random: sshd: uninitialized urandom read (32 bytes read, 116 bits of entropy available) ================================================================== BUG: KASAN: slab-out-of-bounds in pfkey_msg2xfrm_state net/key/af_key.c:1219 [inline] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x153f/0x3490 net/key/af_key.c:1498 Read of size 8192 at addr ffff8801d0572518 by task syzkaller831361/3326 CPU: 0 PID: 3326 Comm: syzkaller831361 Not tainted 4.4.107-g610c835 #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 752a5623dddceaea ffff8801d0bbf6f8 ffffffff81d0457d ffffea0007415c80 ffff8801d0572518 0000000000000000 ffff8801d0572700 ffff8801d0bbf938 ffff8801d0bbf730 ffffffff814fbb23 ffff8801d0572518 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] check_memory_region_inline mm/kasan/kasan.c:325 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:332 [] memcpy+0x23/0x50 mm/kasan/kasan.c:367 [] pfkey_msg2xfrm_state net/key/af_key.c:1219 [inline] [] pfkey_add+0x153f/0x3490 net/key/af_key.c:1498 [] pfkey_process+0x61e/0x730 net/key/af_key.c:2826 [] pfkey_sendmsg+0x3a9/0x760 net/key/af_key.c:3670 [] sock_sendmsg_nosec net/socket.c:625 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:635 [] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962 [] __sys_sendmsg+0xd3/0x190 net/socket.c:1996 [] C_SYSC_sendmsg net/compat.c:720 [inline] [] compat_SyS_sendmsg+0x2a/0x40 net/compat.c:718 [] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline] [] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457 [] sysenter_flags_fixed+0xd/0x17 Allocated by task 3326: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 [] kasan_krealloc+0x64/0x80 mm/kasan/kasan.c:654 [] ksize+0x92/0xf0 mm/slub.c:3727 [] __alloc_skb+0x132/0x600 net/core/skbuff.c:237 [] alloc_skb include/linux/skbuff.h:815 [inline] [] pfkey_sendmsg+0x135/0x760 net/key/af_key.c:3657 [] sock_sendmsg_nosec net/socket.c:625 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:635 [] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962 [] __sys_sendmsg+0xd3/0x190 net/socket.c:1996 [] C_SYSC_sendmsg net/compat.c:720 [inline] [] compat_SyS_sendmsg+0x2a/0x40 net/compat.c:718 [] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline] [] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457 [] sysenter_flags_fixed+0xd/0x17 Freed by task 1773: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xfc/0x300 mm/slub.c:3749 [] skb_free_head net/core/skbuff.c:571 [inline] [] skb_release_data+0x2ed/0x3b0 net/core/skbuff.c:602 [] skb_release_all+0x4a/0x60 net/core/skbuff.c:661 [] __kfree_skb+0x15/0x20 net/core/skbuff.c:675 [] kfree_skb+0xf7/0x3e0 net/core/skbuff.c:696 [] unix_stream_connect+0x75d/0x11d0 net/unix/af_unix.c:1370 [] SYSC_connect+0x1b6/0x310 net/socket.c:1557 [] SyS_connect+0x24/0x30 net/socket.c:1538 [] entry_SYSCALL_64_fastpath+0x16/0x76 The buggy address belongs to the object at ffff8801d0572500 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 24 bytes inside of 512-byte region [ffff8801d0572500, ffff8801d0572700) The buggy address belongs to the page: BUG: Bad page state in process rcu_preempt pfn:038a7 page:ffffea00000e29c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x4000000000000400(reserved) page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set bad because of flags: flags: 0x400(reserved) Modules linked in: CPU: 1 PID: 7 Comm: rcu_preempt Not tainted 4.4.107-g610c835 #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 3f6c21c8588feb34 ffff8801da27f808 ffffffff81d0457d ffffea00000e29c0 1ffffffff0841200 ffffffff8389a020 000000000058bce1 0000000000000000 ffff8801da27f838 ffffffff81429dbf ffffea00000e29c8 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] bad_page+0x13f/0x1a0 mm/page_alloc.c:480 [] free_pages_check mm/page_alloc.c:825 [inline] [] free_pages_prepare+0x7e6/0xb30 mm/page_alloc.c:1035 [] free_hot_cold_page+0x3f/0x3a0 mm/page_alloc.c:2112 [] __free_pages+0x67/0x90 mm/page_alloc.c:3367 [] free_pages+0x50/0x90 mm/page_alloc.c:3379 [] _pgd_free arch/x86/mm/pgtable.c:350 [inline] [] pgd_free+0x82/0xc0 arch/x86/mm/pgtable.c:399 [] mm_free_pgd kernel/fork.c:546 [inline] [] __mmdrop+0x66/0x260 kernel/fork.c:692 [] mmdrop include/linux/sched.h:2776 [inline] [] finish_task_switch+0x213/0x4e0 kernel/sched/core.c:2679 [] context_switch kernel/sched/core.c:2803 [inline] [] __schedule+0xa99/0x1c70 kernel/sched/core.c:3322 [] schedule+0x9a/0x1c0 kernel/sched/core.c:3351 [] schedule_timeout+0x356/0x970 kernel/time/timer.c:1531 [] rcu_gp_kthread+0xe09/0x2220 kernel/rcu/tree.c:2121 [] kthread+0x268/0x300 kernel/kthread.c:211 [] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468 BUG: Bad rss-counter state mm:ffff8801d057d400 idx:0 val:-2088075424 BUG: non-zero nr_pmds on freeing mm: -131933604948840 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1525 at lib/list_debug.c:53 __list_del_entry+0x111/0x1d0 lib/list_debug.c:51() list_del corruption, ffffea00000e29e0->next is LIST_POISON1 (dead000000000100)