_disk+0x18/0x20 [ 30.075692] loop_add+0x33b/0x770 [ 30.079115] loop_probe+0x14f/0x180 [ 30.082724] kobj_lookup+0x223/0x410 [ 30.086408] get_gendisk+0x39/0x2d0 [ 30.090009] __blkdev_get+0x351/0xd60 [ 30.093788] blkdev_get+0x2da/0x920 [ 30.097388] blkdev_open+0x1a5/0x250 [ 30.101074] do_dentry_open+0x703/0xc80 [ 30.105019] vfs_open+0x11c/0x210 [ 30.108451] path_openat+0x758/0x3590 [ 30.112230] do_filp_open+0x197/0x270 [ 30.116001] do_sys_open+0x30d/0x5c0 [ 30.119685] SyS_open+0x2d/0x40 [ 30.122938] do_syscall_64+0x1a6/0x490 [ 30.126799] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 30.131871] [ 30.133473] Freed by task 4035: [ 30.136723] save_stack_trace+0x16/0x20 [ 30.140669] save_stack+0x43/0xd0 [ 30.144099] kasan_slab_free+0x72/0xc0 [ 30.147964] kfree+0xfb/0x310 [ 30.151044] disk_release+0x259/0x330 [ 30.154819] device_release+0x7e/0x220 [ 30.158686] kobject_release+0x103/0x1b0 [ 30.162720] kobject_put+0x6d/0xd0 [ 30.166240] put_disk+0x23/0x30 [ 30.169494] __blkdev_get+0x616/0xd60 [ 30.173265] blkdev_get+0x2da/0x920 [ 30.176865] blkdev_open+0x1a5/0x250 [ 30.180553] do_dentry_open+0x703/0xc80 [ 30.184498] vfs_open+0x11c/0x210 [ 30.187928] path_openat+0x758/0x3590 [ 30.191711] do_filp_open+0x197/0x270 [ 30.195486] do_sys_open+0x30d/0x5c0 [ 30.199180] SyS_open+0x2d/0x40 [ 30.202441] do_syscall_64+0x1a6/0x490 [ 30.206311] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 30.211389] [ 30.212994] The buggy address belongs to the object at ffff8801d7111100 [ 30.212994] which belongs to the cache kmalloc-2048 of size 2048 [ 30.225797] The buggy address is located 1376 bytes inside of [ 30.225797] 2048-byte region [ffff8801d7111100, ffff8801d7111900) [ 30.237821] The buggy address belongs to the page: [ 30.242725] page:ffffea00075c4400 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 30.252901] flags: 0x8000000000004080(slab|head) [ 30.257626] page dumped because: kasan: bad access detected [ 30.263303] [ 30.264900] Memory state around the buggy address: [ 30.269801] ffff8801d7111500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.277132] ffff8801d7111580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.284463] >ffff8801d7111600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.291792] ^ [ 30.298262] ffff8801d7111680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.305592] ffff8801d7111700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.312920] ================================================================== [ 30.320250] Disabling lock debugging due to kernel taint [ 30.326062] Kernel panic - not syncing: panic_on_warn set ... [ 30.326062] [ 30.333428] CPU: 1 PID: 4035 Comm: blkid Tainted: G B 4.9.99-gc2f9bce #25 [ 30.341506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.350847] ffff8801d732f638 ffffffff81eb0f09 ffffffff843c5065 00000000ffffffff [ 30.358900] 0000000000000000 0000000000000001 0000000000000000 ffff8801d732f6f8 [ 30.366991] ffffffff8141f855 0000000041b58ab3 ffffffff843b8768 ffffffff8141f696 [ 30.375036] Call Trace: [ 30.377615] [] dump_stack+0xc1/0x128 [ 30.382972] [] panic+0x1bf/0x3bc [ 30.387983] [] ? add_taint.cold.6+0x16/0x16 [ 30.393946] [] ? ___preempt_schedule+0x16/0x18 [ 30.400259] [] kasan_end_report+0x47/0x4f [ 30.406048] [] kasan_report.cold.6+0x76/0x2fe [ 30.412188] [] ? disk_unblock_events+0x51/0x60 [ 30.418430] [] __asan_report_load8_noabort+0x14/0x20 [ 30.425175] [] disk_unblock_events+0x51/0x60 [ 30.431225] [] __blkdev_get+0x6b6/0xd60 [ 30.436849] [] ? __blkdev_put+0x840/0x840 [ 30.442653] [] ? fsnotify+0x114/0x1100 [ 30.448182] [] blkdev_get+0x2da/0x920 [ 30.453623] [] ? bd_may_claim+0xd0/0xd0 [ 30.459236] [] ? bd_acquire+0x27/0x250 [ 30.464763] [] ? bd_acquire+0x88/0x250 [ 30.470345] [] ? _raw_spin_unlock+0x2c/0x50 [ 30.476310] [] blkdev_open+0x1a5/0x250 [ 30.481845] [] do_dentry_open+0x703/0xc80 [ 30.487640] [] ? blkdev_get_by_dev+0x70/0x70 [ 30.493691] [] vfs_open+0x11c/0x210 [ 30.498965] [] ? may_open.isra.57+0x14f/0x2a0 [ 30.505100] [] path_openat+0x758/0x3590 [ 30.510716] [] ? save_stack+0xa9/0xd0 [ 30.516168] [] ? path_lookupat.isra.41+0x410/0x410 [ 30.522738] [] ? __lock_is_held+0xa2/0xf0 [ 30.528543] [] do_filp_open+0x197/0x270 [ 30.534156] [] ? may_open_dev+0xe0/0xe0 [ 30.539781] [] ? _raw_spin_unlock+0x2c/0x50 [ 30.545755] [] ? __alloc_fd+0x1d7/0x4a0 [ 30.551371] [] do_sys_open+0x30d/0x5c0 [ 30.556900] [] ? filp_open+0x70/0x70 [ 30.563385] [] ? up_read+0x1a/0x40 [ 30.568585] [] ? __do_page_fault+0x183/0xd50 [ 30.574632] [] SyS_open+0x2d/0x40 [ 30.579720] [] ? do_sys_open+0x5c0/0x5c0 [ 30.585420] [] do_syscall_64+0x1a6/0x490 [ 30.591127] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 30.598469] Dumping ftrace buffer: [ 30.601986] (ftrace buffer empty) [ 30.605669] Kernel Offset: disabled [ 30.609267] Rebooting in 86400 seconds..