[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   16.193479] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   20.328490] random: sshd: uninitialized urandom read (32 bytes read)
[   20.706212] random: sshd: uninitialized urandom read (32 bytes read)
[   21.416510] random: sshd: uninitialized urandom read (32 bytes read)
[   21.550102] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.10.33' (ECDSA) to the list of known hosts.
[   26.987210] random: sshd: uninitialized urandom read (32 bytes read)
executing program
[   32.737065] ==================================================================
[   32.744468] BUG: KASAN: use-after-free in _copy_to_user+0xe9/0x110
[   32.750764] Read of size 924 at addr ffff8801c03ffff2 by task syz-executor649/4460
[   32.758444] 
[   32.760053] CPU: 0 PID: 4460 Comm: syz-executor649 Not tainted 4.18.0-rc4-next-20180710+ #3
[   32.768523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   32.777851] Call Trace:
[   32.780429]  dump_stack+0x1c9/0x2b4
[   32.784039]  ? dump_stack_print_info.cold.2+0x52/0x52
[   32.789206]  ? printk+0xa7/0xcf
[   32.792473]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   32.797207]  ? _copy_to_user+0xe9/0x110
[   32.801160]  print_address_description+0x6c/0x20b
[   32.805982]  ? _copy_to_user+0xe9/0x110
[   32.809933]  kasan_report.cold.7+0x242/0x30d
[   32.814322]  check_memory_region+0x13e/0x1b0
[   32.818706]  kasan_check_read+0x11/0x20
[   32.822665]  _copy_to_user+0xe9/0x110
[   32.826446]  bpf_test_finish.isra.7+0xee/0x1f0
[   32.831006]  ? bpf_test_init.isra.8+0x100/0x100
[   32.835743]  ? bpf_test_run+0x1ea/0x3b0
[   32.839697]  ? bpf_test_run+0x2fc/0x3b0
[   32.843651]  bpf_prog_test_run_skb+0x7d7/0xa30
[   32.848210]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   32.853039]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   32.858556]  ? __bpf_prog_get+0x9b/0x290
[   32.862597]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   32.867424]  bpf_prog_test_run+0x130/0x1a0
[   32.871639]  __x64_sys_bpf+0x3d8/0x510
[   32.875503]  ? bpf_prog_get+0x20/0x20
[   32.879286]  ? do_page_fault+0xf6/0x8c0
[   32.883241]  do_syscall_64+0x1b9/0x820
[   32.887109]  ? syscall_return_slowpath+0x5e0/0x5e0
[   32.892023]  ? syscall_return_slowpath+0x31d/0x5e0
[   32.896947]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   32.901944]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   32.907457]  ? prepare_exit_to_usermode+0x291/0x3b0
[   32.912451]  ? perf_trace_sys_enter+0xb10/0xb10
[   32.917097]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   32.921921]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   32.927094] RIP: 0033:0x4408d9
[   32.930259] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   32.949380] RSP: 002b:00007ffc68fa83b8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   32.957068] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9
[   32.964316] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a
[   32.971668] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8
[   32.978915] R10: 0000000002542880 R11: 0000000000000213 R12: 0000000000401da0
[   32.986170] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000
[   32.993421] 
[   32.995030] The buggy address belongs to the page:
[   32.999941] page:ffffea000700ffc0 count:0 mapcount:0 mapping:0000000000000000 index:0x1
[   33.008060] flags: 0x2fffc0000000000()
[   33.011928] raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000
[   33.019787] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[   33.027648] page dumped because: kasan: bad access detected
[   33.033329] 
[   33.034941] Memory state around the buggy address:
[   33.039848]  ffff8801c03ffe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.047183]  ffff8801c03fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.054519] >ffff8801c03fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.061856]                                                              ^
[   33.068847]  ffff8801c0400000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.076184]  ffff8801c0400080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.083524] ==================================================================
[   33.091039] Kernel panic - not syncing: panic_on_warn set ...
[   33.091039] 
[   33.098414] CPU: 0 PID: 4460 Comm: syz-executor649 Tainted: G    B             4.18.0-rc4-next-20180710+ #3
[   33.108281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   33.117628] Call Trace:
[   33.120201]  dump_stack+0x1c9/0x2b4
[   33.123808]  ? dump_stack_print_info.cold.2+0x52/0x52
[   33.128978]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   33.133715]  panic+0x238/0x4e7
[   33.136887]  ? add_taint.cold.5+0x16/0x16
[   33.141022]  ? do_raw_spin_unlock+0xa7/0x2f0
[   33.145423]  ? do_raw_spin_unlock+0xa7/0x2f0
[   33.149814]  ? _copy_to_user+0xe9/0x110
[   33.153774]  kasan_end_report+0x47/0x4f
[   33.157725]  kasan_report.cold.7+0x76/0x30d
[   33.162035]  check_memory_region+0x13e/0x1b0
[   33.166422]  kasan_check_read+0x11/0x20
[   33.170374]  _copy_to_user+0xe9/0x110
[   33.174154]  bpf_test_finish.isra.7+0xee/0x1f0
[   33.178716]  ? bpf_test_init.isra.8+0x100/0x100
[   33.183371]  ? bpf_test_run+0x1ea/0x3b0
[   33.187325]  ? bpf_test_run+0x2fc/0x3b0
[   33.191287]  bpf_prog_test_run_skb+0x7d7/0xa30
[   33.195849]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   33.200671]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   33.206191]  ? __bpf_prog_get+0x9b/0x290
[   33.210229]  ? bpf_test_finish.isra.7+0x1f0/0x1f0
[   33.215053]  bpf_prog_test_run+0x130/0x1a0
[   33.219268]  __x64_sys_bpf+0x3d8/0x510
[   33.223134]  ? bpf_prog_get+0x20/0x20
[   33.226916]  ? do_page_fault+0xf6/0x8c0
[   33.230868]  do_syscall_64+0x1b9/0x820
[   33.234744]  ? syscall_return_slowpath+0x5e0/0x5e0
[   33.239652]  ? syscall_return_slowpath+0x31d/0x5e0
[   33.244562]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   33.249564]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   33.255090]  ? prepare_exit_to_usermode+0x291/0x3b0
[   33.260086]  ? perf_trace_sys_enter+0xb10/0xb10
[   33.264739]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   33.269568]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   33.274737] RIP: 0033:0x4408d9
[   33.277900] Code: e8 4c b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 
[   33.297037] RSP: 002b:00007ffc68fa83b8 EFLAGS: 00000213 ORIG_RAX: 0000000000000141
[   33.304737] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004408d9
[   33.311990] RDX: 0000000000000028 RSI: 0000000020000140 RDI: 000000000000000a
[   33.319240] RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8
[   33.326503] R10: 0000000002542880 R11: 0000000000000213 R12: 0000000000401da0
[   33.333760] R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000
[   33.341515] Dumping ftrace buffer:
[   33.345037]    (ftrace buffer empty)
[   33.348721] Kernel Offset: disabled
[   33.352332] Rebooting in 86400 seconds..