[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok [   16.091965] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available)
8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   20.801669] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available)
[   21.143600] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available)
[   21.895082] random: sshd: uninitialized urandom read (32 bytes read, 88 bits of entropy available)
[   25.774502] random: sshd: uninitialized urandom read (32 bytes read, 96 bits of entropy available)
Warning: Permanently added 'ci-android-44-kasan-gce-386-4,10.128.0.18' (ECDSA) to the list of known hosts.
[   31.207615] random: sshd: uninitialized urandom read (32 bytes read, 103 bits of entropy available)
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   32.847622] ==================================================================
[   32.851928] ------------[ cut here ]------------
[   32.851948] WARNING: CPU: 1 PID: 4085 at kernel/locking/lockdep.c:3190 __lock_acquire+0x23b3/0x4b50()
[   32.851955] DEBUG_LOCKS_WARN_ON(id >= MAX_LOCKDEP_KEYS)
[   32.851955] Kernel panic - not syncing: panic_on_warn set ...
[   32.851955] 
[   32.851963] CPU: 1 PID: 4085 Comm: syzkaller160734 Not tainted 4.4.107-g79f138a #2
[   32.851967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   32.851976]  0000000000000000 fac66347bd2b1d29 ffff8800b6a470c0 ffffffff81d03a1d
[   32.851983]  ffffffff838429a0 ffff8800b6a47198 ffffffff83854820 0000000000000009
[   32.851990]  0000000000000c76 ffff8800b6a47188 ffffffff81416dca 0000000041b58ab3
[   32.851992] Call Trace:
[   32.852004]  [<ffffffff81d03a1d>] dump_stack+0xc1/0x124
[   32.852013]  [<ffffffff81416dca>] panic+0x1aa/0x388
[   32.852020]  [<ffffffff81416c20>] ? percpu_up_read.constprop.46+0xe1/0xe1
[   32.852028]  [<ffffffff8112ad7a>] ? warn_slowpath_common+0x10a/0x140
[   32.852034]  [<ffffffff8112ad95>] warn_slowpath_common+0x125/0x140
[   32.852039]  [<ffffffff812361f3>] ? __lock_acquire+0x23b3/0x4b50
[   32.852045]  [<ffffffff8112ae71>] warn_slowpath_fmt+0xc1/0x110
[   32.852051]  [<ffffffff8112adb0>] ? warn_slowpath_common+0x140/0x140
[   32.852056]  [<ffffffff8122d870>] ? save_trace+0xe0/0x270
[   32.852064]  [<ffffffff81016bec>] ? dump_trace+0x14c/0x350
[   32.852069]  [<ffffffff8123260e>] ? mark_lock+0x45e/0xfd0
[   32.852075]  [<ffffffff812361f3>] __lock_acquire+0x23b3/0x4b50
[   32.852083]  [<ffffffff814fa193>] ? save_stack+0xa3/0xd0
[   32.852092]  [<ffffffff81035c86>] ? save_stack_trace+0x26/0x50
[   32.852098]  [<ffffffff814fa133>] ? save_stack+0x43/0xd0
[   32.852104]  [<ffffffff814fa3fd>] ? kasan_kmalloc+0xad/0xe0
[   32.852110]  [<ffffffff814f63b0>] ? kmem_cache_alloc_trace+0x100/0x2b0
[   32.852119]  [<ffffffff825b6c38>] ? sg_read+0xb48/0x1490
[   32.852125]  [<ffffffff81233e40>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[   32.852131]  [<ffffffff81233e40>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[   32.852137]  [<ffffffff8151cdb8>] ? vfs_readv+0x78/0xb0
[   32.852146]  [<ffffffff815b863a>] ? default_file_splice_read+0x4fa/0x8e0
[   32.852152]  [<ffffffff815b4365>] ? do_splice_to+0xf5/0x140
[   32.852158]  [<ffffffff815ba599>] ? SyS_splice+0x1009/0x14b0
[   32.852164]  [<ffffffff81006d84>] ? do_fast_syscall_32+0x314/0x890
[   32.852171]  [<ffffffff83771357>] ? sysenter_flags_fixed+0xd/0x17
[   32.852177]  [<ffffffff8123a1fe>] lock_acquire+0x15e/0x460
[   32.852183]  [<ffffffff825b46c9>] ? sg_remove_request+0x69/0x110
[   32.852189]  [<ffffffff825b6c38>] ? sg_read+0xb48/0x1490
[   32.852196]  [<ffffffff8376f89e>] _raw_write_lock_irqsave+0x4e/0x70
[   32.852202]  [<ffffffff825b46c9>] ? sg_remove_request+0x69/0x110
[   32.852208]  [<ffffffff825b46c9>] sg_remove_request+0x69/0x110
[   32.852214]  [<ffffffff825b4cd5>] sg_finish_rem_req+0x295/0x340
[   32.852219]  [<ffffffff825b6b11>] sg_read+0xa21/0x1490
[   32.852226]  [<ffffffff815128b4>] ? __check_object_size+0x154/0x35b
[   32.852231]  [<ffffffff810002b8>] ? 0xffffffff810002b8
[   32.852237]  [<ffffffff825b60f0>] ? sg_proc_seq_show_debug+0xd30/0xd30
[   32.852244]  [<ffffffff815e8650>] ? fsnotify+0xee0/0xee0
[   32.852252]  [<ffffffff81b4ca39>] ? avc_policy_seqno+0x9/0x20
[   32.852258]  [<ffffffff8151a8e1>] do_loop_readv_writev+0x141/0x1e0
[   32.852265]  [<ffffffff81b43929>] ? security_file_permission+0x89/0x1e0
[   32.852275]  [<ffffffff825b60f0>] ? sg_proc_seq_show_debug+0xd30/0xd30
[   32.852281]  [<ffffffff825b60f0>] ? sg_proc_seq_show_debug+0xd30/0xd30
[   32.852287]  [<ffffffff8151cc3d>] do_readv_writev+0x5dd/0x6e0
[   32.852293]  [<ffffffff8151c660>] ? vfs_write+0x530/0x530
[   32.852300]  [<ffffffff81434690>] ? __alloc_pages_direct_compact+0x250/0x250
[   32.852307]  [<ffffffff8151cdb8>] vfs_readv+0x78/0xb0
[   32.852314]  [<ffffffff815b863a>] default_file_splice_read+0x4fa/0x8e0
[   32.852321]  [<ffffffff815b8140>] ? generic_file_splice_read+0x1c0/0x1c0
[   32.852328]  [<ffffffff815b3650>] ? page_cache_pipe_buf_release+0x70/0x70
[   32.852339]  [<ffffffff8123499f>] ? __lock_acquire+0xb5f/0x4b50
[   32.852345]  [<ffffffff81233e40>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[   32.852353]  [<ffffffff8151bba0>] ? rw_verify_area+0x100/0x2f0
[   32.852359]  [<ffffffff815b8140>] ? generic_file_splice_read+0x1c0/0x1c0
[   32.852365]  [<ffffffff815b4365>] do_splice_to+0xf5/0x140
[   32.852372]  [<ffffffff815ba599>] SyS_splice+0x1009/0x14b0
[   32.852377]  [<ffffffff8123360b>] ? trace_hardirqs_on_caller+0x38b/0x590
[   32.852384]  [<ffffffff815b9590>] ? compat_SyS_vmsplice+0x240/0x240
[   32.852390]  [<ffffffff81006b47>] ? do_fast_syscall_32+0xd7/0x890
[   32.852396]  [<ffffffff815b9590>] ? compat_SyS_vmsplice+0x240/0x240
[   32.852402]  [<ffffffff81006d84>] do_fast_syscall_32+0x314/0x890
[   32.852408]  [<ffffffff83771357>] sysenter_flags_fixed+0xd/0x17
[   33.301450] BUG: KASAN: out-of-bounds in sg_remove_request+0xf9/0x110
[   33.308001] Read of size 8 at addr ffff8801d5993740 by task syzkaller160734/4073
[   33.315495] 
[   33.317097] CPU: 0 PID: 4073 Comm: syzkaller160734 Not tainted 4.4.107-g79f138a #2
[   33.324772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   33.334101]  0000000000000000 847e5af13f711d75 ffff8801ccf27480 ffffffff81d03a1d
[   33.342053]  ffffea00075664c0 ffff8801d5993740 0000000000000000 ffff8801d5993748
[   33.349998]  ffff8800b57a4438 ffff8801ccf274b8 ffffffff814fb0c3 ffff8801d5993740
[   33.357948] Call Trace:
[   33.360505]  [<ffffffff81d03a1d>] dump_stack+0xc1/0x124
[   33.365840]  [<ffffffff814fb0c3>] print_address_description+0x73/0x260
[   33.372483]  [<ffffffff814fb5d5>] kasan_report+0x285/0x370
[   33.378073]  [<ffffffff825b4759>] ? sg_remove_request+0xf9/0x110
[   33.384184]  [<ffffffff814fb734>] __asan_report_load8_noabort+0x14/0x20
[   33.390902]  [<ffffffff825b4759>] sg_remove_request+0xf9/0x110
[   33.396837]  [<ffffffff825b4cd5>] sg_finish_rem_req+0x295/0x340
[   33.402857]  [<ffffffff825b6b11>] sg_read+0xa21/0x1490
[   33.408111]  [<ffffffff815128b4>] ? __check_object_size+0x154/0x35b
[   33.414477]  [<ffffffff810002b8>] ? 0xffffffff810002b8
[   33.419716]  [<ffffffff825b60f0>] ? sg_proc_seq_show_debug+0xd30/0xd30
[   33.426364]  [<ffffffff815e8650>] ? fsnotify+0xee0/0xee0
[   33.431781]  [<ffffffff81b4ca39>] ? avc_policy_seqno+0x9/0x20
[   33.437649]  [<ffffffff8151a8e1>] do_loop_readv_writev+0x141/0x1e0
[   33.443943]  [<ffffffff81b43929>] ? security_file_permission+0x89/0x1e0
[   33.450665]  [<ffffffff825b60f0>] ? sg_proc_seq_show_debug+0xd30/0xd30
[   33.457293]  [<ffffffff825b60f0>] ? sg_proc_seq_show_debug+0xd30/0xd30
[   33.463926]  [<ffffffff8151cc3d>] do_readv_writev+0x5dd/0x6e0
[   33.469776]  [<ffffffff8151c660>] ? vfs_write+0x530/0x530
[   33.475277]  [<ffffffff81434690>] ? __alloc_pages_direct_compact+0x250/0x250
[   33.482433]  [<ffffffff8151cdb8>] vfs_readv+0x78/0xb0
[   33.487592]  [<ffffffff815b863a>] default_file_splice_read+0x4fa/0x8e0
[   33.494221]  [<ffffffff815b8140>] ? generic_file_splice_read+0x1c0/0x1c0
[   33.501021]  [<ffffffff815b3650>] ? page_cache_pipe_buf_release+0x70/0x70
[   33.507912]  [<ffffffff8123499f>] ? __lock_acquire+0xb5f/0x4b50
[   33.513932]  [<ffffffff81233e40>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[   33.520911]  [<ffffffff8151bba0>] ? rw_verify_area+0x100/0x2f0
[   33.526862]  [<ffffffff815b8140>] ? generic_file_splice_read+0x1c0/0x1c0
[   33.533684]  [<ffffffff815b4365>] do_splice_to+0xf5/0x140
[   33.539185]  [<ffffffff815ba599>] SyS_splice+0x1009/0x14b0
[   33.544774]  [<ffffffff8123360b>] ? trace_hardirqs_on_caller+0x38b/0x590
[   33.551575]  [<ffffffff815b9590>] ? compat_SyS_vmsplice+0x240/0x240
[   33.557952]  [<ffffffff81006b47>] ? do_fast_syscall_32+0xd7/0x890
[   33.564159]  [<ffffffff815b9590>] ? compat_SyS_vmsplice+0x240/0x240
[   33.570528]  [<ffffffff81006d84>] do_fast_syscall_32+0x314/0x890
[   33.576645]  [<ffffffff83771357>] sysenter_flags_fixed+0xd/0x17
[   33.582663] 
[   33.584257] Allocated by task 4082:
[   33.587847]  [<ffffffff81035c86>] save_stack_trace+0x26/0x50
[   33.593727]  [<ffffffff814fa133>] save_stack+0x43/0xd0
[   33.599078]  [<ffffffff814fa3fd>] kasan_kmalloc+0xad/0xe0
[   33.604689]  [<ffffffff814fa9d2>] kasan_slab_alloc+0x12/0x20
[   33.610560]  [<ffffffff814f60da>] kmem_cache_alloc+0xba/0x290
[   33.616519]  [<ffffffff81556aa7>] fasync_helper+0x37/0xb0
[   33.622131]  [<ffffffff825b33e6>] sg_fasync+0x86/0xb0
[   33.627411]  [<ffffffff81558121>] do_vfs_ioctl+0x981/0xee0
[   33.633109]  [<ffffffff8161cf1e>] compat_SyS_ioctl+0x64e/0x2540
[   33.639244]  [<ffffffff81006d84>] do_fast_syscall_32+0x314/0x890
[   33.645461]  [<ffffffff83771357>] sysenter_flags_fixed+0xd/0x17
[   33.651595] 
[   33.653187] Freed by task 0:
[   33.656167] (stack is not available)
[   33.659846] 
[   33.661437] The buggy address belongs to the object at ffff8801d5993700
[   33.661437]  which belongs to the cache fasync_cache of size 96
[   33.674063] The buggy address is located 64 bytes inside of
[   33.674063]  96-byte region [ffff8801d5993700, ffff8801d5993760)
[   33.685727] The buggy address belongs to the page:
[   33.914305] Shutting down cpus with NMI
[   33.918679] Dumping ftrace buffer:
[   33.922192]    (ftrace buffer empty)
[   33.925870] Kernel Offset: disabled
[   33.929462] Rebooting in 86400 seconds..