[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 28.719533] random: sshd: uninitialized urandom read (32 bytes read) [ 29.278308] audit: type=1400 audit(1547337388.200:6): avc: denied { map } for pid=1771 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 29.321327] random: sshd: uninitialized urandom read (32 bytes read) [ 29.776877] random: sshd: uninitialized urandom read (32 bytes read) [ 75.322855] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts. [ 80.825435] random: sshd: uninitialized urandom read (32 bytes read) [ 80.918802] audit: type=1400 audit(1547337439.840:7): avc: denied { map } for pid=1813 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/01/12 23:57:20 parsed 1 programs [ 81.657991] audit: type=1400 audit(1547337440.580:8): avc: denied { map } for pid=1813 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=5005 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 82.086620] random: cc1: uninitialized urandom read (8 bytes read) 2019/01/12 23:57:21 executed programs: 0 [ 82.969723] audit: type=1400 audit(1547337441.890:9): avc: denied { map } for pid=1813 comm="syz-execprog" path="/root/syzkaller-shm745338252" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 2019/01/12 23:57:26 executed programs: 192 2019/01/12 23:57:31 executed programs: 501 2019/01/12 23:57:36 executed programs: 817 2019/01/12 23:57:41 executed programs: 1122 [ 104.576065] ================================================================== [ 104.583561] BUG: KASAN: user-memory-access in n_tty_set_termios+0xee/0xcc0 [ 104.590568] Write of size 512 at addr 0000000000001060 by task syz-executor0/9325 [ 104.598184] [ 104.599805] CPU: 0 PID: 9325 Comm: syz-executor0 Not tainted 4.14.92+ #5 [ 104.606630] Call Trace: [ 104.609217] dump_stack+0xb9/0x10e [ 104.612750] ? n_tty_set_termios+0xee/0xcc0 [ 104.617060] kasan_report.cold+0x1f8/0x2a5 [ 104.621287] ? memset+0x20/0x40 [ 104.624565] ? n_tty_set_termios+0xee/0xcc0 [ 104.628878] ? process_echoes+0x140/0x140 [ 104.633014] ? tty_set_termios+0x608/0x870 [ 104.637241] ? tty_wait_until_sent+0x490/0x490 [ 104.641809] ? lock_downgrade+0x5d0/0x5d0 [ 104.645964] ? set_termios+0x2cd/0x460 [ 104.649840] ? __tty_perform_flush+0x210/0x210 [ 104.654433] ? mark_wake_futex+0xf0/0xf0 [ 104.658506] ? tty_mode_ioctl+0x5a5/0x880 [ 104.662653] ? tty_perform_flush+0x80/0x80 [ 104.666881] ? __ldsem_down_read_nested+0xb6/0x600 [ 104.671794] ? __ldsem_down_read_nested+0xd5/0x600 [ 104.676742] ? __ldsem_wake+0x310/0x310 [ 104.680707] ? avc_has_extended_perms+0x706/0xc20 [ 104.685566] ? n_tty_ioctl_helper+0x44/0x360 [ 104.689966] ? n_tty_ioctl+0x47/0x2e0 [ 104.693758] ? tty_ioctl+0x7a3/0x1260 [ 104.697555] ? n_tty_receive_buf+0x40/0x40 [ 104.701777] ? tty_vhangup+0x30/0x30 [ 104.705493] ? trace_hardirqs_on+0x10/0x10 [ 104.709720] ? trace_hardirqs_on+0x10/0x10 [ 104.713961] ? tty_vhangup+0x30/0x30 [ 104.717670] ? do_vfs_ioctl+0xabe/0x1040 [ 104.721722] ? selinux_file_ioctl+0x426/0x590 [ 104.726223] ? selinux_file_ioctl+0x116/0x590 [ 104.730726] ? ioctl_preallocate+0x1e0/0x1e0 [ 104.735125] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 104.740738] ? __fget+0x1ff/0x360 [ 104.744185] ? lock_downgrade+0x5d0/0x5d0 [ 104.748324] ? lock_acquire+0x10f/0x380 [ 104.752298] ? __fget+0x44/0x360 [ 104.755666] ? check_preemption_disabled+0x35/0x1f0 [ 104.760697] ? security_file_ioctl+0x7c/0xb0 [ 104.765102] ? SyS_ioctl+0x7f/0xb0 [ 104.768627] ? do_vfs_ioctl+0x1040/0x1040 [ 104.772773] ? do_syscall_64+0x19b/0x4b0 [ 104.776827] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 104.782209] ================================================================== [ 104.789556] Disabling lock debugging due to kernel taint [ 104.795897] Kernel panic - not syncing: panic_on_warn set ... [ 104.795897] [ 104.803261] CPU: 0 PID: 9325 Comm: syz-executor0 Tainted: G B 4.14.92+ #5 [ 104.811286] Call Trace: [ 104.813855] dump_stack+0xb9/0x10e [ 104.817371] panic+0x1d9/0x3c2 [ 104.820537] ? add_taint.cold+0x16/0x16 [ 104.824495] ? n_tty_set_termios+0xee/0xcc0 [ 104.828792] ? ___preempt_schedule+0x16/0x18 [ 104.833175] ? n_tty_set_termios+0xee/0xcc0 [ 104.837469] kasan_end_report+0x43/0x49 [ 104.841417] kasan_report.cold+0xa4/0x2a5 [ 104.845538] ? memset+0x20/0x40 [ 104.848806] ? n_tty_set_termios+0xee/0xcc0 [ 104.853100] ? process_echoes+0x140/0x140 [ 104.857248] ? tty_set_termios+0x608/0x870 [ 104.861461] ? tty_wait_until_sent+0x490/0x490 [ 104.866018] ? lock_downgrade+0x5d0/0x5d0 [ 104.870142] ? set_termios+0x2cd/0x460 [ 104.874004] ? __tty_perform_flush+0x210/0x210 [ 104.878568] ? mark_wake_futex+0xf0/0xf0 [ 104.882609] ? tty_mode_ioctl+0x5a5/0x880 [ 104.886729] ? tty_perform_flush+0x80/0x80 [ 104.890938] ? __ldsem_down_read_nested+0xb6/0x600 [ 104.895837] ? __ldsem_down_read_nested+0xd5/0x600 [ 104.900740] ? __ldsem_wake+0x310/0x310 [ 104.904687] ? avc_has_extended_perms+0x706/0xc20 [ 104.909522] ? n_tty_ioctl_helper+0x44/0x360 [ 104.913904] ? n_tty_ioctl+0x47/0x2e0 [ 104.917681] ? tty_ioctl+0x7a3/0x1260 [ 104.921454] ? n_tty_receive_buf+0x40/0x40 [ 104.925664] ? tty_vhangup+0x30/0x30 [ 104.929351] ? trace_hardirqs_on+0x10/0x10 [ 104.933567] ? trace_hardirqs_on+0x10/0x10 [ 104.937793] ? tty_vhangup+0x30/0x30 [ 104.941482] ? do_vfs_ioctl+0xabe/0x1040 [ 104.945534] ? selinux_file_ioctl+0x426/0x590 [ 104.950004] ? selinux_file_ioctl+0x116/0x590 [ 104.954482] ? ioctl_preallocate+0x1e0/0x1e0 [ 104.958892] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 104.964490] ? __fget+0x1ff/0x360 [ 104.967919] ? lock_downgrade+0x5d0/0x5d0 [ 104.972050] ? lock_acquire+0x10f/0x380 [ 104.975996] ? __fget+0x44/0x360 [ 104.979340] ? check_preemption_disabled+0x35/0x1f0 [ 104.984337] ? security_file_ioctl+0x7c/0xb0 [ 104.988730] ? SyS_ioctl+0x7f/0xb0 [ 104.992243] ? do_vfs_ioctl+0x1040/0x1040 [ 104.996370] ? do_syscall_64+0x19b/0x4b0 [ 105.000413] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 105.006116] Kernel Offset: 0x1b000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 105.017026] Rebooting in 86400 seconds..