[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   18.118562] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   23.831357] random: sshd: uninitialized urandom read (32 bytes read)
[   24.063403] random: sshd: uninitialized urandom read (32 bytes read)
[   24.819580] random: sshd: uninitialized urandom read (32 bytes read)
[   41.310905] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.0.34' (ECDSA) to the list of known hosts.
[   46.827931] random: sshd: uninitialized urandom read (32 bytes read)
executing program
[   46.942617] ==================================================================
[   46.950055] BUG: KASAN: slab-out-of-bounds in sha512_final+0x34a/0x3e0
[   46.956701] Write of size 8 at addr ffff8801d41a79c0 by task syz-executor075/4514
[   46.964295] 
[   46.965906] CPU: 1 PID: 4514 Comm: syz-executor075 Not tainted 4.18.0-rc2+ #116
[   46.973329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.982657] Call Trace:
[   46.985227]  dump_stack+0x1c9/0x2b4
[   46.988833]  ? dump_stack_print_info.cold.2+0x52/0x52
[   46.994000]  ? printk+0xa7/0xcf
[   46.997268]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   47.002003]  ? sha512_final+0x34a/0x3e0
[   47.005954]  print_address_description+0x6c/0x20b
[   47.010772]  ? sha512_final+0x34a/0x3e0
[   47.014723]  kasan_report.cold.7+0x242/0x2fe
[   47.019119]  __asan_report_store8_noabort+0x17/0x20
[   47.024114]  sha512_final+0x34a/0x3e0
[   47.027894]  crypto_shash_final+0x104/0x260
[   47.032196]  ? sha512_generic_block_fn+0x70/0x70
[   47.036932]  __keyctl_dh_compute+0x1198/0x1be0
[   47.041497]  ? copy_overflow+0x30/0x30
[   47.045374]  ? save_stack+0x43/0xd0
[   47.048982]  ? __kasan_slab_free+0x11a/0x170
[   47.053367]  ? kasan_slab_free+0xe/0x10
[   47.057319]  ? kfree+0xd9/0x260
[   47.060576]  ? __x64_sys_add_key+0x2b7/0x4e0
[   47.064961]  ? do_syscall_64+0x1b9/0x820
[   47.069010]  ? lock_release+0xa30/0xa30
[   47.072963]  ? check_same_owner+0x340/0x340
[   47.077286]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   47.082801]  ? _copy_from_user+0xdf/0x150
[   47.086928]  keyctl_dh_compute+0xc5/0x11f
[   47.091054]  ? __keyctl_dh_compute+0x1be0/0x1be0
[   47.095786]  ? __x64_sys_add_key+0x2bc/0x4e0
[   47.100178]  __x64_sys_keyctl+0x12a/0x3b0
[   47.104308]  do_syscall_64+0x1b9/0x820
[   47.108180]  ? syscall_return_slowpath+0x5e0/0x5e0
[   47.113099]  ? syscall_return_slowpath+0x31d/0x5e0
[   47.118021]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[   47.123365]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   47.128203]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   47.133379] RIP: 0033:0x43fff9
[   47.136544] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b 45 00 00 c3 66 2e 0f 1f 84 00 00 00 00 
[   47.155714] RSP: 002b:00007fff0bdcf328 EFLAGS: 00000217 ORIG_RAX: 00000000000000fa
[   47.163401] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fff9
[   47.170648] RDX: 0000000020a53ffb RSI: 0000000020000100 RDI: 0000000000000017
[   47.177896] RBP: 00000000006ca018 R08: 0000000020000140 R09: 00000000004002c8
[   47.185145] R10: 0000000000000018 R11: 0000000000000217 R12: 0000000000401920
[   47.192391] R13: 00000000004019b0 R14: 0000000000000000 R15: 0000000000000000
[   47.199642] 
[   47.201259] Allocated by task 4514:
[   47.204869]  save_stack+0x43/0xd0
[   47.208300]  kasan_kmalloc+0xc4/0xe0
[   47.211991]  __kmalloc+0x14e/0x760
[   47.215506]  __keyctl_dh_compute+0x1000/0x1be0
[   47.220063]  keyctl_dh_compute+0xc5/0x11f
[   47.224187]  __x64_sys_keyctl+0x12a/0x3b0
[   47.228312]  do_syscall_64+0x1b9/0x820
[   47.232178]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   47.237339] 
[   47.238946] Freed by task 1:
[   47.241946]  save_stack+0x43/0xd0
[   47.245380]  __kasan_slab_free+0x11a/0x170
[   47.249596]  kasan_slab_free+0xe/0x10
[   47.253377]  kfree+0xd9/0x260
[   47.256478]  apply_wqattrs_cleanup+0x149/0x170
[   47.261037]  apply_workqueue_attrs_locked+0x19a/0x250
[   47.266205]  apply_workqueue_attrs+0x30/0x50
[   47.270589]  __alloc_workqueue_key+0x74c/0x1190
[   47.275248]  rpc_init_mempool+0x7c/0x188
[   47.279286]  init_sunrpc+0xf/0xbb
[   47.282718]  do_one_initcall+0x127/0x913
[   47.286758]  kernel_init_freeable+0x49b/0x58e
[   47.291228]  kernel_init+0x11/0x1b3
[   47.294838]  ret_from_fork+0x3a/0x50
[   47.298523] 
[   47.300130] The buggy address belongs to the object at ffff8801d41a7980
[   47.300130]  which belongs to the cache kmalloc-64 of size 64
[   47.312598] The buggy address is located 0 bytes to the right of
[   47.312598]  64-byte region [ffff8801d41a7980, ffff8801d41a79c0)
[   47.324707] The buggy address belongs to the page:
[   47.329623] page:ffffea00075069c0 count:1 mapcount:0 mapping:ffff8801da800340 index:0x0
[   47.337742] flags: 0x2fffc0000000100(slab)
[   47.341958] raw: 02fffc0000000100 ffffea00074ba408 ffffea0007599908 ffff8801da800340
[   47.349827] raw: 0000000000000000 ffff8801d41a7000 0000000100000020 0000000000000000
[   47.357686] page dumped because: kasan: bad access detected
[   47.363370] 
[   47.364978] Memory state around the buggy address:
[   47.369882]  ffff8801d41a7880: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[   47.377223]  ffff8801d41a7900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   47.384576] >ffff8801d41a7980: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   47.391911]                                            ^
[   47.397339]  ffff8801d41a7a00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   47.404688]  ffff8801d41a7a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   47.412020] ==================================================================
[   47.419354] Disabling lock debugging due to kernel taint
[   47.424837] Kernel panic - not syncing: panic_on_warn set ...
[   47.424837] 
[   47.432185] CPU: 1 PID: 4514 Comm: syz-executor075 Tainted: G    B             4.18.0-rc2+ #116
[   47.441004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   47.450411] Call Trace:
[   47.452981]  dump_stack+0x1c9/0x2b4
[   47.456589]  ? dump_stack_print_info.cold.2+0x52/0x52
[   47.461760]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   47.466501]  panic+0x238/0x4e7
[   47.469680]  ? add_taint.cold.5+0x16/0x16
[   47.473807]  ? do_raw_spin_unlock+0xa7/0x2f0
[   47.478194]  ? do_raw_spin_unlock+0xa7/0x2f0
[   47.482581]  ? sha512_final+0x34a/0x3e0
[   47.486536]  kasan_end_report+0x47/0x4f
[   47.490489]  kasan_report.cold.7+0x76/0x2fe
[   47.494788]  __asan_report_store8_noabort+0x17/0x20
[   47.499783]  sha512_final+0x34a/0x3e0
[   47.503565]  crypto_shash_final+0x104/0x260
[   47.507873]  ? sha512_generic_block_fn+0x70/0x70
[   47.512610]  __keyctl_dh_compute+0x1198/0x1be0
[   47.517179]  ? copy_overflow+0x30/0x30
[   47.521045]  ? save_stack+0x43/0xd0
[   47.524647]  ? __kasan_slab_free+0x11a/0x170
[   47.529035]  ? kasan_slab_free+0xe/0x10
[   47.532987]  ? kfree+0xd9/0x260
[   47.536246]  ? __x64_sys_add_key+0x2b7/0x4e0
[   47.540633]  ? do_syscall_64+0x1b9/0x820
[   47.544975]  ? lock_release+0xa30/0xa30
[   47.548930]  ? check_same_owner+0x340/0x340
[   47.553237]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   47.558776]  ? _copy_from_user+0xdf/0x150
[   47.562906]  keyctl_dh_compute+0xc5/0x11f
[   47.567034]  ? __keyctl_dh_compute+0x1be0/0x1be0
[   47.571779]  ? __x64_sys_add_key+0x2bc/0x4e0
[   47.576166]  __x64_sys_keyctl+0x12a/0x3b0
[   47.580293]  do_syscall_64+0x1b9/0x820
[   47.584160]  ? syscall_return_slowpath+0x5e0/0x5e0
[   47.589078]  ? syscall_return_slowpath+0x31d/0x5e0
[   47.593998]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[   47.599352]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   47.604173]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   47.609339] RIP: 0033:0x43fff9
[   47.612503] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b 45 00 00 c3 66 2e 0f 1f 84 00 00 00 00 
[   47.631620] RSP: 002b:00007fff0bdcf328 EFLAGS: 00000217 ORIG_RAX: 00000000000000fa
[   47.639314] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fff9
[   47.646558] RDX: 0000000020a53ffb RSI: 0000000020000100 RDI: 0000000000000017
[   47.653812] RBP: 00000000006ca018 R08: 0000000020000140 R09: 00000000004002c8
[   47.661060] R10: 0000000000000018 R11: 0000000000000217 R12: 0000000000401920
[   47.668309] R13: 00000000004019b0 R14: 0000000000000000 R15: 0000000000000000
[   47.675974] Dumping ftrace buffer:
[   47.679489]    (ftrace buffer empty)
[   47.683187] Kernel Offset: disabled
[   47.686792] Rebooting in 86400 seconds..