[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 21.038653] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.667158] random: sshd: uninitialized urandom read (32 bytes read) [ 23.965405] random: sshd: uninitialized urandom read (32 bytes read) [ 24.713546] random: sshd: uninitialized urandom read (32 bytes read) [ 45.393405] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.10' (ECDSA) to the list of known hosts. [ 50.869780] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 50.983561] Restarting kernel threads ... done. [ 50.988995] ================================================================== [ 50.996404] BUG: KASAN: null-ptr-deref in _copy_from_user+0x100/0x150 [ 51.002963] Write of size 32 at addr 0000000000000020 by task syz-executor101/4498 [ 51.010666] [ 51.012280] CPU: 1 PID: 4498 Comm: syz-executor101 Not tainted 4.17.0-rc3+ #34 [ 51.019623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.028956] Call Trace: [ 51.031532] dump_stack+0x1b9/0x294 [ 51.035145] ? dump_stack_print_info.cold.2+0x52/0x52 [ 51.040327] ? kasan_check_write+0x14/0x20 [ 51.044541] ? do_raw_spin_lock+0xc1/0x200 [ 51.048756] ? vprintk_func+0x81/0xe7 [ 51.052538] ? _copy_from_user+0x100/0x150 [ 51.056751] kasan_report.cold.7+0x6d/0x2fe [ 51.061054] check_memory_region+0x13e/0x1b0 [ 51.065439] kasan_check_write+0x14/0x20 [ 51.069494] _copy_from_user+0x100/0x150 [ 51.073534] simple_write_to_buffer+0xaf/0x130 [ 51.078095] snapshot_write+0x16d/0x270 [ 51.082054] ? snapshot_compat_ioctl+0x4e0/0x4e0 [ 51.086793] ? do_raw_spin_unlock+0x9e/0x2e0 [ 51.091180] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 51.095743] __vfs_write+0x10b/0x960 [ 51.099446] ? __fget_light+0x2ef/0x430 [ 51.103405] ? snapshot_compat_ioctl+0x4e0/0x4e0 [ 51.108137] ? kernel_read+0x120/0x120 [ 51.112003] ? debug_check_no_obj_freed+0x2ff/0x584 [ 51.116998] ? kasan_check_read+0x11/0x20 [ 51.121127] ? rcu_is_watching+0x85/0x140 [ 51.125254] ? rcu_pm_notify+0xc0/0xc0 [ 51.129127] ? trace_hardirqs_off+0xd/0x10 [ 51.133350] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 51.138865] ? security_file_permission+0x1c6/0x240 [ 51.143865] ? rw_verify_area+0x118/0x360 [ 51.147991] vfs_write+0x1f8/0x560 [ 51.151510] ksys_write+0xf9/0x250 [ 51.155032] ? __ia32_sys_read+0xb0/0xb0 [ 51.159075] ? ksys_ioctl+0x81/0xd0 [ 51.162681] __x64_sys_write+0x73/0xb0 [ 51.166551] do_syscall_64+0x1b1/0x800 [ 51.170430] ? finish_task_switch+0x1ca/0x810 [ 51.174908] ? syscall_return_slowpath+0x5c0/0x5c0 [ 51.179819] ? syscall_return_slowpath+0x30f/0x5c0 [ 51.184732] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 51.190077] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 51.194899] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 51.200065] RIP: 0033:0x4455a9 [ 51.203248] RSP: 002b:00007f973a88ada8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 51.210935] RAX: ffffffffffffffda RBX: 00000000006dac24 RCX: 00000000004455a9 [ 51.218182] RDX: 0000000000000020 RSI: 0000000020000040 RDI: 0000000000000003 [ 51.225435] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 51.232685] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac20 [ 51.239945] R13: 616e732f7665642f R14: 00007f973a88b9c0 R15: 0000000000000003 [ 51.247212] ================================================================== [ 51.254556] Disabling lock debugging due to kernel taint [ 51.260072] Kernel panic - not syncing: panic_on_warn set ... [ 51.260072] [ 51.267427] CPU: 1 PID: 4498 Comm: syz-executor101 Tainted: G B 4.17.0-rc3+ #34 [ 51.276163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.285668] Call Trace: [ 51.288241] dump_stack+0x1b9/0x294 [ 51.291848] ? dump_stack_print_info.cold.2+0x52/0x52 [ 51.297018] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 51.301752] ? _copy_from_user+0x20/0x150 [ 51.305879] panic+0x22f/0x4de [ 51.309047] ? add_taint.cold.5+0x16/0x16 [ 51.313175] ? do_raw_spin_unlock+0x9e/0x2e0 [ 51.317561] ? do_raw_spin_unlock+0x9e/0x2e0 [ 51.321950] ? _copy_from_user+0x100/0x150 [ 51.326162] kasan_end_report+0x47/0x4f [ 51.330128] kasan_report.cold.7+0x76/0x2fe [ 51.334441] check_memory_region+0x13e/0x1b0 [ 51.338846] kasan_check_write+0x14/0x20 [ 51.342893] _copy_from_user+0x100/0x150 [ 51.346935] simple_write_to_buffer+0xaf/0x130 [ 51.351507] snapshot_write+0x16d/0x270 [ 51.355460] ? snapshot_compat_ioctl+0x4e0/0x4e0 [ 51.360195] ? do_raw_spin_unlock+0x9e/0x2e0 [ 51.364584] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 51.369147] __vfs_write+0x10b/0x960 [ 51.372840] ? __fget_light+0x2ef/0x430 [ 51.376803] ? snapshot_compat_ioctl+0x4e0/0x4e0 [ 51.381536] ? kernel_read+0x120/0x120 [ 51.385401] ? debug_check_no_obj_freed+0x2ff/0x584 [ 51.390399] ? kasan_check_read+0x11/0x20 [ 51.394527] ? rcu_is_watching+0x85/0x140 [ 51.398655] ? rcu_pm_notify+0xc0/0xc0 [ 51.402525] ? trace_hardirqs_off+0xd/0x10 [ 51.406742] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 51.412260] ? security_file_permission+0x1c6/0x240 [ 51.417256] ? rw_verify_area+0x118/0x360 [ 51.421401] vfs_write+0x1f8/0x560 [ 51.424920] ksys_write+0xf9/0x250 [ 51.428437] ? __ia32_sys_read+0xb0/0xb0 [ 51.432475] ? ksys_ioctl+0x81/0xd0 [ 51.436080] __x64_sys_write+0x73/0xb0 [ 51.439948] do_syscall_64+0x1b1/0x800 [ 51.443813] ? finish_task_switch+0x1ca/0x810 [ 51.448285] ? syscall_return_slowpath+0x5c0/0x5c0 [ 51.453204] ? syscall_return_slowpath+0x30f/0x5c0 [ 51.458115] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 51.463467] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 51.468297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 51.473467] RIP: 0033:0x4455a9 [ 51.476643] RSP: 002b:00007f973a88ada8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 51.484336] RAX: ffffffffffffffda RBX: 00000000006dac24 RCX: 00000000004455a9 [ 51.491583] RDX: 0000000000000020 RSI: 0000000020000040 RDI: 0000000000000003 [ 51.498832] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 51.506080] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac20 [ 51.513329] R13: 616e732f7665642f R14: 00007f973a88b9c0 R15: 0000000000000003 [ 51.521068] Dumping ftrace buffer: [ 51.524587] (ftrace buffer empty) [ 51.528278] Kernel Offset: disabled [ 51.531885] Rebooting in 86400 seconds..