random: sshd: uninitialized urandom read (32 bytes read, 109 bits of entropy available) ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x387e/0x4b50 kernel/locking/lockdep.c:3092 Read of size 8 at addr ffff8801d2972d38 by task syzkaller608109/3316 CPU: 1 PID: 3316 Comm: syzkaller608109 Not tainted 4.4.112-g5f6325b #21 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 b12dd01ced9c8cee ffff8801d1f47850 ffffffff81d0579d ffffea00074a5c80 ffff8801d2972d38 0000000000000000 ffff8801d2972d38 0000000000000000 ffff8801d1f47888 ffffffff814fd9f3 ffff8801d2972d38 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] __lock_acquire+0x387e/0x4b50 kernel/locking/lockdep.c:3092 [] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592 [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline] [] _raw_spin_lock_irqsave+0x4e/0x70 kernel/locking/spinlock.c:159 [] remove_wait_queue+0x14/0x40 kernel/sched/wait.c:49 [] ep_remove_wait_queue fs/eventpoll.c:530 [inline] [] ep_unregister_pollwait.isra.6+0xa8/0x220 fs/eventpoll.c:548 [] ep_free+0x93/0x1c0 fs/eventpoll.c:765 [] ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:797 [] __fput+0x233/0x6d0 fs/file_table.c:208 [] ____fput+0x15/0x20 fs/file_table.c:244 [] task_work_run+0x104/0x180 kernel/task_work.c:115 [] exit_task_work include/linux/task_work.h:21 [inline] [] do_exit+0x871/0x2a20 kernel/exit.c:755 [] do_group_exit+0x108/0x320 kernel/exit.c:885 [] SYSC_exit_group kernel/exit.c:896 [inline] [] SyS_exit_group+0x1d/0x20 kernel/exit.c:894 [] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline] [] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457 [] sysenter_flags_fixed+0xd/0x17 Allocated by task 3316: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 [] kmem_cache_alloc_trace+0x100/0x2b0 mm/slub.c:2642 [] kmalloc include/linux/slab.h:476 [inline] [] kzalloc include/linux/slab.h:620 [inline] [] binder_get_thread+0x181/0x7a0 drivers/android/binder.c:4452 [] binder_poll+0x4a/0x210 drivers/android/binder.c:4555 [] ep_item_poll fs/eventpoll.c:806 [inline] [] ep_insert fs/eventpoll.c:1319 [inline] [] SYSC_epoll_ctl fs/eventpoll.c:1934 [inline] [] SyS_epoll_ctl+0x10b1/0x2050 fs/eventpoll.c:1833 [] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline] [] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457 [] sysenter_flags_fixed+0xd/0x17 Freed by task 3316: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xfc/0x300 mm/slub.c:3749 [] binder_free_thread drivers/android/binder.c:4480 [inline] [] binder_thread_dec_tmpref+0x1c1/0x250 drivers/android/binder.c:2036 [] binder_thread_release+0x27d/0x540 drivers/android/binder.c:4544 [] binder_ioctl+0xb94/0x12e0 drivers/android/binder.c:4760 [] C_SYSC_ioctl fs/compat_ioctl.c:1592 [inline] [] compat_SyS_ioctl+0x28a/0x2540 fs/compat_ioctl.c:1544 [] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline] [] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457 [] sysenter_flags_fixed+0xd/0x17 The buggy address belongs to the object at ffff8801d2972c80 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 184 bytes inside of 512-byte region [ffff8801d2972c80, ffff8801d2972e80) The buggy address belongs to the page: PANIC: double fault, error_code: 0x0 CPU: 1 PID: 3316 Comm: syzkaller608109 Not tainted 4.4.112-g5f6325b #21 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8800b50197c0 task.stack: ffff8801d1f40000 RIP: 0010:[] [] dump_page_badflags+0x1a/0x250 mm/debug.c:84 RSP: 0018:ffff880100000000 EFLAGS: 00010086 RAX: ffff8800b50197c0 RBX: ffffea00074a5c80 RCX: ffffffff8148ff40 RDX: 0000000000000000 RSI: ffffffff838a8620 RDI: ffffea00074a5c80 RBP: ffff880100000030 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000002 R11: fffffbfff0ad7a1e R12: 0000000000000000 R13: ffffffff838a8620 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 1734 Comm: udevd Not tainted 4.4.112-g5f6325b #21 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d3ae97c0 task.stack: ffff8801d3b90000 RIP: 0010:[] [] __debug_check_no_obj_freed lib/debugobjects.c:689 [inline] RIP: 0010:[] [] debug_check_no_obj_freed+0x1a8/0x9b0 lib/debugobjects.c:726 RSP: 0000:ffff8801d3b97778 EFLAGS: 00010803 RAX: 0000000000000286 RBX: ffff8801d0e48380 RCX: 0000000000000005 RDX: 1d2000dc1b1d0161 RSI: ffff8801d3b97808 RDI: ffffffff8148ff69 RBP: ffff8801d3b97870 R08: 1ffffffff0291fed R09: ffffffff8512b880 R10: dead000000000200 R11: 1ffff1003a772eb6 R12: ecff7ee8ffffff45 R13: ffff8801d0e48300 R14: e90006e0d8e80b0f R15: dffffc0000000000 FS: 00007faa624617a0(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001d3b62000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff81642370 ffff8801d3b977c0 ffff880100000018 ffff8801d3b978b8 1ffff1003a772efd ffffffff85786bc0 ffff8801d0e49000 ffff8801d0e48380 ffffffff842bcb20 a1a7875492e29c4f 0000000000027180 fffffbfff0af0d78 Call Trace: [] slab_free_hook mm/slub.c:1376 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xf1/0x300 mm/slub.c:3749 [] do_coredump+0xec6/0x2af0 fs/coredump.c:747 [] get_signal+0x63a/0x1660 kernel/signal.c:2311 [] do_signal+0x8b/0x1d40 arch/x86/kernel/signal.c:712 [] exit_to_usermode_loop+0x122/0x170 arch/x86/entry/common.c:247 [] prepare_exit_to_usermode+0xe3/0x100 arch/x86/entry/common.c:282 [] retint_user+0x8/0x3c Code: 48 c7 c6 40 fa 75 85 4c 8b 34 0e 4d 85 f6 0f 84 c5 03 00 00 49 ba 00 02 00 00 00 00 ad de 31 c9 48 8d 75 98 4c 89 f2 48 c1 ea 03 <42> 80 3c 3a 00 0f 85 f0 03 00 00 49 8d 7e 18 83 c1 01 49 8b 16 RIP [] __debug_check_no_obj_freed lib/debugobjects.c:689 [inline] RIP [] debug_check_no_obj_freed+0x1a8/0x9b0 lib/debugobjects.c:726 RSP ---[ end trace 7ebeb53337120894 ]---