[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   19.586299] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   23.753540] random: sshd: uninitialized urandom read (32 bytes read)
[   24.304438] random: sshd: uninitialized urandom read (32 bytes read)
[   25.185801] random: sshd: uninitialized urandom read (32 bytes read)
[   84.260687] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.10.4' (ECDSA) to the list of known hosts.
[   89.771955] random: sshd: uninitialized urandom read (32 bytes read)
executing program
executing program
executing program
[   89.973337] ==================================================================
[   89.980802] BUG: KASAN: use-after-free in p9_poll_workfn+0x660/0x6d0
[   89.987292] Read of size 4 at addr ffff8801d893c644 by task kworker/0:2/26
[   89.994294] 
[   89.995921] CPU: 0 PID: 26 Comm: kworker/0:2 Not tainted 4.18.0-rc4+ #141
[   90.002838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   90.012183] Workqueue: events p9_poll_workfn
[   90.016763] Call Trace:
[   90.019348]  dump_stack+0x1c9/0x2b4
[   90.022960]  ? dump_stack_print_info.cold.2+0x52/0x52
[   90.028147]  ? printk+0xa7/0xcf
[   90.031411]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   90.036153]  ? p9_poll_workfn+0x660/0x6d0
[   90.040284]  print_address_description+0x6c/0x20b
[   90.045107]  ? p9_poll_workfn+0x660/0x6d0
[   90.049237]  kasan_report.cold.7+0x242/0x2fe
[   90.053639]  __asan_report_load4_noabort+0x14/0x20
[   90.058552]  p9_poll_workfn+0x660/0x6d0
[   90.062530]  ? p9_read_work+0x1060/0x1060
[   90.066687]  ? graph_lock+0x170/0x170
[   90.070483]  ? lock_acquire+0x1e4/0x540
[   90.074439]  ? process_one_work+0xb9b/0x1ba0
[   90.078833]  ? kasan_check_read+0x11/0x20
[   90.082967]  ? __lock_is_held+0xb5/0x140
[   90.087016]  process_one_work+0xc73/0x1ba0
[   90.091258]  ? trace_hardirqs_on+0x10/0x10
[   90.095494]  ? pwq_dec_nr_in_flight+0x4a0/0x4a0
[   90.100146]  ? lock_repin_lock+0x430/0x430
[   90.104374]  ? __sched_text_start+0x8/0x8
[   90.108503]  ? lock_downgrade+0x8f0/0x8f0
[   90.112645]  ? graph_lock+0x170/0x170
[   90.116427]  ? graph_lock+0x170/0x170
[   90.120226]  ? lock_acquire+0x1e4/0x540
[   90.124181]  ? worker_thread+0x3dc/0x13c0
[   90.128312]  ? lock_downgrade+0x8f0/0x8f0
[   90.132446]  ? lock_release+0xa30/0xa30
[   90.136405]  ? kasan_check_read+0x11/0x20
[   90.140546]  ? do_raw_spin_unlock+0xa7/0x2f0
[   90.144945]  ? do_raw_spin_trylock+0x1c0/0x1c0
[   90.149513]  ? kasan_check_write+0x14/0x20
[   90.153733]  ? do_raw_spin_lock+0xc1/0x200
[   90.157963]  worker_thread+0x189/0x13c0
[   90.161938]  ? process_one_work+0x1ba0/0x1ba0
[   90.166443]  ? graph_lock+0x170/0x170
[   90.170233]  ? graph_lock+0x170/0x170
[   90.174015]  ? find_held_lock+0x36/0x1c0
[   90.178066]  ? find_held_lock+0x36/0x1c0
[   90.182123]  ? kasan_check_read+0x11/0x20
[   90.186256]  ? do_raw_spin_unlock+0xa7/0x2f0
[   90.190657]  ? _raw_spin_unlock_irqrestore+0x74/0xc0
[   90.195742]  ? __kthread_parkme+0x58/0x1b0
[   90.199960]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   90.204965]  ? trace_hardirqs_on+0xd/0x10
[   90.209112]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   90.214631]  ? __kthread_parkme+0x106/0x1b0
[   90.218939]  kthread+0x345/0x410
[   90.222300]  ? process_one_work+0x1ba0/0x1ba0
[   90.226777]  ? kthread_bind+0x40/0x40
[   90.230578]  ret_from_fork+0x3a/0x50
[   90.234274] 
[   90.235884] Allocated by task 4536:
[   90.239495]  save_stack+0x43/0xd0
[   90.242929]  kasan_kmalloc+0xc4/0xe0
[   90.246625]  kmem_cache_alloc_trace+0x152/0x780
[   90.251277]  p9_fd_create+0x1a7/0x3f0
[   90.255060]  p9_client_create+0x915/0x16c9
[   90.259276]  v9fs_session_init+0x21a/0x1a80
[   90.263575]  v9fs_mount+0x7c/0x900
[   90.267113]  mount_fs+0xae/0x328
[   90.270461]  vfs_kern_mount.part.34+0xdc/0x4e0
[   90.275025]  do_mount+0x581/0x30e0
[   90.278545]  ksys_mount+0x12d/0x140
[   90.282151]  __x64_sys_mount+0xbe/0x150
[   90.286108]  do_syscall_64+0x1b9/0x820
[   90.289998]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   90.295166] 
[   90.296773] Freed by task 4536:
[   90.300051]  save_stack+0x43/0xd0
[   90.303487]  __kasan_slab_free+0x11a/0x170
[   90.307701]  kasan_slab_free+0xe/0x10
[   90.311492]  kfree+0xd9/0x260
[   90.314590]  p9_fd_close+0x416/0x5b0
[   90.318285]  p9_client_create+0xac2/0x16c9
[   90.322510]  v9fs_session_init+0x21a/0x1a80
[   90.326814]  v9fs_mount+0x7c/0x900
[   90.330337]  mount_fs+0xae/0x328
[   90.333688]  vfs_kern_mount.part.34+0xdc/0x4e0
[   90.338247]  do_mount+0x581/0x30e0
[   90.341769]  ksys_mount+0x12d/0x140
[   90.345376]  __x64_sys_mount+0xbe/0x150
[   90.349333]  do_syscall_64+0x1b9/0x820
[   90.353205]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   90.358370] 
[   90.359981] The buggy address belongs to the object at ffff8801d893c5c0
[   90.359981]  which belongs to the cache kmalloc-512 of size 512
[   90.372619] The buggy address is located 132 bytes inside of
[   90.372619]  512-byte region [ffff8801d893c5c0, ffff8801d893c7c0)
[   90.384484] The buggy address belongs to the page:
[   90.389396] page:ffffea0007624f00 count:1 mapcount:0 mapping:ffff8801da800940 index:0x0
[   90.397535] flags: 0x2fffc0000000100(slab)
[   90.401757] raw: 02fffc0000000100 ffffea000765ab48 ffff8801da801748 ffff8801da800940
[   90.409622] raw: 0000000000000000 ffff8801d893c0c0 0000000100000006 0000000000000000
[   90.417483] page dumped because: kasan: bad access detected
[   90.423185] 
[   90.424790] Memory state around the buggy address:
[   90.429702]  ffff8801d893c500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   90.437042]  ffff8801d893c580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   90.444388] >ffff8801d893c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   90.451735]                                            ^
[   90.457180]  ffff8801d893c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   90.464522]  ffff8801d893c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
executing program
[   90.471884] ==================================================================
[   90.479219] Disabling lock debugging due to kernel taint
[   90.484765] Kernel panic - not syncing: panic_on_warn set ...
[   90.484765] 
[   90.492118] CPU: 0 PID: 26 Comm: kworker/0:2 Tainted: G    B             4.18.0-rc4+ #141
[   90.500500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   90.509859] Workqueue: events p9_poll_workfn
[   90.514251] Call Trace:
[   90.516844]  dump_stack+0x1c9/0x2b4
[   90.520464]  ? dump_stack_print_info.cold.2+0x52/0x52
[   90.525636]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   90.530371]  panic+0x238/0x4e7
[   90.533572]  ? add_taint.cold.5+0x16/0x16
[   90.537719]  ? do_raw_spin_unlock+0xa7/0x2f0
[   90.542105]  ? do_raw_spin_unlock+0xa7/0x2f0
[   90.546495]  ? p9_poll_workfn+0x660/0x6d0
[   90.550624]  kasan_end_report+0x47/0x4f
[   90.554583]  kasan_report.cold.7+0x76/0x2fe
[   90.558886]  __asan_report_load4_noabort+0x14/0x20
[   90.563795]  p9_poll_workfn+0x660/0x6d0
[   90.567749]  ? p9_read_work+0x1060/0x1060
[   90.571878]  ? graph_lock+0x170/0x170
[   90.575660]  ? lock_acquire+0x1e4/0x540
[   90.579613]  ? process_one_work+0xb9b/0x1ba0
[   90.584003]  ? kasan_check_read+0x11/0x20
[   90.588151]  ? __lock_is_held+0xb5/0x140
[   90.592201]  process_one_work+0xc73/0x1ba0
[   90.596422]  ? trace_hardirqs_on+0x10/0x10
[   90.600640]  ? pwq_dec_nr_in_flight+0x4a0/0x4a0
[   90.605325]  ? lock_repin_lock+0x430/0x430
[   90.609566]  ? __sched_text_start+0x8/0x8
[   90.613715]  ? lock_downgrade+0x8f0/0x8f0
[   90.617856]  ? graph_lock+0x170/0x170
[   90.621640]  ? graph_lock+0x170/0x170
[   90.625431]  ? lock_acquire+0x1e4/0x540
[   90.629385]  ? worker_thread+0x3dc/0x13c0
[   90.633517]  ? lock_downgrade+0x8f0/0x8f0
[   90.637652]  ? lock_release+0xa30/0xa30
[   90.641611]  ? kasan_check_read+0x11/0x20
[   90.645738]  ? do_raw_spin_unlock+0xa7/0x2f0
[   90.650127]  ? do_raw_spin_trylock+0x1c0/0x1c0
[   90.654688]  ? kasan_check_write+0x14/0x20
[   90.658905]  ? do_raw_spin_lock+0xc1/0x200
[   90.663125]  worker_thread+0x189/0x13c0
[   90.667083]  ? process_one_work+0x1ba0/0x1ba0
[   90.671562]  ? graph_lock+0x170/0x170
[   90.675343]  ? graph_lock+0x170/0x170
[   90.679126]  ? find_held_lock+0x36/0x1c0
[   90.683171]  ? find_held_lock+0x36/0x1c0
[   90.687215]  ? kasan_check_read+0x11/0x20
[   90.691341]  ? do_raw_spin_unlock+0xa7/0x2f0
[   90.695732]  ? _raw_spin_unlock_irqrestore+0x74/0xc0
[   90.700814]  ? __kthread_parkme+0x58/0x1b0
[   90.705029]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   90.710023]  ? trace_hardirqs_on+0xd/0x10
[   90.714156]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   90.719672]  ? __kthread_parkme+0x106/0x1b0
[   90.723988]  kthread+0x345/0x410
[   90.727338]  ? process_one_work+0x1ba0/0x1ba0
[   90.731809]  ? kthread_bind+0x40/0x40
[   90.735593]  ret_from_fork+0x3a/0x50
[   90.739698] Dumping ftrace buffer:
[   90.743217]    (ftrace buffer empty)
[   90.746931] Kernel Offset: disabled
[   90.750550] Rebooting in 86400 seconds..