[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 32.091513] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 35.268945] random: sshd: uninitialized urandom read (32 bytes read) [ 35.556814] random: sshd: uninitialized urandom read (32 bytes read) [ 36.831309] random: sshd: uninitialized urandom read (32 bytes read) [ 45.857256] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.29' (ECDSA) to the list of known hosts. [ 51.399215] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 51.533264] ================================================================== [ 51.540724] BUG: KMSAN: kernel-infoleak in copy_from_read_buf+0x311/0x890 [ 51.547751] CPU: 1 PID: 4532 Comm: syz-executor763 Not tainted 4.17.0+ #22 [ 51.554884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.564250] Call Trace: [ 51.566872] dump_stack+0x185/0x1d0 [ 51.570535] kmsan_report+0x188/0x2a0 [ 51.574384] kmsan_internal_check_memory+0x17e/0x1f0 [ 51.579531] kmsan_copy_to_user+0x73/0xb0 [ 51.583734] copy_from_read_buf+0x311/0x890 [ 51.588103] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 51.593521] n_tty_read+0x178f/0x2f70 [ 51.597358] ? wait_woken+0x2e0/0x2e0 [ 51.601183] ? rcu_all_qs+0x32/0x1f0 [ 51.604911] ? _cond_resched+0x3c/0xd0 [ 51.608826] ? ldsem_down_read+0x95/0xad0 [ 51.613016] ? tty_ldisc_ref_wait+0x97/0xf0 [ 51.617370] ? n_tty_flush_buffer+0x430/0x430 [ 51.621881] tty_read+0x26e/0x6c0 [ 51.625356] ? release_one_tty+0x5f0/0x5f0 [ 51.629612] __vfs_read+0x1b2/0x9d0 [ 51.633360] vfs_read+0x36c/0x6b0 [ 51.636837] __x64_sys_read+0x1bf/0x3e0 [ 51.640847] ? ksys_read+0x360/0x360 [ 51.644571] do_syscall_64+0x15b/0x230 [ 51.648501] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 51.653705] RIP: 0033:0x440489 [ 51.656895] RSP: 002b:00007ffd51d9d278 EFLAGS: 00000217 ORIG_RAX: 0000000000000000 [ 51.664604] RAX: ffffffffffffffda RBX: 00007ffd51d9d330 RCX: 0000000000440489 [ 51.671881] RDX: 00000000ffffff5c RSI: 0000000020000080 RDI: 0000000000000004 [ 51.679168] RBP: 00000000006cc018 R08: 000000000000000a R09: 00007ffd51d9d2f0 [ 51.686466] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401cf0 [ 51.693789] R13: 0000000000401d80 R14: 0000000000000000 R15: 0000000000000000 [ 51.701080] [ 51.702707] Uninit was created at: [ 51.706283] kmsan_internal_alloc_meta_for_pages+0x146/0x700 [ 51.712114] kmsan_alloc_page+0x75/0xd0 [ 51.716094] __alloc_pages_nodemask+0xf7b/0x5cc0 [ 51.720853] alloc_pages_current+0x6b1/0x970 [ 51.725282] __vmalloc_node_range+0x8bf/0x1170 [ 51.729874] vmalloc+0xd8/0xf0 [ 51.733053] n_tty_open+0x4a/0x490 [ 51.736933] tty_ldisc_setup+0x375/0x670 [ 51.740999] tty_init_dev+0xb82/0x1020 [ 51.744906] ptmx_open+0x2bb/0x7c0 [ 51.749136] chrdev_open+0xc25/0xd90 [ 51.752851] do_dentry_open+0xccc/0x1440 [ 51.756921] vfs_open+0x1b6/0x2f0 [ 51.760389] path_openat+0x4771/0x6640 [ 51.764284] do_filp_open+0x261/0x640 [ 51.768106] do_sys_open+0x624/0x960 [ 51.771833] __x64_sys_openat+0x129/0x170 [ 51.775999] do_syscall_64+0x15b/0x230 [ 51.779889] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 51.785076] [ 51.786694] Byte 4094 of 4095 is uninitialized [ 51.791282] Memory access starts at ffffc9000189f05e [ 51.796387] ================================================================== [ 51.803757] Disabling lock debugging due to kernel taint [ 51.809245] Kernel panic - not syncing: panic_on_warn set ... [ 51.809245] [ 51.816653] CPU: 1 PID: 4532 Comm: syz-executor763 Tainted: G B 4.17.0+ #22 [ 51.825152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.834646] Call Trace: [ 51.837257] dump_stack+0x185/0x1d0 [ 51.840898] panic+0x3d0/0x9b0 [ 51.844124] kmsan_report+0x29e/0x2a0 [ 51.847947] kmsan_internal_check_memory+0x17e/0x1f0 [ 51.853080] kmsan_copy_to_user+0x73/0xb0 [ 51.857237] copy_from_read_buf+0x311/0x890 [ 51.861582] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 51.866973] n_tty_read+0x178f/0x2f70 [ 51.870820] ? wait_woken+0x2e0/0x2e0 [ 51.874664] ? rcu_all_qs+0x32/0x1f0 [ 51.878394] ? _cond_resched+0x3c/0xd0 [ 51.882290] ? ldsem_down_read+0x95/0xad0 [ 51.886464] ? tty_ldisc_ref_wait+0x97/0xf0 [ 51.890804] ? n_tty_flush_buffer+0x430/0x430 [ 51.895331] tty_read+0x26e/0x6c0 [ 51.898811] ? release_one_tty+0x5f0/0x5f0 [ 51.903054] __vfs_read+0x1b2/0x9d0 [ 51.906709] vfs_read+0x36c/0x6b0 [ 51.910198] __x64_sys_read+0x1bf/0x3e0 [ 51.914181] ? ksys_read+0x360/0x360 [ 51.917904] do_syscall_64+0x15b/0x230 [ 51.921831] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 51.927024] RIP: 0033:0x440489 [ 51.930235] RSP: 002b:00007ffd51d9d278 EFLAGS: 00000217 ORIG_RAX: 0000000000000000 [ 51.937965] RAX: ffffffffffffffda RBX: 00007ffd51d9d330 RCX: 0000000000440489 [ 51.945232] RDX: 00000000ffffff5c RSI: 0000000020000080 RDI: 0000000000000004 [ 51.952510] RBP: 00000000006cc018 R08: 000000000000000a R09: 00007ffd51d9d2f0 [ 51.959820] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401cf0 [ 51.967184] R13: 0000000000401d80 R14: 0000000000000000 R15: 0000000000000000 [ 51.975045] Dumping ftrace buffer: [ 51.978605] (ftrace buffer empty) [ 51.982333] Kernel Offset: disabled [ 51.985991] Rebooting in 86400 seconds..