[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.369705] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 20.527740] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.948177] random: sshd: uninitialized urandom read (32 bytes read) [ 21.735677] random: sshd: uninitialized urandom read (32 bytes read) [ 21.896256] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.61' (ECDSA) to the list of known hosts. [ 27.338866] random: sshd: uninitialized urandom read (32 bytes read) net.ipv6.conf.syz_tun.accept_dad = 0 [ 27.431508] IPVS: ftp: loaded support on port[0] = 21 net.ipv6.conf.syz_tun.router_solicitations = 0 executing program [ 27.556513] ================================================================== [ 27.564072] BUG: KASAN: use-after-free in irq_bypass_unregister_consumer+0x3cd/0x4a0 [ 27.571940] Read of size 8 at addr ffff8801adf2a168 by task kworker/0:1/24 [ 27.578929] [ 27.580719] CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.17.0-rc5+ #59 [ 27.587535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.596880] Workqueue: kvm-irqfd-cleanup irqfd_shutdown [ 27.602226] Call Trace: [ 27.604801] dump_stack+0x1b9/0x294 [ 27.608414] ? dump_stack_print_info.cold.2+0x52/0x52 [ 27.613586] ? printk+0x9e/0xba [ 27.616857] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 27.621606] ? kasan_check_write+0x14/0x20 [ 27.625843] print_address_description+0x6c/0x20b [ 27.630700] ? irq_bypass_unregister_consumer+0x3cd/0x4a0 [ 27.636223] kasan_report.cold.7+0x242/0x2fe [ 27.640626] __asan_report_load8_noabort+0x14/0x20 [ 27.645564] irq_bypass_unregister_consumer+0x3cd/0x4a0 [ 27.650912] ? irq_bypass_register_producer+0x490/0x490 [ 27.656259] ? process_one_work+0xb46/0x1b50 [ 27.660659] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 27.665760] irqfd_shutdown+0x112/0x1a0 [ 27.669720] ? __lock_is_held+0xb5/0x140 [ 27.673770] ? irqfd_resampler_shutdown+0x6e0/0x6e0 [ 27.678780] process_one_work+0xc1e/0x1b50 [ 27.683005] ? finish_task_switch+0x28b/0x840 [ 27.687515] ? pwq_dec_nr_in_flight+0x490/0x490 [ 27.692190] ? __schedule+0x809/0x1e30 [ 27.696084] ? pick_next_task_fair+0x97c/0x1780 [ 27.700758] ? graph_lock+0x170/0x170 [ 27.704559] ? graph_lock+0x170/0x170 [ 27.708347] ? find_held_lock+0x36/0x1c0 [ 27.712399] ? find_held_lock+0x36/0x1c0 [ 27.716449] ? lock_acquire+0x1dc/0x520 [ 27.720411] ? worker_thread+0x41f/0x1440 [ 27.724544] ? lock_downgrade+0x8e0/0x8e0 [ 27.729126] ? lock_release+0xa10/0xa10 [ 27.733086] ? kasan_check_read+0x11/0x20 [ 27.737226] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 27.741801] worker_thread+0x1cc/0x1440 [ 27.745768] ? process_one_work+0x1b50/0x1b50 [ 27.750251] ? graph_lock+0x170/0x170 [ 27.754035] ? find_held_lock+0x36/0x1c0 [ 27.758087] ? find_held_lock+0x36/0x1c0 [ 27.762142] ? __schedule+0x1e30/0x1e30 [ 27.766102] ? do_raw_spin_unlock+0x9e/0x2e0 [ 27.770502] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 27.775070] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 27.780592] ? __kthread_parkme+0x111/0x1d0 [ 27.784900] ? parse_args.cold.15+0x1b3/0x1b3 [ 27.789379] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.794393] ? trace_hardirqs_on+0xd/0x10 [ 27.798528] kthread+0x345/0x410 [ 27.801880] ? process_one_work+0x1b50/0x1b50 [ 27.806358] ? kthread_bind+0x40/0x40 [ 27.810144] ret_from_fork+0x3a/0x50 [ 27.813844] [ 27.815454] Allocated by task 4534: [ 27.819067] save_stack+0x43/0xd0 [ 27.822502] kasan_kmalloc+0xc4/0xe0 [ 27.826205] kmem_cache_alloc_trace+0x152/0x780 [ 27.830854] kvm_irqfd+0x187/0x1ec0 [ 27.834471] kvm_vm_ioctl+0xf84/0x1d90 [ 27.838346] do_vfs_ioctl+0x1cf/0x16a0 [ 27.842228] ksys_ioctl+0xa9/0xd0 [ 27.845664] __x64_sys_ioctl+0x73/0xb0 [ 27.849534] do_syscall_64+0x1b1/0x800 [ 27.853409] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 27.858572] [ 27.860178] Freed by task 24: [ 27.863264] save_stack+0x43/0xd0 [ 27.866698] __kasan_slab_free+0x11a/0x170 [ 27.870915] kasan_slab_free+0xe/0x10 [ 27.874696] kfree+0xd9/0x260 [ 27.877792] irqfd_shutdown+0x13a/0x1a0 [ 27.881750] process_one_work+0xc1e/0x1b50 [ 27.885969] worker_thread+0x1cc/0x1440 [ 27.889926] kthread+0x345/0x410 [ 27.893271] ret_from_fork+0x3a/0x50 [ 27.896958] [ 27.898568] The buggy address belongs to the object at ffff8801adf2a000 [ 27.898568] which belongs to the cache kmalloc-512 of size 512 [ 27.911207] The buggy address is located 360 bytes inside of [ 27.911207] 512-byte region [ffff8801adf2a000, ffff8801adf2a200) [ 27.923061] The buggy address belongs to the page: [ 27.927973] page:ffffea0006b7ca80 count:1 mapcount:0 mapping:ffff8801adf2a000 index:0x0 [ 27.936100] flags: 0x2fffc0000000100(slab) [ 27.940321] raw: 02fffc0000000100 ffff8801adf2a000 0000000000000000 0000000100000006 [ 27.948186] raw: ffffea0007647a20 ffffea0006b45ba0 ffff8801da800940 0000000000000000 [ 27.956051] page dumped because: kasan: bad access detected [ 27.961734] [ 27.963338] Memory state around the buggy address: [ 27.968252] ffff8801adf2a000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.975594] ffff8801adf2a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.982935] >ffff8801adf2a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.990282] ^ [ 27.997029] ffff8801adf2a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.004372] ffff8801adf2a200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.011721] ================================================================== [ 28.019065] Disabling lock debugging due to kernel taint [ 28.024597] Kernel panic - not syncing: panic_on_warn set ... [ 28.024597] [ 28.031981] CPU: 0 PID: 24 Comm: kworker/0:1 Tainted: G B 4.17.0-rc5+ #59 [ 28.040189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.049635] Workqueue: kvm-irqfd-cleanup irqfd_shutdown [ 28.054976] Call Trace: [ 28.057562] dump_stack+0x1b9/0x294 [ 28.061182] ? dump_stack_print_info.cold.2+0x52/0x52 [ 28.066357] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 28.071094] ? irq_bypass_unregister_consumer+0x2d0/0x4a0 [ 28.076608] panic+0x22f/0x4de [ 28.079784] ? add_taint.cold.5+0x16/0x16 [ 28.083912] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.088300] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.092685] ? irq_bypass_unregister_consumer+0x3cd/0x4a0 [ 28.098201] kasan_end_report+0x47/0x4f [ 28.102153] kasan_report.cold.7+0x76/0x2fe [ 28.106455] __asan_report_load8_noabort+0x14/0x20 [ 28.111361] irq_bypass_unregister_consumer+0x3cd/0x4a0 [ 28.116704] ? irq_bypass_register_producer+0x490/0x490 [ 28.122059] ? process_one_work+0xb46/0x1b50 [ 28.126467] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 28.131579] irqfd_shutdown+0x112/0x1a0 [ 28.135561] ? __lock_is_held+0xb5/0x140 [ 28.139619] ? irqfd_resampler_shutdown+0x6e0/0x6e0 [ 28.144622] process_one_work+0xc1e/0x1b50 [ 28.148855] ? finish_task_switch+0x28b/0x840 [ 28.153339] ? pwq_dec_nr_in_flight+0x490/0x490 [ 28.157987] ? __schedule+0x809/0x1e30 [ 28.161854] ? pick_next_task_fair+0x97c/0x1780 [ 28.166507] ? graph_lock+0x170/0x170 [ 28.170281] ? graph_lock+0x170/0x170 [ 28.174058] ? find_held_lock+0x36/0x1c0 [ 28.178101] ? find_held_lock+0x36/0x1c0 [ 28.182155] ? lock_acquire+0x1dc/0x520 [ 28.186113] ? worker_thread+0x41f/0x1440 [ 28.190238] ? lock_downgrade+0x8e0/0x8e0 [ 28.194360] ? lock_release+0xa10/0xa10 [ 28.198311] ? kasan_check_read+0x11/0x20 [ 28.202435] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 28.206995] worker_thread+0x1cc/0x1440 [ 28.210953] ? process_one_work+0x1b50/0x1b50 [ 28.215425] ? graph_lock+0x170/0x170 [ 28.219200] ? find_held_lock+0x36/0x1c0 [ 28.223240] ? find_held_lock+0x36/0x1c0 [ 28.227281] ? __schedule+0x1e30/0x1e30 [ 28.231232] ? do_raw_spin_unlock+0x9e/0x2e0 [ 28.235621] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 28.240189] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 28.245701] ? __kthread_parkme+0x111/0x1d0 [ 28.249999] ? parse_args.cold.15+0x1b3/0x1b3 [ 28.254495] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 28.259492] ? trace_hardirqs_on+0xd/0x10 [ 28.263620] kthread+0x345/0x410 [ 28.266974] ? process_one_work+0x1b50/0x1b50 [ 28.271446] ? kthread_bind+0x40/0x40 [ 28.275239] ret_from_fork+0x3a/0x50 [ 28.279342] Dumping ftrace buffer: [ 28.282869] (ftrace buffer empty) [ 28.286558] Kernel Offset: disabled [ 28.290161] Rebooting in 86400 seconds..