[   32.614387] audit: type=1800 audit(1568987178.324:33): pid=6831 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0
[   32.641303] audit: type=1800 audit(1568987178.324:34): pid=6831 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   38.289052] random: sshd: uninitialized urandom read (32 bytes read)
[   38.609791] audit: type=1400 audit(1568987184.314:35): avc:  denied  { map } for  pid=7004 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
[   38.661982] random: sshd: uninitialized urandom read (32 bytes read)
[   39.219334] random: sshd: uninitialized urandom read (32 bytes read)
[   43.785354] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.15.202' (ECDSA) to the list of known hosts.
[   49.259552] random: sshd: uninitialized urandom read (32 bytes read)
executing program
[   49.374493] audit: type=1400 audit(1568987195.084:36): avc:  denied  { map } for  pid=7016 comm="syz-executor388" path="/root/syz-executor388190986" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   49.404031] ==================================================================
[   49.411483] BUG: KASAN: use-after-free in tcp_init_tso_segs+0x1ae/0x200
[   49.418446] Read of size 2 at addr ffff88808831aab0 by task syz-executor388/7016
[   49.425965] 
[   49.427587] CPU: 1 PID: 7016 Comm: syz-executor388 Not tainted 4.14.145 #0
[   49.434679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   49.444245] Call Trace:
[   49.446828]  dump_stack+0x138/0x197
[   49.450466]  ? tcp_init_tso_segs+0x1ae/0x200
[   49.454857]  print_address_description.cold+0x7c/0x1dc
[   49.460116]  ? tcp_init_tso_segs+0x1ae/0x200
[   49.464685]  kasan_report.cold+0xa9/0x2af
[   49.468815]  __asan_report_load2_noabort+0x14/0x20
[   49.473725]  tcp_init_tso_segs+0x1ae/0x200
[   49.478027]  ? tcp_tso_segs+0x7d/0x1c0
[   49.481897]  tcp_write_xmit+0x15e/0x4960
[   49.485939]  ? tcp_v6_md5_lookup+0x23/0x30
[   49.490158]  ? tcp_established_options+0x2c5/0x420
[   49.495075]  ? tcp_current_mss+0x1dc/0x2f0
[   49.499298]  ? __alloc_skb+0x3ee/0x500
[   49.503214]  __tcp_push_pending_frames+0xa6/0x260
[   49.508060]  tcp_send_fin+0x17e/0xc40
[   49.511866]  tcp_close+0xcc8/0xfb0
[   49.515390]  ? lock_acquire+0x16f/0x430
[   49.519349]  ? ip_mc_drop_socket+0x1d6/0x230
[   49.523762]  inet_release+0xec/0x1c0
[   49.527549]  inet6_release+0x53/0x80
[   49.531248]  __sock_release+0xce/0x2b0
[   49.535114]  ? __sock_release+0x2b0/0x2b0
[   49.539240]  sock_close+0x1b/0x30
[   49.542700]  __fput+0x275/0x7a0
[   49.545963]  ____fput+0x16/0x20
[   49.549335]  task_work_run+0x114/0x190
[   49.553211]  do_exit+0x7df/0x2c10
[   49.556846]  ? mm_update_next_owner+0x5d0/0x5d0
[   49.561508]  ? fd_install+0x4d/0x60
[   49.565155]  ? sock_map_fd+0x56/0x80
[   49.568859]  ? SyS_socket+0x103/0x170
[   49.572644]  do_group_exit+0x111/0x330
[   49.576604]  SyS_exit_group+0x1d/0x20
[   49.580391]  ? do_group_exit+0x330/0x330
[   49.584456]  do_syscall_64+0x1e8/0x640
[   49.588419]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   49.593365]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   49.598542] RIP: 0033:0x43ee88
[   49.601724] RSP: 002b:00007ffceff9cfd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   49.609473] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ee88
[   49.616920] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   49.624173] RBP: 00000000004be688 R08: 00000000000000e7 R09: ffffffffffffffd0
[   49.631516] R10: 0000000020000004 R11: 0000000000000246 R12: 0000000000000001
[   49.639199] R13: 00000000006d0180 R14: 0000000000000000 R15: 0000000000000000
[   49.646461] 
[   49.648070] Allocated by task 7016:
[   49.651684]  save_stack_trace+0x16/0x20
[   49.655644]  save_stack+0x45/0xd0
[   49.659093]  kasan_kmalloc+0xce/0xf0
[   49.662786]  kasan_slab_alloc+0xf/0x20
[   49.666651]  kmem_cache_alloc_node+0x144/0x780
[   49.671382]  __alloc_skb+0x9c/0x500
[   49.675012]  sk_stream_alloc_skb+0xb3/0x780
[   49.679405]  tcp_sendmsg_locked+0xf61/0x3200
[   49.683804]  tcp_sendmsg+0x30/0x50
[   49.687321]  inet_sendmsg+0x122/0x500
[   49.691214]  sock_sendmsg+0xce/0x110
[   49.694926]  SYSC_sendto+0x206/0x310
[   49.698688]  SyS_sendto+0x40/0x50
[   49.702121]  do_syscall_64+0x1e8/0x640
[   49.706949]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   49.712126] 
[   49.713736] Freed by task 7016:
[   49.717103]  save_stack_trace+0x16/0x20
[   49.721064]  save_stack+0x45/0xd0
[   49.724652]  kasan_slab_free+0x75/0xc0
[   49.728541]  kmem_cache_free+0x83/0x2b0
[   49.732500]  kfree_skbmem+0x8d/0x120
[   49.736196]  __kfree_skb+0x1e/0x30
[   49.739809]  tcp_remove_empty_skb.part.0+0x231/0x2e0
[   49.744892]  tcp_sendmsg_locked+0x1ced/0x3200
[   49.749454]  tcp_sendmsg+0x30/0x50
[   49.752974]  inet_sendmsg+0x122/0x500
[   49.756748]  sock_sendmsg+0xce/0x110
[   49.760446]  SYSC_sendto+0x206/0x310
[   49.764137]  SyS_sendto+0x40/0x50
[   49.767571]  do_syscall_64+0x1e8/0x640
[   49.771447]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   49.776612] 
[   49.778218] The buggy address belongs to the object at ffff88808831aa80
[   49.778218]  which belongs to the cache skbuff_fclone_cache of size 472
[   49.791552] The buggy address is located 48 bytes inside of
[   49.791552]  472-byte region [ffff88808831aa80, ffff88808831ac58)
[   49.803515] The buggy address belongs to the page:
[   49.808435] page:ffffea000220c680 count:1 mapcount:0 mapping:ffff88808831a080 index:0x0
[   49.816681] flags: 0x1fffc0000000100(slab)
[   49.820896] raw: 01fffc0000000100 ffff88808831a080 0000000000000000 0000000100000006
[   49.828758] raw: ffffea000214ca20 ffff8880a9e1ce48 ffff88821b75f3c0 0000000000000000
[   49.836611] page dumped because: kasan: bad access detected
[   49.842308] 
[   49.843911] Memory state around the buggy address:
[   49.848922]  ffff88808831a980: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
[   49.856373]  ffff88808831aa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   49.863733] >ffff88808831aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.871178]                                      ^
[   49.876081]  ffff88808831ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.883440]  ffff88808831ab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.890904] ==================================================================
[   49.898421] Disabling lock debugging due to kernel taint
[   49.904286] Kernel panic - not syncing: panic_on_warn set ...
[   49.904286] 
[   49.911778] CPU: 0 PID: 7016 Comm: syz-executor388 Tainted: G    B           4.14.145 #0
[   49.920003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   49.929553] Call Trace:
[   49.932128]  dump_stack+0x138/0x197
[   49.935901]  ? tcp_init_tso_segs+0x1ae/0x200
[   49.940304]  panic+0x1f2/0x426
[   49.943482]  ? add_taint.cold+0x16/0x16
[   49.947453]  ? ___preempt_schedule+0x16/0x18
[   49.951851]  kasan_end_report+0x47/0x4f
[   49.955803]  kasan_report.cold+0x130/0x2af
[   49.960156]  __asan_report_load2_noabort+0x14/0x20
[   49.965109]  tcp_init_tso_segs+0x1ae/0x200
[   49.969422]  ? tcp_tso_segs+0x7d/0x1c0
[   49.973397]  tcp_write_xmit+0x15e/0x4960
[   49.977560]  ? tcp_v6_md5_lookup+0x23/0x30
[   49.981789]  ? tcp_established_options+0x2c5/0x420
[   49.986810]  ? tcp_current_mss+0x1dc/0x2f0
[   49.991033]  ? __alloc_skb+0x3ee/0x500
[   49.994911]  __tcp_push_pending_frames+0xa6/0x260
[   49.999958]  tcp_send_fin+0x17e/0xc40
[   50.003919]  tcp_close+0xcc8/0xfb0
[   50.007442]  ? lock_acquire+0x16f/0x430
[   50.011489]  ? ip_mc_drop_socket+0x1d6/0x230
[   50.015878]  inet_release+0xec/0x1c0
[   50.019576]  inet6_release+0x53/0x80
[   50.023275]  __sock_release+0xce/0x2b0
[   50.027142]  ? __sock_release+0x2b0/0x2b0
[   50.031283]  sock_close+0x1b/0x30
[   50.034819]  __fput+0x275/0x7a0
[   50.038095]  ____fput+0x16/0x20
[   50.041354]  task_work_run+0x114/0x190
[   50.045235]  do_exit+0x7df/0x2c10
[   50.048772]  ? mm_update_next_owner+0x5d0/0x5d0
[   50.053420]  ? fd_install+0x4d/0x60
[   50.057030]  ? sock_map_fd+0x56/0x80
[   50.060732]  ? SyS_socket+0x103/0x170
[   50.064692]  do_group_exit+0x111/0x330
[   50.068565]  SyS_exit_group+0x1d/0x20
[   50.072347]  ? do_group_exit+0x330/0x330
[   50.076568]  do_syscall_64+0x1e8/0x640
[   50.080522]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   50.085352]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   50.090532] RIP: 0033:0x43ee88
[   50.093717] RSP: 002b:00007ffceff9cfd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   50.101404] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ee88
[   50.108655] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   50.117475] RBP: 00000000004be688 R08: 00000000000000e7 R09: ffffffffffffffd0
[   50.124733] R10: 0000000020000004 R11: 0000000000000246 R12: 0000000000000001
[   50.132163] R13: 00000000006d0180 R14: 0000000000000000 R15: 0000000000000000
[   50.142016] Kernel Offset: disabled
[   50.145662] Rebooting in 86400 seconds..