[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   17.829599] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   21.570980] random: sshd: uninitialized urandom read (32 bytes read)
[   22.023379] random: sshd: uninitialized urandom read (32 bytes read)
[   22.744755] random: sshd: uninitialized urandom read (32 bytes read)
[   22.881562] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.0.46' (ECDSA) to the list of known hosts.
[   28.477057] random: sshd: uninitialized urandom read (32 bytes read)
executing program
[   33.696045] ==================================================================
[   33.703454] BUG: KASAN: use-after-free in _copy_to_user+0xe9/0x110
[   33.709750] Read of size 924 at addr ffff8801a73ffff2 by task syz-executor317/4467
[   33.717437] 
[   33.719047] CPU: 0 PID: 4467 Comm: syz-executor317 Not tainted 4.18.0-rc4-next-20180711+ #4
[   33.727514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   33.736853] Call Trace:
[   33.739434]  dump_stack+0x1c9/0x2b4
[   33.743047]  ? dump_stack_print_info.cold.2+0x52/0x52
[   33.748215]  ? printk+0xa7/0xcf
[   33.751492]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   33.756243]  ? _copy_to_user+0xe9/0x110
[   33.760202]  print_address_description+0x6c/0x20b
[   33.765043]  ? _copy_to_user+0xe9/0x110
[   33.768995]  kasan_report.cold.7+0x242/0x30d
[   33.773393]  check_memory_region+0x13e/0x1b0
[   33.777779]  kasan_check_read+0x11/0x20
[   33.781737]  _copy_to_user+0xe9/0x110
[   33.785515]  bpf_test_finish.isra.7+0xee/0x1f0
[   33.790075]  ? bpf_test_init.isra.8+0x100/0x100
[   33.794737]  ? bpf_skb_change_head+0x737/0xad0
[   33.799301]  ? bpf_test_run+0x2fc/0x3b0
[   33.803255]  bpf_prog_test_run_skb+0x7d7/0xa30
[   33.807918]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   33.812742]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   33.818258]  ? __bpf_prog_get+0x9b/0x290
[   33.822303]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   33.827123]  bpf_prog_test_run+0x130/0x1a0
[   33.831339]  __x64_sys_bpf+0x3d8/0x510
[   33.835204]  ? bpf_prog_get+0x20/0x20
[   33.838985]  ? do_page_fault+0xf6/0x8c0
[   33.842941]  do_syscall_64+0x1b9/0x820
[   33.846811]  ? syscall_return_slowpath+0x5e0/0x5e0
[   33.851718]  ? syscall_return_slowpath+0x31d/0x5e0
[   33.856626]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   33.861622]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   33.867135]  ? prepare_exit_to_usermode+0x291/0x3b0
[   33.872127]  ? perf_trace_sys_enter+0xb10/0xb10
[   33.876773]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   33.881598]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   33.886765] RIP: 0033:0x4408d9
[   33.889941] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   33.909057] RSP: 002b:00007fff3da1dba8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   33.916745] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9
[   33.924008] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a
[   33.931270] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8
[   33.938517] R10: 0000000001224880 R11: 0000000000000213 R12: 0000000000401da0
[   33.945764] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000
[   33.953017] 
[   33.954627] The buggy address belongs to the page:
[   33.959550] page:ffffea00069cffc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
[   33.967668] flags: 0x2fffc0000000000()
[   33.971534] raw: 02fffc0000000000 ffffea00069cffc8 ffffea00069cffc8 0000000000000000
[   33.979400] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   33.987253] page dumped because: kasan: bad access detected
[   33.993029] 
[   33.994630] Memory state around the buggy address:
[   33.999542]  ffff8801a73ffe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.006877]  ffff8801a73fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.014224] >ffff8801a73fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.021567]                                                              ^
[   34.028555]  ffff8801a7400000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   34.035975]  ffff8801a7400080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   34.043324] ==================================================================
[   34.050762] Kernel panic - not syncing: panic_on_warn set ...
[   34.050762] 
[   34.058131] CPU: 0 PID: 4467 Comm: syz-executor317 Tainted: G    B             4.18.0-rc4-next-20180711+ #4
[   34.068001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   34.077345] Call Trace:
[   34.079928]  dump_stack+0x1c9/0x2b4
[   34.083534]  ? dump_stack_print_info.cold.2+0x52/0x52
[   34.088792]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   34.093528]  panic+0x238/0x4e7
[   34.096699]  ? add_taint.cold.5+0x16/0x16
[   34.100828]  ? do_raw_spin_unlock+0xa7/0x2f0
[   34.105212]  ? do_raw_spin_unlock+0xa7/0x2f0
[   34.109599]  ? _copy_to_user+0xe9/0x110
[   34.113636]  kasan_end_report+0x47/0x4f
[   34.117588]  kasan_report.cold.7+0x76/0x30d
[   34.121897]  check_memory_region+0x13e/0x1b0
[   34.126289]  kasan_check_read+0x11/0x20
[   34.130246]  _copy_to_user+0xe9/0x110
[   34.134041]  bpf_test_finish.isra.7+0xee/0x1f0
[   34.138688]  ? bpf_test_init.isra.8+0x100/0x100
[   34.143335]  ? bpf_skb_change_head+0x737/0xad0
[   34.147897]  ? bpf_test_run+0x2fc/0x3b0
[   34.151868]  bpf_prog_test_run_skb+0x7d7/0xa30
[   34.156442]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   34.161358]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   34.166885]  ? __bpf_prog_get+0x9b/0x290
[   34.170941]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   34.175768]  bpf_prog_test_run+0x130/0x1a0
[   34.179982]  __x64_sys_bpf+0x3d8/0x510
[   34.183846]  ? bpf_prog_get+0x20/0x20
[   34.187629]  ? do_page_fault+0xf6/0x8c0
[   34.193850]  do_syscall_64+0x1b9/0x820
[   34.197746]  ? syscall_return_slowpath+0x5e0/0x5e0
[   34.202657]  ? syscall_return_slowpath+0x31d/0x5e0
[   34.207568]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   34.212577]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   34.218098]  ? prepare_exit_to_usermode+0x291/0x3b0
[   34.223096]  ? perf_trace_sys_enter+0xb10/0xb10
[   34.227762]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   34.232698]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   34.237872] RIP: 0033:0x4408d9
[   34.241037] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   34.260173] RSP: 002b:00007fff3da1dba8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   34.267872] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9
[   34.275151] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a
[   34.282405] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8
[   34.289668] R10: 0000000001224880 R11: 0000000000000213 R12: 0000000000401da0
[   34.297092] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000
[   34.304964] Dumping ftrace buffer:
[   34.308511]    (ftrace buffer empty)
[   34.312226] Kernel Offset: disabled
[   34.315836] Rebooting in 86400 seconds..