random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
BUG: sleeping function called from invalid context at net/core/sock.c:2502
in_atomic(): 1, irqs_disabled(): 0, pid: 3762, name: syz-executor992
1 lock held by syz-executor992/3762:
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_process_callbacks+0x98e/0x12b0 kernel/rcu/tree.c:3037
Preemption disabled at:[   34.826469] [<ffffffff81f1ba94>] __debug_check_no_obj_freed lib/debugobjects.c:711 [inline]
Preemption disabled at:[   34.826469] [<ffffffff81f1ba94>] debug_check_no_obj_freed+0x164/0x930 lib/debugobjects.c:749
CPU: 0 PID: 3762 Comm: syz-executor992 Not tainted 4.9.98-gf679e4d #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db207cd8 ffffffff81eb0fc9 ffffffff81f1ba94 0000000000000000
 0000000000000101 ffff8801bda3c800 ffff8801bda3c800 ffff8801db207d10
 ffffffff81422310 ffff8801bda3c800 ffffffff840f5f60 00000000000009c6
Call Trace:
 <IRQ> [   34.878723]  [<ffffffff81eb0fc9>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [   34.878723]  [<ffffffff81eb0fc9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81422310>] ___might_sleep.cold.123+0x1bc/0x1f5 kernel/sched/core.c:7992
 [<ffffffff811b9335>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7949
 [<ffffffff83020614>] lock_sock_nested+0x34/0x120 net/core/sock.c:2502
 [<ffffffff8341c369>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff8341c369>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
 [<ffffffff836be630>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
 [<ffffffff836b7e61>] l2tp_tunnel_closeall+0x231/0x350 net/l2tp/l2tp_core.c:1368
 [<ffffffff836b86e2>] l2tp_tunnel_destruct+0x2f2/0x590 net/l2tp/l2tp_core.c:1324
 [<ffffffff8301d095>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
 [<ffffffff8128578e>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff8128578e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff8128578e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff8128578e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff8128578e>] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037
 [<ffffffff839fb23b>] __do_softirq+0x20b/0x937 kernel/softirq.c:284
 [<ffffffff81149037>] invoke_softirq kernel/softirq.c:364 [inline]
 [<ffffffff81149037>] irq_exit+0x147/0x190 kernel/softirq.c:405
 [<ffffffff839f9e21>] exiting_irq arch/x86/include/asm/apic.h:659 [inline]
 [<ffffffff839f9e21>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:960
 [<ffffffff839f5fb0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> [   35.009521]  [<ffffffff839f3d5f>] ? arch_local_irq_restore arch/x86/include/asm/paravirt.h:768 [inline]
 <EOI> [   35.009521]  [<ffffffff839f3d5f>] ? __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline]
 <EOI> [   35.009521]  [<ffffffff839f3d5f>] ? _raw_spin_unlock_irqrestore+0x5f/0x70 kernel/locking/spinlock.c:191
 [<ffffffff81f1bc1c>] __debug_check_no_obj_freed lib/debugobjects.c:733 [inline]
 [<ffffffff81f1bc1c>] debug_check_no_obj_freed+0x2ec/0x930 lib/debugobjects.c:749
 [<ffffffff8144838d>] free_pages_prepare mm/page_alloc.c:1061 [inline]
 [<ffffffff8144838d>] __free_pages_ok+0x1dd/0x1610 mm/page_alloc.c:1263
 [<ffffffff8144981e>] free_compound_page+0x5e/0x70 mm/page_alloc.c:594
 [<ffffffff8154f549>] free_transhuge_page+0x99/0xc0 mm/huge_memory.c:2228
 [<ffffffff81461b80>] __put_compound_page+0x80/0xc0 mm/swap.c:94
 [<ffffffff81463774>] release_pages+0x2f4/0x970 mm/swap.c:763
 [<ffffffff81506577>] free_pages_and_swap_cache+0x117/0x160 mm/swap_state.c:273
 [<ffffffff814bdd34>] tlb_flush_mmu_free+0xb4/0x150 mm/memory.c:259
 [<ffffffff814c616d>] zap_pte_range mm/memory.c:1216 [inline]
 [<ffffffff814c616d>] zap_pmd_range mm/memory.c:1258 [inline]
 [<ffffffff814c616d>] zap_pud_range mm/memory.c:1279 [inline]
 [<ffffffff814c616d>] unmap_page_range+0x104d/0x1730 mm/memory.c:1300
 [<ffffffff814c6951>] unmap_single_vma+0x101/0x260 mm/memory.c:1345
 [<ffffffff814c7292>] unmap_vmas+0x102/0x1d0 mm/memory.c:1375
 [<ffffffff814df9f4>] exit_mmap+0x214/0x3f0 mm/mmap.c:2988
 [<ffffffff81129dd3>] __mmput kernel/fork.c:878 [inline]
 [<ffffffff81129dd3>] mmput+0xf3/0x2d0 kernel/fork.c:900
 [<ffffffff8113ebb6>] exit_mm kernel/exit.c:518 [inline]
 [<ffffffff8113ebb6>] do_exit+0x906/0x27c0 kernel/exit.c:824
 [<ffffffff81144d91>] do_group_exit+0x111/0x340 kernel/exit.c:941
 [<ffffffff81144fdd>] SYSC_exit_group kernel/exit.c:952 [inline]
 [<ffffffff81144fdd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:950
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f4653>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

=================================
[ INFO: inconsistent lock state ]
4.9.98-gf679e4d #14 Tainted: G        W      
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz-executor992/3762 [HC0[0]:SC1[3]:HE1:SE0] takes:
 (sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff8341c369>] lock_sock include/net/sock.h:1404 [inline]
 (sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff8341c369>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
  mark_held_locks+0xc7/0x130 kernel/locking/lockdep.c:2660
  __trace_hardirqs_on_caller kernel/locking/lockdep.c:2689 [inline]
  trace_hardirqs_on_caller+0x38b/0x590 kernel/locking/lockdep.c:2736
  trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2743
  __local_bh_enable_ip+0x6a/0xd0 kernel/softirq.c:186
  local_bh_enable include/linux/bottom_half.h:31 [inline]
  lock_sock_nested+0xdc/0x120 net/core/sock.c:2512
  lock_sock include/net/sock.h:1404 [inline]
  pppol2tp_connect+0xd9/0x18f0 net/l2tp/l2tp_ppp.c:590
  SYSC_connect+0x1b8/0x300 net/socket.c:1562
  SyS_connect+0x24/0x30 net/socket.c:1543
  do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
  entry_SYSCALL_64_after_swapgs+0x5d/0xdb
irq event stamp: 2702
hardirqs last  enabled at (2702): [<ffffffff839f4fe9>] restore_regs_and_iret+0x0/0x1d
hardirqs last disabled at (2701): [<ffffffff839f5fab>] apic_timer_interrupt+0x9b/0xb0 arch/x86/entry/entry_64.S:648
softirqs last  enabled at (342): [<ffffffff8302109e>] spin_unlock_bh include/linux/spinlock.h:352 [inline]
softirqs last  enabled at (342): [<ffffffff8302109e>] release_sock+0x14e/0x1c0 net/core/sock.c:2531
softirqs last disabled at (1917): [<ffffffff81149037>] invoke_softirq kernel/softirq.c:364 [inline]
softirqs last disabled at (1917): [<ffffffff81149037>] irq_exit+0x147/0x190 kernel/softirq.c:405

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_PPPOX);
  <Interrupt>
    lock(sk_lock-AF_PPPOX);

 *** DEADLOCK ***

1 lock held by syz-executor992/3762:
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff8128586e>] rcu_process_callbacks+0x98e/0x12b0 kernel/rcu/tree.c:3037

stack backtrace:
CPU: 0 PID: 3762 Comm: syz-executor992 Tainted: G        W       4.9.98-gf679e4d #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db207a58 ffffffff81eb0fc9 ffff8801bda3c800 ffffffff855ef880
 ffff8801bda3d0f0 ffff8801bda3d110 0000000000000000 ffff8801db207ac8
 ffffffff814256bb 0000000000000003 0000000000000001 ffff880100000000
Call Trace:
 <IRQ> [   35.440378]  [<ffffffff81eb0fc9>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [   35.440378]  [<ffffffff81eb0fc9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814256bb>] print_usage_bug.cold.56+0x327/0x421 kernel/locking/lockdep.c:2387
 [<ffffffff81233196>] valid_state kernel/locking/lockdep.c:2400 [inline]
 [<ffffffff81233196>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline]
 [<ffffffff81233196>] mark_lock+0xcc6/0x1280 kernel/locking/lockdep.c:3065
 [<ffffffff812350c0>] mark_irqflags kernel/locking/lockdep.c:2923 [inline]
 [<ffffffff812350c0>] __lock_acquire+0xd40/0x4070 kernel/locking/lockdep.c:3302
 [<ffffffff81238e60>] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756
 [<ffffffff830206a6>] lock_sock_nested+0xc6/0x120 net/core/sock.c:2511
 [<ffffffff8341c369>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff8341c369>] inet_shutdown+0x69/0x360 net/ipv4/af_inet.c:823
 [<ffffffff836be630>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
 [<ffffffff836b7e61>] l2tp_tunnel_closeall+0x231/0x350 net/l2tp/l2tp_core.c:1368
 [<ffffffff836b86e2>] l2tp_tunnel_destruct+0x2f2/0x590 net/l2tp/l2tp_core.c:1324
 [<ffffffff8301d095>] __sk_destruct+0x55/0x590 net/core/sock.c:1428
 [<ffffffff8128578e>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff8128578e>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff8128578e>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff8128578e>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff8128578e>] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037
 [<ffffffff839fb23b>] __do_softirq+0x20b/0x937 kernel/softirq.c:284
 [<ffffffff81149037>] invoke_softirq kernel/softirq.c:364 [inline]
 [<ffffffff81149037>] irq_exit+0x147/0x190 kernel/softirq.c:405
 [<ffffffff839f9e21>] exiting_irq arch/x86/include/asm/apic.h:659 [inline]
 [<ffffffff839f9e21>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:960
 [<ffffffff839f5fb0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> [   35.612338]  [<ffffffff839f3d5f>] ? arch_local_irq_restore arch/x86/include/asm/paravirt.h:768 [inline]
 <EOI> [   35.612338]  [<ffffffff839f3d5f>] ? __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline]
 <EOI> [   35.612338]  [<ffffffff839f3d5f>] ? _raw_spin_unlock_irqrestore+0x5f/0x70 kernel/locking/spinlock.c:191
 [<ffffffff81f1bc1c>] __debug_check_no_obj_freed lib/debugobjects.c:733 [inline]
 [<ffffffff81f1bc1c>] debug_check_no_obj_freed+0x2ec/0x930 lib/debugobjects.c:749
 [<ffffffff8144838d>] free_pages_prepare mm/page_alloc.c:1061 [inline]
 [<ffffffff8144838d>] __free_pages_ok+0x1dd/0x1610 mm/page_alloc.c:1263
 [<ffffffff8144981e>] free_compound_page+0x5e/0x70 mm/page_alloc.c:594
 [<ffffffff8154f549>] free_transhuge_page+0x99/0xc0 mm/huge_memory.c:2228
 [<ffffffff81461b80>] __put_compound_page+0x80/0xc0 mm/swap.c:94
 [<ffffffff81463774>] release_pages+0x2f4/0x970 mm/swap.c:763
 [<ffffffff81506577>] free_pages_and_swap_cache+0x117/0x160 mm/swap_state.c:273
 [<ffffffff814bdd34>] tlb_flush_mmu_free+0xb4/0x150 mm/memory.c:259
 [<ffffffff814c616d>] zap_pte_range mm/memory.c:1216 [inline]
 [<ffffffff814c616d>] zap_pmd_range mm/memory.c:1258 [inline]
 [<ffffffff814c616d>] zap_pud_range mm/memory.c:1279 [inline]
 [<ffffffff814c616d>] unmap_page_range+0x104d/0x1730 mm/memory.c:1300
 [<ffffffff814c6951>] unmap_single_vma+0x101/0x260 mm/memory.c:1345
 [<ffffffff814c7292>] unmap_vmas+0x102/0x1d0 mm/memory.c:1375
 [<ffffffff814df9f4>] exit_mmap+0x214/0x3f0 mm/mmap.c:2988
 [<ffffffff81129dd3>] __mmput kernel/fork.c:878 [inline]
 [<ffffffff81129dd3>] mmput+0xf3/0x2d0 kernel/fork.c:900
 [<ffffffff8113ebb6>] exit_mm kernel/exit.c:518 [inline]
 [<ffffffff8113ebb6>] do_exit+0x906/0x27c0 kernel/exit.c:824
 [<ffffffff81144d91>] do_group_exit+0x111/0x340 kernel/exit.c:941
 [<ffffffff81144fdd>] SYSC_exit_group kernel/exit.c:952 [inline]
 [<ffffffff81144fdd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:950
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f4653>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3762 at net/ipv4/af_inet.c:167 inet_sock_destruct+0x598/0x760 net/ipv4/af_inet.c:167