[ 16.580434] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.771662] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 22.249020] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 23.105483] random: sshd: uninitialized urandom read (32 bytes read, 101 bits of entropy available) [ 23.284832] random: sshd: uninitialized urandom read (32 bytes read, 107 bits of entropy available) Warning: Permanently added '10.128.0.13' (ECDSA) to the list of known hosts. [ 28.690224] random: sshd: uninitialized urandom read (32 bytes read, 117 bits of entropy available) executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 29.196983] ================================================================== [ 29.204374] BUG: KASAN: use-after-free in pppol2tp_session_destruct+0xee/0x110 [ 29.211701] Read of size 4 at addr ffff8800b4c69680 by task syzkaller943914/3312 [ 29.219198] [ 29.220798] CPU: 1 PID: 3312 Comm: syzkaller943914 Not tainted 4.4.112-g3fc4284 #32 [ 29.228561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.237884] 0000000000000000 05b39818b00d7906 ffff8801d096fc70 ffffffff81d054ed [ 29.245861] ffffea0002d31a00 ffff8800b4c69680 0000000000000000 ffff8800b4c69680 [ 29.253828] ffffffff82dea4d0 ffff8801d096fca8 ffffffff814fd953 ffff8800b4c69680 [ 29.261794] Call Trace: [ 29.264358] [] dump_stack+0xc1/0x124 [ 29.269693] [] ? sock_release+0x1e0/0x1e0 [ 29.275463] [] print_address_description+0x73/0x260 [ 29.282106] [] ? sock_release+0x1e0/0x1e0 [ 29.287880] [] kasan_report+0x285/0x370 [ 29.293476] [] ? pppol2tp_session_destruct+0xee/0x110 [ 29.300284] [] __asan_report_load4_noabort+0x14/0x20 [ 29.307014] [] pppol2tp_session_destruct+0xee/0x110 [ 29.313647] [] ? pppol2tp_seq_start+0x4e0/0x4e0 [ 29.319989] [] sk_destruct+0x4a/0x4c0 [ 29.325419] [] __sk_free+0x57/0x230 [ 29.330677] [] sk_free+0x30/0x40 [ 29.335662] [] pppol2tp_release+0x27a/0x310 [ 29.341602] [] sock_release+0x8d/0x1e0 [ 29.347107] [] sock_close+0x16/0x20 [ 29.352356] [] __fput+0x233/0x6d0 [ 29.357432] [] ____fput+0x15/0x20 [ 29.362514] [] task_work_run+0x104/0x180 [ 29.368201] [] exit_to_usermode_loop+0x145/0x170 [ 29.374582] [] syscall_return_slowpath+0x1b5/0x1f0 [ 29.381133] [] int_ret_from_sys_call+0x25/0xa3 [ 29.387331] [ 29.388944] Allocated by task 3311: [ 29.392539] [] save_stack_trace+0x26/0x50 [ 29.398426] [] save_stack+0x43/0xd0 [ 29.403791] [] kasan_kmalloc+0xad/0xe0 [ 29.409415] [] __kmalloc+0x124/0x320 [ 29.414861] [] l2tp_session_create+0x39/0x10f0 [ 29.421175] [] pppol2tp_connect+0x10fc/0x1930 [ 29.427404] [] SYSC_connect+0x1b6/0x310 [ 29.433115] [] SyS_connect+0x24/0x30 [ 29.438564] [] entry_SYSCALL_64_fastpath+0x16/0x92 [ 29.445227] [ 29.446822] Freed by task 3311: [ 29.450067] [] save_stack_trace+0x26/0x50 [ 29.455953] [] save_stack+0x43/0xd0 [ 29.461319] [] kasan_slab_free+0x72/0xc0 [ 29.467124] [] kfree+0xfc/0x300 [ 29.472139] [] l2tp_session_free+0x170/0x200 [ 29.478294] [] l2tp_tunnel_closeall+0x2d1/0x3b0 [ 29.484705] [] l2tp_udp_encap_destroy+0x8b/0xf0 [ 29.491126] [] udpv6_destroy_sock+0xb1/0xd0 [ 29.497185] [] sk_common_release+0x6b/0x300 [ 29.503255] [] udp_lib_close+0x15/0x20 [ 29.508878] [] inet_release+0xfa/0x1d0 [ 29.514499] [] inet6_release+0x50/0x70 [ 29.520130] [] sock_release+0x8d/0x1e0 [ 29.525759] [] sock_close+0x16/0x20 [ 29.531127] [] __fput+0x233/0x6d0 [ 29.536321] [] ____fput+0x15/0x20 [ 29.541514] [] task_work_run+0x104/0x180 [ 29.547322] [] exit_to_usermode_loop+0x145/0x170 [ 29.553826] [] syscall_return_slowpath+0x1b5/0x1f0 [ 29.560498] [] int_ret_from_sys_call+0x25/0xa3 [ 29.566817] [ 29.568430] The buggy address belongs to the object at ffff8800b4c69680 [ 29.568430] which belongs to the cache kmalloc-512 of size 512 [ 29.581056] The buggy address is located 0 bytes inside of [ 29.581056] 512-byte region [ffff8800b4c69680, ffff8800b4c69880) [ 29.592731] The buggy address belongs to the page: [ 29.602170] BUG: unable to handle kernel paging request at ffffebe000000028 [ 29.609534] IP: [] __list_del_entry+0x30/0x1d0 [ 29.615801] PGD 0 [ 29.618065] Oops: 0000 [#1] PREEMPT SMP KASAN [ 29.623072] Dumping ftrace buffer: [ 29.626602] (ftrace buffer empty) [ 29.630303] Modules linked in: [ 29.633631] CPU: 0 PID: 7 Comm: rcu_preempt Not tainted 4.4.112-g3fc4284 #32 [ 29.640803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.650151] task: ffff8801da3717c0 task.stack: ffff8801da388000 [ 29.656199] RIP: 0010:[] [] __list_del_entry+0x30/0x1d0 [ 29.664917] RSP: 0018:ffff8801da38f900 EFLAGS: 00010246 [ 29.670354] RAX: dffffc0000000000 RBX: ffffebe000000020 RCX: ffffebe000000020 [ 29.677699] RDX: ffffebe000000020 RSI: ffff8801da372030 RDI: ffffebe000000028 [ 29.684956] RBP: ffff8801da38f918 R08: 0000000000000001 R09: ffffffff850e38e0 [ 29.692229] R10: 0000000000000001 R11: 1ffff1003b471ef0 R12: ffff8801d089ca00 [ 29.699488] R13: 0000000080000000 R14: 000077ff80000000 R15: dffffc0000000000 [ 29.706752] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 29.714971] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.720842] CR2: ffffebe000000028 CR3: 00000001d1330000 CR4: 0000000000160670 [ 29.728101] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.735379] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.742635] Stack: [ 29.744772] 0000000000000000 ffffebe000000020 ffff8801d089ca00 ffff8801da38f930 [ 29.752827] ffffffff81d6588d 0000000000000000 ffff8801da38f960 ffffffff810e93e3 [ 29.760879] ffff8801d089ca00 ffff8801d089cd40 0000000000000000 0000000000000000 [ 29.768917] Call Trace: [ 29.771497] [] list_del+0xd/0x70 [ 29.776509] [] pgd_free+0x63/0x100 [ 29.781689] [] __mmdrop+0x66/0x260 [ 29.786873] [] finish_task_switch+0x213/0x4e0 [ 29.793008] [] ? finish_task_switch+0x1bb/0x4e0 [ 29.799325] [] ? __schedule+0xa26/0x1c70 [ 29.805031] [] __schedule+0xa9d/0x1c70 [ 29.810557] [] ? check_preemption_disabled+0x3b/0x200 [ 29.817393] [] schedule+0x9a/0x1c0 [ 29.822578] [] schedule_timeout+0x356/0x970 [ 29.828544] [] ? prepare_to_wait_event+0x114/0x420 [ 29.835117] [] ? usleep_range+0x140/0x140 [ 29.840908] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 29.847747] [] ? init_timer_key+0x360/0x360 [ 29.853711] [] ? __might_sleep+0x90/0x1a0 [ 29.859507] [] rcu_gp_kthread+0xe09/0x2220 [ 29.865399] [] ? force_qs_rnp+0x3e0/0x3e0 [ 29.871194] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 29.878024] [] ? _raw_spin_unlock_irq+0x38/0x50 [ 29.884336] [] ? __schedule+0x1006/0x1c70 [ 29.890132] [] ? preempt_schedule+0x24/0x30 [ 29.896095] [] ? ___preempt_schedule+0x12/0x14 [ 29.902325] [] ? prepare_to_wait_event+0x420/0x420 [ 29.908897] [] ? __kthread_parkme+0x164/0x230 [ 29.915037] [] kthread+0x268/0x300 [ 29.920222] [] ? force_qs_rnp+0x3e0/0x3e0 [ 29.926013] [] ? kthread_create_on_node+0x400/0x400 [ 29.932681] [] ? kthread_create_on_node+0x400/0x400 [ 29.939337] [] ret_from_fork+0x3f/0x70 [ 29.944866] [] ? kthread_create_on_node+0x400/0x400 [ 29.951517] Code: 00 00 fc ff df 48 89 f9 55 48 83 c7 08 48 89 fa 48 89 e5 41 54 48 c1 ea 03 53 48 83 ec 08 80 3c 02 00 0f 85 87 01 00 00 48 89 ca <48> 8b 59 08 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 [ 29.979238] RIP [] __list_del_entry+0x30/0x1d0 [ 29.985605] RSP [ 29.989220] CR2: ffffebe000000028 [ 29.992665] ---[ end trace 70e8edd233763bae ]--- [ 29.997408] Kernel panic - not syncing: Fatal exception [ 31.143908] Shutting down cpus with NMI [ 31.148377] Dumping ftrace buffer: [ 31.151899] (ftrace buffer empty) [ 31.155580] Kernel Offset: disabled [ 31.159182] Rebooting in 86400 seconds..