[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.430114] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.839107] random: sshd: uninitialized urandom read (32 bytes read) [ 23.002108] random: sshd: uninitialized urandom read (32 bytes read) [ 23.670978] random: sshd: uninitialized urandom read (32 bytes read) [ 23.824402] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.0' (ECDSA) to the list of known hosts. [ 29.373187] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 29.460855] ================================================================== [ 29.468323] BUG: KASAN: null-ptr-deref in refcount_inc_not_zero+0x8f/0x2d0 [ 29.475316] Read of size 4 at addr 0000000000000004 by task syzkaller633288/4488 [ 29.482821] [ 29.484430] CPU: 0 PID: 4488 Comm: syzkaller633288 Not tainted 4.17.0-rc1+ #12 [ 29.491764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.501097] Call Trace: [ 29.503667] dump_stack+0x1b9/0x294 [ 29.507274] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.512444] ? kasan_check_write+0x14/0x20 [ 29.516663] ? do_raw_spin_lock+0xc1/0x200 [ 29.520876] ? vprintk_func+0x81/0xe7 [ 29.524659] ? refcount_inc_not_zero+0x8f/0x2d0 [ 29.529309] kasan_report.cold.7+0x6d/0x2fe [ 29.533610] check_memory_region+0x13e/0x1b0 [ 29.537998] kasan_check_read+0x11/0x20 [ 29.541962] refcount_inc_not_zero+0x8f/0x2d0 [ 29.546437] ? refcount_add_not_zero+0x320/0x320 [ 29.551173] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.556166] ? lock_sock_nested+0x9f/0x120 [ 29.560384] refcount_inc+0x15/0x70 [ 29.563989] llc_ui_release+0xba/0x2b0 [ 29.567858] ? fsnotify_first_mark+0x330/0x330 [ 29.572421] sock_release+0x96/0x1b0 [ 29.576112] ? sock_alloc_file+0x4e0/0x4e0 [ 29.580324] sock_close+0x16/0x20 [ 29.583756] __fput+0x34d/0x890 [ 29.587030] ? fput+0x1a0/0x1a0 [ 29.590301] ? _raw_spin_unlock_irq+0x27/0x70 [ 29.594780] ____fput+0x15/0x20 [ 29.598047] task_work_run+0x1e4/0x290 [ 29.601915] ? task_work_cancel+0x240/0x240 [ 29.606217] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 29.611733] ? switch_task_namespaces+0xa2/0xd0 [ 29.616381] do_exit+0x1aee/0x2730 [ 29.619902] ? mm_update_next_owner+0x980/0x980 [ 29.624546] ? kasan_kmalloc+0xc4/0xe0 [ 29.628412] ? kasan_slab_alloc+0x12/0x20 [ 29.632548] ? kmem_cache_alloc+0x12e/0x760 [ 29.636848] ? get_empty_filp+0x125/0x520 [ 29.640974] ? alloc_file+0x24/0x3e0 [ 29.644675] ? sock_alloc_file+0x1f3/0x4e0 [ 29.648889] ? __sys_socket+0x16f/0x250 [ 29.652844] ? __x64_sys_socket+0x73/0xb0 [ 29.656971] ? do_syscall_64+0x1b1/0x800 [ 29.661015] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.666373] ? find_held_lock+0x36/0x1c0 [ 29.670414] ? debug_mutex_init+0x1c/0x60 [ 29.674541] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.679533] ? graph_lock+0x170/0x170 [ 29.683313] ? lockdep_init_map+0x9/0x10 [ 29.687353] ? __mutex_init+0x1ef/0x280 [ 29.691306] ? find_held_lock+0x36/0x1c0 [ 29.695349] ? lock_downgrade+0x8e0/0x8e0 [ 29.699475] ? kasan_check_read+0x11/0x20 [ 29.703608] ? rcu_is_watching+0x85/0x140 [ 29.707734] ? __lock_is_held+0xb5/0x140 [ 29.711784] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 29.716959] ? __fd_install+0x2de/0x880 [ 29.720912] ? get_unused_fd_flags+0x190/0x190 [ 29.725473] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.730994] ? alloc_file+0x44/0x3e0 [ 29.734692] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 29.740206] ? sock_alloc_file+0x2a4/0x4e0 [ 29.744418] ? sock_release+0x1b0/0x1b0 [ 29.748370] ? get_unused_fd_flags+0x121/0x190 [ 29.752932] ? __alloc_fd+0x700/0x700 [ 29.756713] ? fd_install+0x4d/0x60 [ 29.760320] do_group_exit+0x16f/0x430 [ 29.764196] ? __ia32_sys_exit+0x50/0x50 [ 29.768239] ? do_syscall_64+0x92/0x800 [ 29.772193] __x64_sys_exit_group+0x3e/0x50 [ 29.776492] do_syscall_64+0x1b1/0x800 [ 29.780361] ? syscall_return_slowpath+0x5c0/0x5c0 [ 29.785268] ? syscall_return_slowpath+0x30f/0x5c0 [ 29.790180] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 29.795524] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.800347] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.805516] RIP: 0033:0x43e878 [ 29.808683] RSP: 002b:00007ffd854075f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 29.816369] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043e878 [ 29.823616] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 29.830865] RBP: 00000000004be220 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 29.838113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 29.845361] R13: 00000000006cc160 R14: 0000000000000000 R15: 0000000000000000 [ 29.852613] ================================================================== [ 29.859951] Disabling lock debugging due to kernel taint [ 29.865463] Kernel panic - not syncing: panic_on_warn set ... [ 29.865463] [ 29.872819] CPU: 0 PID: 4488 Comm: syzkaller633288 Tainted: G B 4.17.0-rc1+ #12 [ 29.881541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.890868] Call Trace: [ 29.893435] dump_stack+0x1b9/0x294 [ 29.897042] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.902210] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 29.906943] ? refcount_add_not_zero+0x320/0x320 [ 29.911675] panic+0x22f/0x4de [ 29.914845] ? add_taint.cold.5+0x16/0x16 [ 29.918969] ? do_raw_spin_unlock+0x9e/0x2e0 [ 29.923354] ? do_raw_spin_unlock+0x9e/0x2e0 [ 29.927741] ? refcount_inc_not_zero+0x8f/0x2d0 [ 29.932391] kasan_end_report+0x47/0x4f [ 29.936340] kasan_report.cold.7+0x76/0x2fe [ 29.940639] check_memory_region+0x13e/0x1b0 [ 29.945033] kasan_check_read+0x11/0x20 [ 29.948988] refcount_inc_not_zero+0x8f/0x2d0 [ 29.953462] ? refcount_add_not_zero+0x320/0x320 [ 29.958195] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.963187] ? lock_sock_nested+0x9f/0x120 [ 29.967400] refcount_inc+0x15/0x70 [ 29.971009] llc_ui_release+0xba/0x2b0 [ 29.974880] ? fsnotify_first_mark+0x330/0x330 [ 29.979438] sock_release+0x96/0x1b0 [ 29.983129] ? sock_alloc_file+0x4e0/0x4e0 [ 29.987340] sock_close+0x16/0x20 [ 29.990772] __fput+0x34d/0x890 [ 29.994036] ? fput+0x1a0/0x1a0 [ 29.997297] ? _raw_spin_unlock_irq+0x27/0x70 [ 30.001767] ____fput+0x15/0x20 [ 30.005031] task_work_run+0x1e4/0x290 [ 30.008895] ? task_work_cancel+0x240/0x240 [ 30.013197] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 30.018712] ? switch_task_namespaces+0xa2/0xd0 [ 30.023356] do_exit+0x1aee/0x2730 [ 30.026872] ? mm_update_next_owner+0x980/0x980 [ 30.031515] ? kasan_kmalloc+0xc4/0xe0 [ 30.035377] ? kasan_slab_alloc+0x12/0x20 [ 30.039500] ? kmem_cache_alloc+0x12e/0x760 [ 30.043798] ? get_empty_filp+0x125/0x520 [ 30.047922] ? alloc_file+0x24/0x3e0 [ 30.051614] ? sock_alloc_file+0x1f3/0x4e0 [ 30.055823] ? __sys_socket+0x16f/0x250 [ 30.059776] ? __x64_sys_socket+0x73/0xb0 [ 30.063899] ? do_syscall_64+0x1b1/0x800 [ 30.067935] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 30.073285] ? find_held_lock+0x36/0x1c0 [ 30.077322] ? debug_mutex_init+0x1c/0x60 [ 30.081447] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 30.086438] ? graph_lock+0x170/0x170 [ 30.090215] ? lockdep_init_map+0x9/0x10 [ 30.094253] ? __mutex_init+0x1ef/0x280 [ 30.098204] ? find_held_lock+0x36/0x1c0 [ 30.102244] ? lock_downgrade+0x8e0/0x8e0 [ 30.106371] ? kasan_check_read+0x11/0x20 [ 30.110495] ? rcu_is_watching+0x85/0x140 [ 30.114632] ? __lock_is_held+0xb5/0x140 [ 30.118694] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 30.123877] ? __fd_install+0x2de/0x880 [ 30.127839] ? get_unused_fd_flags+0x190/0x190 [ 30.132402] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 30.137914] ? alloc_file+0x44/0x3e0 [ 30.141607] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 30.147122] ? sock_alloc_file+0x2a4/0x4e0 [ 30.151332] ? sock_release+0x1b0/0x1b0 [ 30.155286] ? get_unused_fd_flags+0x121/0x190 [ 30.159850] ? __alloc_fd+0x700/0x700 [ 30.163629] ? fd_install+0x4d/0x60 [ 30.167232] do_group_exit+0x16f/0x430 [ 30.171112] ? __ia32_sys_exit+0x50/0x50 [ 30.175150] ? do_syscall_64+0x92/0x800 [ 30.179101] __x64_sys_exit_group+0x3e/0x50 [ 30.183397] do_syscall_64+0x1b1/0x800 [ 30.187261] ? syscall_return_slowpath+0x5c0/0x5c0 [ 30.192168] ? syscall_return_slowpath+0x30f/0x5c0 [ 30.197075] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 30.202415] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 30.207234] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 30.212396] RIP: 0033:0x43e878 [ 30.215561] RSP: 002b:00007ffd854075f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 30.223244] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043e878 [ 30.230487] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 30.237735] RBP: 00000000004be220 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 30.244980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 30.252225] R13: 00000000006cc160 R14: 0000000000000000 R15: 0000000000000000 [ 30.259949] Dumping ftrace buffer: [ 30.263463] (ftrace buffer empty) [ 30.267146] Kernel Offset: disabled [ 30.270747] Rebooting in 86400 seconds..