[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   21.151023] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   24.706663] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available)
[   24.949903] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available)
[   25.906108] random: sshd: uninitialized urandom read (32 bytes read, 107 bits of entropy available)
[   35.271198] random: sshd: uninitialized urandom read (32 bytes read, 115 bits of entropy available)
Warning: Permanently added '10.128.0.62' (ECDSA) to the list of known hosts.
[   40.667612] random: sshd: uninitialized urandom read (32 bytes read, 119 bits of entropy available)
2018/03/14 18:36:46 parsed 1 programs
2018/03/14 18:36:46 executed programs: 0
[   41.032211] IPVS: Creating netns size=2552 id=1
[   41.055907] IPVS: Creating netns size=2552 id=2
[   41.079639] IPVS: Creating netns size=2552 id=3
[   41.115589] IPVS: Creating netns size=2552 id=4
[   41.175225] IPVS: Creating netns size=2552 id=5
[   41.210882] IPVS: Creating netns size=2552 id=6
[   41.256301] IPVS: Creating netns size=2552 id=7
[   41.295191] IPVS: Creating netns size=2552 id=8
[   41.973058] l2tp_core: tunl 3: fd 3 wrong protocol, got 1, expected 17
[   45.532554] l2tp_core: tunl 3: fd 3 wrong protocol, got 1, expected 17
2018/03/14 18:36:51 executed programs: 731
[   47.156173] ==================================================================
[   47.163577] BUG: KASAN: use-after-free in l2tp_session_create+0xf94/0x10f0
[   47.170571] Read of size 4 at addr ffff8801d2c10790 by task syz-executor0/6463
[   47.177909] 
[   47.179515] CPU: 1 PID: 6463 Comm: syz-executor0 Not tainted 4.4.120-gd63fdf6 #29
[   47.187103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   47.196433]  0000000000000000 9497418fb8cc092a ffff8801d2e0fa30 ffffffff81d0408d
[   47.204414]  ffffea00074b0400 ffff8801d2c10790 0000000000000000 ffff8801d2c10790
[   47.212389]  ffff8801d2c10780 ffff8801d2e0fa68 ffffffff814fe143 ffff8801d2c10790
[   47.220367] Call Trace:
[   47.222927]  [<ffffffff81d0408d>] dump_stack+0xc1/0x124
[   47.228263]  [<ffffffff814fe143>] print_address_description+0x73/0x260
[   47.234900]  [<ffffffff814fe655>] kasan_report+0x285/0x370
[   47.240497]  [<ffffffff8345fe14>] ? l2tp_session_create+0xf94/0x10f0
[   47.246958]  [<ffffffff814fe794>] __asan_report_load4_noabort+0x14/0x20
[   47.253679]  [<ffffffff8345fe14>] l2tp_session_create+0xf94/0x10f0
[   47.259970]  [<ffffffff8113bd95>] ? __local_bh_enable_ip+0xc5/0xd0
[   47.266260]  [<ffffffff8346354c>] pppol2tp_connect+0x10fc/0x1930
[   47.272377]  [<ffffffff83462450>] ? pppol2tp_recv+0x330/0x330
[   47.278235]  [<ffffffff81495684>] ? __might_fault+0xe4/0x1d0
[   47.284003]  [<ffffffff81515418>] ? check_stack_object+0x68/0x140
[   47.290208]  [<ffffffff81b46db9>] ? security_socket_connect+0x89/0xb0
[   47.296758]  [<ffffffff82dec596>] SYSC_connect+0x1b6/0x310
[   47.302355]  [<ffffffff82dec3e0>] ? SYSC_bind+0x280/0x280
[   47.307862]  [<ffffffff81579f50>] ? get_unused_fd_flags+0xd0/0xd0
[   47.314064]  [<ffffffff83772e2c>] ? _raw_spin_unlock+0x2c/0x50
[   47.320003]  [<ffffffff81579b63>] ? __alloc_fd+0x1e3/0x500
[   47.325597]  [<ffffffff812e26a0>] ? compat_SyS_get_robust_list+0x300/0x300
[   47.332578]  [<ffffffff82dee541>] ? SyS_socket+0x121/0x1b0
[   47.338174]  [<ffffffff82dee420>] ? move_addr_to_kernel+0x50/0x50
[   47.344377]  [<ffffffff82deee04>] SyS_connect+0x24/0x30
[   47.349711]  [<ffffffff82deede0>] ? SyS_accept+0x30/0x30
[   47.355135]  [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0
[   47.361254]  [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
[   47.367276] 
[   47.368877] Allocated by task 6463:
[   47.372470]  [<ffffffff81035d96>] save_stack_trace+0x26/0x50
[   47.378359]  [<ffffffff814fd1b3>] save_stack+0x43/0xd0
[   47.383751]  [<ffffffff814fd47d>] kasan_kmalloc+0xad/0xe0
[   47.389377]  [<ffffffff814f9764>] __kmalloc+0x124/0x320
[   47.394832]  [<ffffffff8345eeb9>] l2tp_session_create+0x39/0x10f0
[   47.401156]  [<ffffffff8346354c>] pppol2tp_connect+0x10fc/0x1930
[   47.407388]  [<ffffffff82dec596>] SYSC_connect+0x1b6/0x310
[   47.413106]  [<ffffffff82deee04>] SyS_connect+0x24/0x30
[   47.418559]  [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0
[   47.424792]  [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
[   47.430936] 
[   47.432534] Freed by task 6472:
[   47.435780]  [<ffffffff81035d96>] save_stack_trace+0x26/0x50
[   47.441750]  [<ffffffff814fd1b3>] save_stack+0x43/0xd0
[   47.447119]  [<ffffffff814fdad2>] kasan_slab_free+0x72/0xc0
[   47.452916]  [<ffffffff814fa56c>] kfree+0xfc/0x300
[   47.457930]  [<ffffffff8345b440>] l2tp_session_free+0x170/0x200
[   47.464079]  [<ffffffff8345dcf1>] l2tp_tunnel_closeall+0x2d1/0x3b0
[   47.470494]  [<ffffffff8345e85b>] l2tp_udp_encap_destroy+0x8b/0xf0
[   47.476901]  [<ffffffff8336cc51>] udpv6_destroy_sock+0xb1/0xd0
[   47.482962]  [<ffffffff82dfecdb>] sk_common_release+0x6b/0x300
[   47.489025]  [<ffffffff8336bc05>] udp_lib_close+0x15/0x20
[   47.494650]  [<ffffffff831cfdda>] inet_release+0xfa/0x1d0
[   47.500288]  [<ffffffff832f55a0>] inet6_release+0x50/0x70
[   47.505921]  [<ffffffff82de7bdd>] sock_release+0x8d/0x1e0
[   47.511546]  [<ffffffff82de7d46>] sock_close+0x16/0x20
[   47.516914]  [<ffffffff81523603>] __fput+0x233/0x6d0
[   47.522102]  [<ffffffff81523b25>] ____fput+0x15/0x20
[   47.527292]  [<ffffffff8118b984>] task_work_run+0x104/0x180
[   47.533093]  [<ffffffff8100361d>] exit_to_usermode_loop+0x13d/0x160
[   47.539590]  [<ffffffff81007084>] do_fast_syscall_32+0x614/0x8a0
[   47.545825]  [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
[   47.551974] 
[   47.553574] The buggy address belongs to the object at ffff8801d2c10780
[   47.553574]  which belongs to the cache kmalloc-512 of size 512
[   47.566201] The buggy address is located 16 bytes inside of
[   47.566201]  512-byte region [ffff8801d2c10780, ffff8801d2c10980)
[   47.577957] The buggy address belongs to the page:
[   47.587504] kasan: CONFIG_KASAN_INLINE enabled
[   47.591923] kasan: GPF could be caused by NULL-ptr deref or user memory access[   47.599390] ------------[ cut here ]------------
[   47.604139] WARNING: CPU: 0 PID: 0 at kernel/rcu/update.c:211 __rcu_read_unlock+0x140/0x1a0()
[   47.612784] Kernel panic - not syncing: panic_on_warn set ...
[   47.612784] 
[   47.620135] CPU: 0 PID: 0 Comm:  Not tainted 4.4.120-gd63fdf6 #29
[   47.626349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   47.635688]  0000000000000000 57dc64149ced132b ffff8801db207968 ffffffff81d0408d
[   47.643733]  ffffffff83843b40 ffff8801db207a40 ffffffff83865e00 0000000000000009
[   47.651762]  00000000000000d3 ffff8801db207a30 ffffffff8141ab2a 0000000041b58ab3
[   47.659799] Call Trace:
[   47.662370]  <IRQ>  [<ffffffff81d0408d>] dump_stack+0xc1/0x124
[   47.668478]  [<ffffffff8141ab2a>] panic+0x1aa/0x388
[   47.673495]  [<ffffffff8141a980>] ? percpu_up_read.constprop.45+0xe1/0xe1
[   47.680416]  [<ffffffff8141b6c6>] ? pm_qos_get_value.part.4+0xb/0xb
[   47.686824]  [<ffffffff8112d86a>] ? warn_slowpath_common+0x10a/0x140
[   47.693320]  [<ffffffff8112d885>] warn_slowpath_common+0x125/0x140
[   47.699635]  [<ffffffff812862d0>] ? __rcu_read_unlock+0x140/0x1a0
[   47.705864]  [<ffffffff8112dae9>] warn_slowpath_null+0x29/0x30
[   47.711838]  [<ffffffff812862d0>] __rcu_read_unlock+0x140/0x1a0
[   47.717893]  [<ffffffff8119566e>] atomic_notifier_call_chain+0x9e/0x140
[   47.724640]  [<ffffffff811955d0>] ? __atomic_notifier_call_chain+0x150/0x150
[   47.731830]  [<ffffffff811957ef>] notify_die+0xdf/0x160
[   47.737188]  [<ffffffff81195710>] ? atomic_notifier_call_chain+0x140/0x140
[   47.744199]  [<ffffffff8122b8e6>] ? cpuacct_account_field+0x136/0x300
[   47.750779]  [<ffffffff8118ba31>] ? search_exception_tables+0x31/0x40
[   47.757363]  [<ffffffff81011fa7>] do_general_protection+0x2f7/0x390
[   47.763766]  [<ffffffff83774d28>] general_protection+0x28/0x30
[   47.769740]  [<ffffffff8122b8e6>] ? cpuacct_account_field+0x136/0x300
[   47.776315]  [<ffffffff8122b7b0>] ? cpuacct_charge+0x390/0x390
[   47.782286]  [<ffffffff811d4982>] account_system_time+0x172/0x4d0
[   47.788514]  [<ffffffff811d56bf>] account_process_tick+0xef/0x310
[   47.794740]  [<ffffffff812ab0d3>] update_process_times+0x23/0x70
[   47.800888]  [<ffffffff812d5765>] tick_sched_handle.isra.16+0x55/0xf0
[   47.807468]  [<ffffffff812d7082>] tick_sched_timer+0x72/0x120
[   47.813347]  [<ffffffff812d7010>] ? tick_sched_do_timer+0xa0/0xa0
[   47.819576]  [<ffffffff812ad926>] __hrtimer_run_queues+0x306/0xfe0
[   47.825892]  [<ffffffff812ad620>] ? hrtimer_fixup_init+0x70/0x70
[   47.832039]  [<ffffffff812afd91>] ? hrtimer_interrupt+0x131/0x440
[   47.838266]  [<ffffffff812afe06>] hrtimer_interrupt+0x1a6/0x440
[   47.844323]  [<ffffffff810b0dea>] local_apic_timer_interrupt+0x6a/0xb0
[   47.850987]  [<ffffffff837765b6>] smp_apic_timer_interrupt+0x76/0xa0
[   47.857477]  [<ffffffff83775510>] apic_timer_interrupt+0xa0/0xb0
[   47.863607]  <EOI> 
[   48.976248] Shutting down cpus with NMI
[   48.981039] Dumping ftrace buffer:
[   48.984558]    (ftrace buffer empty)
[   48.988237] Kernel Offset: disabled
[   48.991830] ------------[ cut here ]------------
[   48.996561] WARNING: CPU: 0 PID: 0 at kernel/rcu/update.c:211 __rcu_read_unlock+0x140/0x1a0()
[   49.005187] Modules linked in:
[   49.008478] CPU: 0 PID: 0 Comm:  Not tainted 4.4.120-gd63fdf6 #29
[   49.014672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   49.024309]  0000000000000000 57dc64149ced132b ffff8801db2078b8 ffffffff81d0408d
[   49.032274]  0000000000000000 ffff8801d2c51800 ffffffff83865e00 0000000000000009
[   49.040234]  00000000000000d3 ffff8801db2078f8 ffffffff8112d839 ffffffff812862d0
[   49.048247] Call Trace:
[   49.050798]  <IRQ>  [<ffffffff81d0408d>] dump_stack+0xc1/0x124
[   49.056867]  [<ffffffff8112d839>] warn_slowpath_common+0xd9/0x140
[   49.063065]  [<ffffffff812862d0>] ? __rcu_read_unlock+0x140/0x1a0
[   49.069263]  [<ffffffff8112dae9>] warn_slowpath_null+0x29/0x30
[   49.075202]  [<ffffffff812862d0>] __rcu_read_unlock+0x140/0x1a0
[   49.081227]  [<ffffffff8119566e>] atomic_notifier_call_chain+0x9e/0x140
[   49.087944]  [<ffffffff811955d0>] ? __atomic_notifier_call_chain+0x150/0x150
[   49.095097]  [<ffffffff8141ab89>] panic+0x209/0x388
[   49.100080]  [<ffffffff8141a980>] ? percpu_up_read.constprop.45+0xe1/0xe1
[   49.106986]  [<ffffffff8141b6c6>] ? pm_qos_get_value.part.4+0xb/0xb
[   49.113364]  [<ffffffff8112d86a>] ? warn_slowpath_common+0x10a/0x140
[   49.119824]  [<ffffffff8112d885>] warn_slowpath_common+0x125/0x140
[   49.126108]  [<ffffffff812862d0>] ? __rcu_read_unlock+0x140/0x1a0
[   49.132308]  [<ffffffff8112dae9>] warn_slowpath_null+0x29/0x30
[   49.138248]  [<ffffffff812862d0>] __rcu_read_unlock+0x140/0x1a0
[   49.144273]  [<ffffffff8119566e>] atomic_notifier_call_chain+0x9e/0x140
[   49.150994]  [<ffffffff811955d0>] ? __atomic_notifier_call_chain+0x150/0x150
[   49.158149]  [<ffffffff811957ef>] notify_die+0xdf/0x160
[   49.163478]  [<ffffffff81195710>] ? atomic_notifier_call_chain+0x140/0x140
[   49.170459]  [<ffffffff8122b8e6>] ? cpuacct_account_field+0x136/0x300
[   49.177007]  [<ffffffff8118ba31>] ? search_exception_tables+0x31/0x40
[   49.183555]  [<ffffffff81011fa7>] do_general_protection+0x2f7/0x390
[   49.189928]  [<ffffffff83774d28>] general_protection+0x28/0x30
[   49.195866]  [<ffffffff8122b8e6>] ? cpuacct_account_field+0x136/0x300
[   49.202411]  [<ffffffff8122b7b0>] ? cpuacct_charge+0x390/0x390
[   49.208352]  [<ffffffff811d4982>] account_system_time+0x172/0x4d0
[   49.214552]  [<ffffffff811d56bf>] account_process_tick+0xef/0x310
[   49.220753]  [<ffffffff812ab0d3>] update_process_times+0x23/0x70
[   49.226876]  [<ffffffff812d5765>] tick_sched_handle.isra.16+0x55/0xf0
[   49.233423]  [<ffffffff812d7082>] tick_sched_timer+0x72/0x120
[   49.239273]  [<ffffffff812d7010>] ? tick_sched_do_timer+0xa0/0xa0
[   49.245476]  [<ffffffff812ad926>] __hrtimer_run_queues+0x306/0xfe0
[   49.251760]  [<ffffffff812ad620>] ? hrtimer_fixup_init+0x70/0x70
[   49.257875]  [<ffffffff812afd91>] ? hrtimer_interrupt+0x131/0x440
[   49.264168]  [<ffffffff812afe06>] hrtimer_interrupt+0x1a6/0x440
[   49.270196]  [<ffffffff810b0dea>] local_apic_timer_interrupt+0x6a/0xb0
[   49.276832]  [<ffffffff837765b6>] smp_apic_timer_interrupt+0x76/0xa0
[   49.283291]  [<ffffffff83775510>] apic_timer_interrupt+0xa0/0xb0
[   49.289398]  <EOI> 
[   49.291429] ---[ end trace a814b9c4f29aef22 ]---
[   49.296448] Rebooting in 86400 seconds..