[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.768519] random: sshd: uninitialized urandom read (32 bytes read, 30 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.976060] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [ 20.213092] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [ 21.247390] random: sshd: uninitialized urandom read (32 bytes read, 120 bits of entropy available) [ 31.666601] random: nonblocking pool is initialized Warning: Permanently added '10.128.0.7' (ECDSA) to the list of known hosts. [ 38.096337] ================================================================== [ 38.103736] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xe8/0x100 [ 38.110984] Read of size 4 at addr ffff8800b0626780 by task syzkaller187593/3692 [ 38.118484] [ 38.120088] CPU: 1 PID: 3692 Comm: syzkaller187593 Not tainted 4.4.125-g38f41ec #63 [ 38.127848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.137168] 0000000000000000 018a296bd339e121 ffff8801cbcefcc0 ffffffff81d067bd [ 38.145137] ffffea0002c18980 ffff8800b0626780 0000000000000000 ffff8800b0626780 [ 38.153098] ffffffff82ded950 ffff8801cbcefcf8 ffffffff814fea83 ffff8800b0626780 [ 38.161064] Call Trace: [ 38.163620] [] dump_stack+0xc1/0x124 [ 38.168952] [] ? sock_release+0x1e0/0x1e0 [ 38.174716] [] print_address_description+0x73/0x260 [ 38.181351] [] ? sock_release+0x1e0/0x1e0 [ 38.187115] [] kasan_report+0x285/0x370 [ 38.192717] [] ? l2tp_session_queue_purge+0xe8/0x100 [ 38.199439] [] __asan_report_load4_noabort+0x14/0x20 [ 38.206157] [] l2tp_session_queue_purge+0xe8/0x100 [ 38.212706] [] ? sock_release+0x1e0/0x1e0 [ 38.218476] [] pppol2tp_release+0x1ff/0x310 [ 38.224417] [] sock_release+0x8d/0x1e0 [ 38.229924] [] sock_close+0x16/0x20 [ 38.235167] [] __fput+0x233/0x6d0 [ 38.240237] [] ____fput+0x15/0x20 [ 38.245309] [] task_work_run+0x104/0x180 [ 38.250989] [] exit_to_usermode_loop+0x13d/0x160 [ 38.257364] [] syscall_return_slowpath+0x1b5/0x1f0 [ 38.263911] [] int_ret_from_sys_call+0x25/0xa3 [ 38.270108] [ 38.271704] Allocated by task 3691: [ 38.275295] [] save_stack_trace+0x26/0x50 [ 38.281181] [] save_stack+0x43/0xd0 [ 38.286543] [] kasan_kmalloc+0xad/0xe0 [ 38.292163] [] __kmalloc+0x124/0x320 [ 38.297608] [] l2tp_session_create+0x39/0x10f0 [ 38.303924] [] pppol2tp_connect+0x10fc/0x1930 [ 38.310153] [] SYSC_connect+0x1b6/0x310 [ 38.315865] [] SyS_connect+0x24/0x30 [ 38.321333] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 38.327997] [ 38.329592] Freed by task 3691: [ 38.332836] [] save_stack_trace+0x26/0x50 [ 38.338806] [] save_stack+0x43/0xd0 [ 38.344165] [] kasan_slab_free+0x72/0xc0 [ 38.349961] [] kfree+0xfc/0x300 [ 38.354974] [] l2tp_session_free+0x170/0x200 [ 38.361116] [] l2tp_tunnel_closeall+0x2d1/0x3b0 [ 38.367521] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 38.373925] [] udpv6_destroy_sock+0xb1/0xd0 [ 38.379982] [] sk_common_release+0x6b/0x300 [ 38.386039] [] udp_lib_close+0x15/0x20 [ 38.391666] [] inet_release+0xfa/0x1d0 [ 38.397287] [] inet6_release+0x50/0x70 [ 38.402911] [] sock_release+0x8d/0x1e0 [ 38.408536] [] sock_close+0x16/0x20 [ 38.413897] [] __fput+0x233/0x6d0 [ 38.419089] [] ____fput+0x15/0x20 [ 38.424274] [] task_work_run+0x104/0x180 [ 38.430067] [] exit_to_usermode_loop+0x13d/0x160 [ 38.436556] [] syscall_return_slowpath+0x1b5/0x1f0 [ 38.443218] [] int_ret_from_sys_call+0x25/0xa3 [ 38.449533] [ 38.451130] The buggy address belongs to the object at ffff8800b0626780 [ 38.451130] which belongs to the cache kmalloc-512 of size 512 [ 38.463755] The buggy address is located 0 bytes inside of [ 38.463755] 512-byte region [ffff8800b0626780, ffff8800b0626980) [ 38.475422] The buggy address belongs to the page: [ 40.017743] PANIC: double fault, error_code: 0x0 [ 40.022545] CPU: 1 PID: 3692 Comm: syzkaller187593 Not tainted 4.4.125-g38f41ec #63 [ 40.030311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.039637] task: ffff8801cd331800 task.stack: ffff8801cbce8000 [ 40.045661] RIP: 0010:[] [] dump_page_badflags+0x12/0x250 [ 40.054500] RSP: 0018:ffff880100000000 EFLAGS: 00010046 [ 40.059916] RAX: ffff8801cd331800 RBX: ffffea0002c18980 RCX: ffffffff814912f0 [ 40.067155] RDX: 0000000000000000 RSI: ffffffff838a91a0 RDI: ffffea0002c18980 [ 40.074396] RBP: ffff880100000020 R08: 0000000000000001 R09: 0000000000000000 [ 40.081636] R10: 0000000000000002 R11: fffffbfff0ad821e R12: 0000000000000000 [ 40.088875] R13: ffffffff838a91a0 R14: 0000000000000000 R15: 0000000000000000 [ 40.096115] FS: 00007f529b180700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 [ 40.104309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.110158] CR2: ffff8800fffffff8 CR3: 00000000b4a10000 CR4: 0000000000160670 [ 40.117401] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.124639] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.131877] Stack: [ 40.133992] [ 40.135586] Call Trace: [ 40.138134] [ 40.140173] Code: 00 e9 50 fd ff ff e8 7e df 06 00 e9 1d fd ff ff 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 55 49 89 f5 41 54 49 89 d4 <53> 48 89 fb 48 83 ec 08 e8 f1 04 ed ff 48 8d 7b 10 48 b8 00 00 [ 40.167153] Kernel panic - not syncing: Machine halted. [ 40.172488] CPU: 1 PID: 3692 Comm: syzkaller187593 Not tainted 4.4.125-g38f41ec #63 [ 40.180258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.189582] 0000000000000000 018a296bd339e121 ffff8801db30ce38 ffffffff81d067bd [ 40.197559] ffffffff838374c0 ffff8801db30cf10 ffffffff83808040 ffff880100000000 [ 40.205530] 0000000000000000 ffff8801db30cf00 ffffffff8141b46a 0000000041b58ab3 [ 40.213494] Call Trace: [ 40.216043] <#DF> [] dump_stack+0xc1/0x124 [ 40.222109] [] panic+0x1aa/0x388 [ 40.227092] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 40.233987] [] ? vprintk_emit+0x242/0x850 [ 40.239752] [] ? dump_page_badflags+0x27/0x250 [ 40.245963] [] ? vprintk_emit+0x242/0x850 [ 40.251742] [] df_debug+0x2d/0x30 [ 40.256813] [] do_double_fault+0x10b/0x210 [ 40.262666] [] double_fault+0x2d/0x40 [ 40.268084] [] ? dump_page_badflags+0x180/0x250 [ 40.274369] [] ? dump_page_badflags+0x12/0x250 [ 40.280567] <> [ 40.283937] Dumping ftrace buffer: [ 40.287758] (ftrace buffer empty) [ 40.291452] Kernel Offset: disabled [ 40.295063] Rebooting in 86400 seconds..