[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   15.996443] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   20.986722] random: sshd: uninitialized urandom read (32 bytes read)
[   21.349375] random: sshd: uninitialized urandom read (32 bytes read)
[   22.024897] random: sshd: uninitialized urandom read (32 bytes read)
[   22.157245] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.15.194' (ECDSA) to the list of known hosts.
[   27.562400] random: sshd: uninitialized urandom read (32 bytes read)
executing program
[   27.645733] IPVS: ftp: loaded support on port[0] = 21
[   27.671737] ==================================================================
[   27.679501] BUG: KASAN: use-after-free in _copy_to_user+0xe9/0x110
[   27.685844] Read of size 924 at addr ffff8801a67ffff2 by task syz-executor037/4457
[   27.693522] 
[   27.695129] CPU: 1 PID: 4457 Comm: syz-executor037 Not tainted 4.18.0-rc3+ #48
[   27.702470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   27.711895] Call Trace:
[   27.714467]  dump_stack+0x1c9/0x2b4
[   27.718077]  ? dump_stack_print_info.cold.2+0x52/0x52
[   27.723262]  ? printk+0xa7/0xcf
[   27.726539]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   27.731285]  ? _copy_to_user+0xe9/0x110
[   27.735246]  print_address_description+0x6c/0x20b
[   27.740067]  ? _copy_to_user+0xe9/0x110
[   27.744040]  kasan_report.cold.7+0x242/0x2fe
[   27.748435]  check_memory_region+0x13e/0x1b0
[   27.752823]  kasan_check_read+0x11/0x20
[   27.756957]  _copy_to_user+0xe9/0x110
[   27.760740]  bpf_test_finish.isra.7+0xee/0x1f0
[   27.765307]  ? bpf_test_init.isra.8+0x100/0x100
[   27.769956]  ? bpf_test_run+0x2fc/0x3b0
[   27.773913]  bpf_prog_test_run_skb+0x7d7/0xa30
[   27.778474]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   27.783298]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   27.788816]  ? __bpf_prog_get+0x9b/0x290
[   27.792868]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   27.797696]  bpf_prog_test_run+0x130/0x1a0
[   27.801919]  __x64_sys_bpf+0x3d8/0x510
[   27.805787]  ? bpf_prog_get+0x20/0x20
[   27.809570]  ? do_page_fault+0xf6/0x8c0
[   27.813523]  do_syscall_64+0x1b9/0x820
[   27.817395]  ? syscall_return_slowpath+0x5e0/0x5e0
[   27.822849]  ? syscall_return_slowpath+0x31d/0x5e0
[   27.827768]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   27.832773]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   27.838291]  ? prepare_exit_to_usermode+0x291/0x3b0
[   27.843287]  ? perf_trace_sys_enter+0xb10/0xb10
[   27.847935]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   27.852767]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.857937] RIP: 0033:0x440899
[   27.861115] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   27.880231] RSP: 002b:00007ffe25de8548 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   27.887917] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440899
[   27.895165] RDX: 0000000000000028 RSI: 0000000020000380 RDI: 000000000000000a
[   27.902413] RBP: 00000000006cb018 R08: 0000000000000000 R09: 0000000000000000
[   27.909660] R10: 0000000001bc7880 R11: 0000000000000213 R12: 0000000000401d80
[   27.916915] R13: 0000000000401e10 R14: 0000000000000000 R15: 0000000000000000
[   27.924169] 
[   27.925773] The buggy address belongs to the page:
[   27.930679] page:ffffea000699ffc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
[   27.938796] flags: 0x2fffc0000000000()
[   27.942663] raw: 02fffc0000000000 ffffea000699ffc8 ffffea000699ffc8 0000000000000000
[   27.950524] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   27.958376] page dumped because: kasan: bad access detected
[   27.964058] 
[   27.965674] Memory state around the buggy address:
[   27.970579]  ffff8801a67ffe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   27.977914]  ffff8801a67fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   27.985250] >ffff8801a67fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   27.992592]                                                              ^
[   27.999585]  ffff8801a6800000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   28.006933]  ffff8801a6800080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   28.014273] ==================================================================
[   28.021822] Kernel panic - not syncing: panic_on_warn set ...
[   28.021822] 
[   28.029198] CPU: 1 PID: 4457 Comm: syz-executor037 Tainted: G    B             4.18.0-rc3+ #48
[   28.037947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   28.047281] Call Trace:
[   28.049853]  dump_stack+0x1c9/0x2b4
[   28.053462]  ? dump_stack_print_info.cold.2+0x52/0x52
[   28.058642]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   28.063382]  panic+0x238/0x4e7
[   28.066553]  ? add_taint.cold.5+0x16/0x16
[   28.070700]  ? do_raw_spin_unlock+0xa7/0x2f0
[   28.075089]  ? do_raw_spin_unlock+0xa7/0x2f0
[   28.079480]  ? _copy_to_user+0xe9/0x110
[   28.083432]  kasan_end_report+0x47/0x4f
[   28.087395]  kasan_report.cold.7+0x76/0x2fe
[   28.091696]  check_memory_region+0x13e/0x1b0
[   28.096084]  kasan_check_read+0x11/0x20
[   28.100041]  _copy_to_user+0xe9/0x110
[   28.103838]  bpf_test_finish.isra.7+0xee/0x1f0
[   28.108399]  ? bpf_test_init.isra.8+0x100/0x100
[   28.113049]  ? bpf_test_run+0x2fc/0x3b0
[   28.117024]  bpf_prog_test_run_skb+0x7d7/0xa30
[   28.121590]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   28.126413]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   28.131927]  ? __bpf_prog_get+0x9b/0x290
[   28.135966]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   28.140794]  bpf_prog_test_run+0x130/0x1a0
[   28.145013]  __x64_sys_bpf+0x3d8/0x510
[   28.148882]  ? bpf_prog_get+0x20/0x20
[   28.152665]  ? do_page_fault+0xf6/0x8c0
[   28.156619]  do_syscall_64+0x1b9/0x820
[   28.160487]  ? syscall_return_slowpath+0x5e0/0x5e0
[   28.165392]  ? syscall_return_slowpath+0x31d/0x5e0
[   28.170300]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   28.175294]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   28.180896]  ? prepare_exit_to_usermode+0x291/0x3b0
[   28.185890]  ? perf_trace_sys_enter+0xb10/0xb10
[   28.190535]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   28.195367]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   28.200533] RIP: 0033:0x440899
[   28.203698] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   28.222821] RSP: 002b:00007ffe25de8548 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   28.230507] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440899
[   28.237753] RDX: 0000000000000028 RSI: 0000000020000380 RDI: 000000000000000a
[   28.245013] RBP: 00000000006cb018 R08: 0000000000000000 R09: 0000000000000000
[   28.252275] R10: 0000000001bc7880 R11: 0000000000000213 R12: 0000000000401d80
[   28.259521] R13: 0000000000401e10 R14: 0000000000000000 R15: 0000000000000000
[   28.267316] Dumping ftrace buffer:
[   28.270839]    (ftrace buffer empty)
[   28.274524] Kernel Offset: disabled
[   28.278128] Rebooting in 86400 seconds..