[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.895393] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 20.284581] random: sshd: uninitialized urandom read (32 bytes read) [ 20.639413] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.379516] random: sshd: uninitialized urandom read (32 bytes read) [ 21.540546] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.12' (ECDSA) to the list of known hosts. [ 27.010349] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 27.100904] ================================================================== [ 27.108361] BUG: KASAN: use-after-free in bpf_csum_update+0xb4/0xc0 [ 27.114747] Read of size 1 at addr ffff8801ad062f10 by task syz-executor354/4488 [ 27.122253] [ 27.123865] CPU: 1 PID: 4488 Comm: syz-executor354 Not tainted 4.17.0-rc6+ #29 [ 27.131202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.140546] Call Trace: [ 27.143121] dump_stack+0x1b9/0x294 [ 27.146733] ? dump_stack_print_info.cold.2+0x52/0x52 [ 27.151904] ? printk+0x9e/0xba [ 27.155166] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 27.159904] ? kasan_check_write+0x14/0x20 [ 27.164122] print_address_description+0x6c/0x20b [ 27.168946] ? bpf_csum_update+0xb4/0xc0 [ 27.172985] kasan_report.cold.7+0x242/0x2fe [ 27.177382] __asan_report_load1_noabort+0x14/0x20 [ 27.182289] bpf_csum_update+0xb4/0xc0 [ 27.186159] ? lock_downgrade+0x8e0/0x8e0 [ 27.190286] ? rcu_pm_notify+0xc0/0xc0 [ 27.194159] ? pvclock_read_flags+0x160/0x160 [ 27.198636] ? rcu_read_lock_sched_held+0x108/0x120 [ 27.203631] ? kmem_cache_alloc+0x5fa/0x760 [ 27.207934] ? ktime_get+0x33e/0x430 [ 27.211629] ? lock_acquire+0x1dc/0x520 [ 27.215584] ? bpf_test_run+0x1f3/0x3b0 [ 27.219542] ? kasan_check_read+0x11/0x20 [ 27.223670] ? rcu_is_watching+0x85/0x140 [ 27.227797] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 27.232979] ? __might_sleep+0x95/0x190 [ 27.236943] ? bpf_test_run+0xaf/0x3b0 [ 27.240813] ? bpf_prog_test_run_skb+0x622/0xa20 [ 27.245553] ? bpf_test_finish.isra.7+0x1e0/0x1e0 [ 27.250377] ? bpf_prog_add+0x69/0xd0 [ 27.254162] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 27.259679] ? __bpf_prog_get+0x9b/0x290 [ 27.263719] ? bpf_test_finish.isra.7+0x1e0/0x1e0 [ 27.268551] ? bpf_prog_test_run+0x130/0x1a0 [ 27.272942] ? __x64_sys_bpf+0x3d8/0x510 [ 27.276988] ? bpf_prog_get+0x20/0x20 [ 27.280776] ? do_syscall_64+0x92/0x800 [ 27.284733] ? do_syscall_64+0x1b1/0x800 [ 27.288774] ? syscall_return_slowpath+0x5c0/0x5c0 [ 27.293685] ? syscall_return_slowpath+0x30f/0x5c0 [ 27.298595] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 27.303940] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.308766] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.314112] [ 27.315717] The buggy address belongs to the page: [ 27.320640] page:ffffea0006b41880 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 27.328761] flags: 0x2fffc0000000000() [ 27.332631] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 27.340493] raw: ffffea0006b41820 ffffea0006b671a0 0000000000000000 0000000000000000 [ 27.348356] page dumped because: kasan: bad access detected [ 27.354041] [ 27.355645] Memory state around the buggy address: [ 27.360550] ffff8801ad062e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.367887] ffff8801ad062e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.375224] >ffff8801ad062f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.382557] ^ [ 27.386422] ffff8801ad062f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.393758] ffff8801ad063000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.401096] ================================================================== [ 27.408435] Disabling lock debugging due to kernel taint [ 27.414132] Kernel panic - not syncing: panic_on_warn set ... [ 27.414132] [ 27.421497] CPU: 1 PID: 4488 Comm: syz-executor354 Tainted: G B 4.17.0-rc6+ #29 [ 27.430230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.439681] Call Trace: [ 27.442259] dump_stack+0x1b9/0x294 [ 27.445867] ? dump_stack_print_info.cold.2+0x52/0x52 [ 27.451050] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 27.455785] ? bpf_csum_update+0x60/0xc0 [ 27.459825] panic+0x22f/0x4de [ 27.462996] ? add_taint.cold.5+0x16/0x16 [ 27.467137] ? do_raw_spin_unlock+0x9e/0x2e0 [ 27.471524] ? do_raw_spin_unlock+0x9e/0x2e0 [ 27.475911] ? bpf_csum_update+0xb4/0xc0 [ 27.479963] kasan_end_report+0x47/0x4f [ 27.483918] kasan_report.cold.7+0x76/0x2fe [ 27.488216] __asan_report_load1_noabort+0x14/0x20 [ 27.493121] bpf_csum_update+0xb4/0xc0 [ 27.496993] ? lock_downgrade+0x8e0/0x8e0 [ 27.501132] ? rcu_pm_notify+0xc0/0xc0 [ 27.505001] ? pvclock_read_flags+0x160/0x160 [ 27.509481] ? rcu_read_lock_sched_held+0x108/0x120 [ 27.514488] ? kmem_cache_alloc+0x5fa/0x760 [ 27.518788] ? ktime_get+0x33e/0x430 [ 27.522493] ? lock_acquire+0x1dc/0x520 [ 27.526457] ? bpf_test_run+0x1f3/0x3b0 [ 27.530412] ? kasan_check_read+0x11/0x20 [ 27.534538] ? rcu_is_watching+0x85/0x140 [ 27.538663] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 27.543833] ? __might_sleep+0x95/0x190 [ 27.547787] ? bpf_test_run+0xaf/0x3b0 [ 27.551656] ? bpf_prog_test_run_skb+0x622/0xa20 [ 27.556389] ? bpf_test_finish.isra.7+0x1e0/0x1e0 [ 27.561218] ? bpf_prog_add+0x69/0xd0 [ 27.565014] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 27.570534] ? __bpf_prog_get+0x9b/0x290 [ 27.574574] ? bpf_test_finish.isra.7+0x1e0/0x1e0 [ 27.579394] ? bpf_prog_test_run+0x130/0x1a0 [ 27.583781] ? __x64_sys_bpf+0x3d8/0x510 [ 27.587820] ? bpf_prog_get+0x20/0x20 [ 27.591600] ? do_syscall_64+0x92/0x800 [ 27.595552] ? do_syscall_64+0x1b1/0x800 [ 27.599602] ? syscall_return_slowpath+0x5c0/0x5c0 [ 27.604509] ? syscall_return_slowpath+0x30f/0x5c0 [ 27.609418] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 27.614760] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.619581] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.625392] Dumping ftrace buffer: [ 27.628920] (ftrace buffer empty) [ 27.632614] Kernel Offset: disabled [ 27.636226] Rebooting in 86400 seconds..