[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 35.327456] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 35.725951] random: sshd: uninitialized urandom read (32 bytes read) [ 36.110909] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 37.440587] random: sshd: uninitialized urandom read (32 bytes read) [ 37.690647] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.23' (ECDSA) to the list of known hosts. [ 43.295380] random: sshd: uninitialized urandom read (32 bytes read) executing program executing program [ 43.422361] ================================================================== [ 43.423041] BUG: KMSAN: kernel-infoleak in copy_from_read_buf+0x311/0x890 [ 43.423041] CPU: 1 PID: 4588 Comm: syz-executor320 Not tainted 4.17.0+ #21 [ 43.423041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.423041] Call Trace: [ 43.423041] dump_stack+0x185/0x1d0 [ 43.423041] kmsan_report+0x188/0x2a0 [ 43.423041] kmsan_internal_check_memory+0x17e/0x1f0 [ 43.423041] kmsan_copy_to_user+0x7a/0x160 [ 43.423041] copy_from_read_buf+0x311/0x890 [ 43.423041] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 43.423041] n_tty_read+0x178f/0x2f70 [ 43.423041] ? wait_woken+0x2e0/0x2e0 [ 43.423041] ? rcu_all_qs+0x32/0x1f0 [ 43.423041] ? _cond_resched+0x3c/0xd0 [ 43.423041] ? ldsem_down_read+0x95/0xad0 [ 43.423041] ? tty_ldisc_ref_wait+0x97/0xf0 [ 43.423041] ? n_tty_flush_buffer+0x430/0x430 [ 43.423041] tty_read+0x26e/0x6c0 [ 43.423041] ? release_one_tty+0x5f0/0x5f0 [ 43.423041] __vfs_read+0x1b2/0x9d0 [ 43.423041] vfs_read+0x36c/0x6b0 [ 43.423041] __x64_sys_read+0x1bf/0x3e0 [ 43.423041] ? ksys_read+0x360/0x360 [ 43.423041] do_syscall_64+0x15b/0x230 [ 43.423041] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 43.423041] RIP: 0033:0x440239 [ 43.423041] RSP: 002b:00007ffe5e922d68 EFLAGS: 00000213 ORIG_RAX: 0000000000000000 [ 43.423041] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000440239 [ 43.423041] RDX: 00000000ffffff5c RSI: 0000000020000080 RDI: 0000000000000006 [ 43.423041] RBP: 6d74702f7665642f R08: 000000000000000a R09: 00007ffe5e922de0 [ 43.423041] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401b00 [ 43.423041] R13: 0000000000401b90 R14: 0000000000000000 R15: 0000000000000000 [ 43.423041] [ 43.423041] Uninit was created at: [ 43.423041] kmsan_internal_alloc_meta_for_pages+0x146/0x700 [ 43.423041] kmsan_alloc_page+0x75/0xd0 [ 43.423041] __alloc_pages_nodemask+0xf7b/0x5cc0 [ 43.423041] alloc_pages_current+0x6b1/0x970 [ 43.423041] __vmalloc_node_range+0x8bf/0x1170 [ 43.423041] vmalloc+0xd8/0xf0 [ 43.423041] n_tty_open+0x4a/0x490 [ 43.423041] tty_ldisc_setup+0x375/0x670 [ 43.423041] tty_init_dev+0xb82/0x1020 [ 43.423041] ptmx_open+0x2bb/0x7c0 [ 43.423041] chrdev_open+0xc25/0xd90 [ 43.423041] do_dentry_open+0xccc/0x1440 [ 43.423041] vfs_open+0x1b6/0x2f0 [ 43.423041] path_openat+0x4771/0x6640 [ 43.423041] do_filp_open+0x261/0x640 [ 43.423041] do_sys_open+0x624/0x960 [ 43.423041] __x64_sys_openat+0x129/0x170 [ 43.423041] do_syscall_64+0x15b/0x230 [ 43.423041] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 43.423041] [ 43.423041] Byte 4094 of 4095 is uninitialized [ 43.423041] Memory access starts at ffffc900018af05e [ 43.423041] ================================================================== [ 43.423041] Disabling lock debugging due to kernel taint [ 43.423041] Kernel panic - not syncing: panic_on_warn set ... [ 43.423041] [ 43.423041] CPU: 1 PID: 4588 Comm: syz-executor320 Tainted: G B 4.17.0+ #21 [ 43.423041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.423041] Call Trace: [ 43.423041] dump_stack+0x185/0x1d0 [ 43.423041] panic+0x3d0/0x9b0 [ 43.423041] kmsan_report+0x29e/0x2a0 [ 43.423041] kmsan_internal_check_memory+0x17e/0x1f0 [ 43.423041] kmsan_copy_to_user+0x7a/0x160 [ 43.423041] copy_from_read_buf+0x311/0x890 [ 43.423041] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 43.423041] n_tty_read+0x178f/0x2f70 [ 43.423041] ? wait_woken+0x2e0/0x2e0 [ 43.423041] ? rcu_all_qs+0x32/0x1f0 [ 43.423041] ? _cond_resched+0x3c/0xd0 [ 43.423041] ? ldsem_down_read+0x95/0xad0 [ 43.423041] ? tty_ldisc_ref_wait+0x97/0xf0 [ 43.423041] ? n_tty_flush_buffer+0x430/0x430 [ 43.423041] tty_read+0x26e/0x6c0 [ 43.423041] ? release_one_tty+0x5f0/0x5f0 [ 43.423041] __vfs_read+0x1b2/0x9d0 [ 43.423041] vfs_read+0x36c/0x6b0 [ 43.423041] __x64_sys_read+0x1bf/0x3e0 [ 43.423041] ? ksys_read+0x360/0x360 [ 43.423041] do_syscall_64+0x15b/0x230 [ 43.423041] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 43.423041] RIP: 0033:0x440239 [ 43.423041] RSP: 002b:00007ffe5e922d68 EFLAGS: 00000213 ORIG_RAX: 0000000000000000 [ 43.423041] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000440239 [ 43.423041] RDX: 00000000ffffff5c RSI: 0000000020000080 RDI: 0000000000000006 [ 43.423041] RBP: 6d74702f7665642f R08: 000000000000000a R09: 00007ffe5e922de0 [ 43.423041] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401b00 [ 43.423041] R13: 0000000000401b90 R14: 0000000000000000 R15: 0000000000000000 [ 43.423041] Dumping ftrace buffer: [ 43.423041] (ftrace buffer empty) [ 43.423041] Kernel Offset: disabled [ 43.423041] Rebooting in 86400 seconds..