[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   18.178927] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   20.059716] random: sshd: uninitialized urandom read (32 bytes read)
[   20.365727] random: sshd: uninitialized urandom read (32 bytes read)
[   21.216956] random: sshd: uninitialized urandom read (32 bytes read)
[   21.374111] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.10.17' (ECDSA) to the list of known hosts.
[   26.893692] random: sshd: uninitialized urandom read (32 bytes read)
executing program
[   26.989709] ==================================================================
[   26.997146] BUG: KASAN: use-after-free in _copy_to_user+0xe9/0x110
[   27.003454] Read of size 924 at addr ffff8801a8bffff2 by task syz-executor703/4506
[   27.011139] 
[   27.012749] CPU: 0 PID: 4506 Comm: syz-executor703 Not tainted 4.18.0-rc4+ #141
[   27.020168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   27.029498] Call Trace:
[   27.032067]  dump_stack+0x1c9/0x2b4
[   27.035675]  ? dump_stack_print_info.cold.2+0x52/0x52
[   27.040844]  ? printk+0xa7/0xcf
[   27.044106]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   27.048844]  ? _copy_to_user+0xe9/0x110
[   27.052798]  print_address_description+0x6c/0x20b
[   27.057619]  ? _copy_to_user+0xe9/0x110
[   27.061570]  kasan_report.cold.7+0x242/0x2fe
[   27.065964]  check_memory_region+0x13e/0x1b0
[   27.070352]  kasan_check_read+0x11/0x20
[   27.074306]  _copy_to_user+0xe9/0x110
[   27.078101]  bpf_test_finish.isra.7+0xee/0x1f0
[   27.082661]  ? bpf_test_init.isra.8+0x100/0x100
[   27.087313]  ? bpf_test_run+0x2fc/0x3b0
[   27.091273]  bpf_prog_test_run_skb+0x7d7/0xa30
[   27.095836]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   27.100659]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   27.106181]  ? __bpf_prog_get+0x9b/0x290
[   27.110221]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   27.115043]  bpf_prog_test_run+0x130/0x1a0
[   27.120307]  __x64_sys_bpf+0x3d8/0x510
[   27.124173]  ? bpf_prog_get+0x20/0x20
[   27.127959]  ? do_syscall_64+0x9a/0x820
[   27.131915]  do_syscall_64+0x1b9/0x820
[   27.135784]  ? syscall_slow_exit_work+0x500/0x500
[   27.140605]  ? syscall_return_slowpath+0x5e0/0x5e0
[   27.145512]  ? syscall_return_slowpath+0x31d/0x5e0
[   27.150424]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[   27.155768]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   27.160593]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.165761] RIP: 0033:0x440269
[   27.168925] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   27.188129] RSP: 002b:00007fffd845fcb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   27.195815] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269
[   27.203060] RDX: 0000000000000028 RSI: 0000000020000380 RDI: 000000000000000a
[   27.210308] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
[   27.217555] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401af0
[   27.224803] R13: 0000000000401b80 R14: 0000000000000000 R15: 0000000000000000
[   27.232059] 
[   27.233661] The buggy address belongs to the page:
[   27.238569] page:ffffea0006a2ffc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
[   27.246687] flags: 0x2fffc0000000000()
[   27.250555] raw: 02fffc0000000000 ffffea0006a2ffc8 ffffea0006a2ffc8 0000000000000000
[   27.258414] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   27.266275] page dumped because: kasan: bad access detected
[   27.271958] 
[   27.273561] Memory state around the buggy address:
[   27.278469]  ffff8801a8bffe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   27.285804]  ffff8801a8bfff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   27.293142] >ffff8801a8bfff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   27.300485]                                                              ^
[   27.307477]  ffff8801a8c00000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   27.314812]  ffff8801a8c00080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   27.322145] ==================================================================
[   27.329477] Disabling lock debugging due to kernel taint
[   27.334987] Kernel panic - not syncing: panic_on_warn set ...
[   27.334987] 
[   27.342354] CPU: 0 PID: 4506 Comm: syz-executor703 Tainted: G    B             4.18.0-rc4+ #141
[   27.351177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   27.360507] Call Trace:
[   27.363074]  dump_stack+0x1c9/0x2b4
[   27.366682]  ? dump_stack_print_info.cold.2+0x52/0x52
[   27.371850]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   27.376587]  panic+0x238/0x4e7
[   27.379758]  ? add_taint.cold.5+0x16/0x16
[   27.383884]  ? do_raw_spin_unlock+0xa7/0x2f0
[   27.388269]  ? do_raw_spin_unlock+0xa7/0x2f0
[   27.392656]  ? _copy_to_user+0xe9/0x110
[   27.396606]  kasan_end_report+0x47/0x4f
[   27.400554]  kasan_report.cold.7+0x76/0x2fe
[   27.404854]  check_memory_region+0x13e/0x1b0
[   27.409241]  kasan_check_read+0x11/0x20
[   27.413191]  _copy_to_user+0xe9/0x110
[   27.416970]  bpf_test_finish.isra.7+0xee/0x1f0
[   27.421531]  ? bpf_test_init.isra.8+0x100/0x100
[   27.426180]  ? bpf_test_run+0x2fc/0x3b0
[   27.430133]  bpf_prog_test_run_skb+0x7d7/0xa30
[   27.434699]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   27.439518]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   27.445033]  ? __bpf_prog_get+0x9b/0x290
[   27.449075]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   27.453914]  bpf_prog_test_run+0x130/0x1a0
[   27.458129]  __x64_sys_bpf+0x3d8/0x510
[   27.461994]  ? bpf_prog_get+0x20/0x20
[   27.465781]  ? do_syscall_64+0x9a/0x820
[   27.469742]  do_syscall_64+0x1b9/0x820
[   27.473607]  ? syscall_slow_exit_work+0x500/0x500
[   27.478429]  ? syscall_return_slowpath+0x5e0/0x5e0
[   27.483334]  ? syscall_return_slowpath+0x31d/0x5e0
[   27.488243]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[   27.493582]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   27.498404]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   27.503570] RIP: 0033:0x440269
[   27.506734] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   27.525852] RSP: 002b:00007fffd845fcb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   27.533535] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269
[   27.540778] RDX: 0000000000000028 RSI: 0000000020000380 RDI: 000000000000000a
[   27.548027] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
[   27.555275] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401af0
[   27.562521] R13: 0000000000401b80 R14: 0000000000000000 R15: 0000000000000000
[   27.570283] Dumping ftrace buffer:
[   27.573804]    (ftrace buffer empty)
[   27.577489] Kernel Offset: disabled
[   27.581091] Rebooting in 86400 seconds..