[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.622287] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.865473] random: sshd: uninitialized urandom read (32 bytes read) [ 25.193695] random: sshd: uninitialized urandom read (32 bytes read) [ 26.085538] random: sshd: uninitialized urandom read (32 bytes read) [ 26.244690] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.21' (ECDSA) to the list of known hosts. [ 31.701077] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 31.799391] IPVS: ftp: loaded support on port[0] = 21 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 46.309275] ================================================================== [ 46.316775] BUG: KASAN: use-after-free in p9_poll_workfn+0x660/0x6d0 [ 46.323252] Read of size 4 at addr ffff8801bfdbc844 by task kworker/1:0/19 [ 46.330244] [ 46.331865] CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 4.18.0-rc5+ #159 [ 46.338770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 46.348629] Workqueue: events p9_poll_workfn [ 46.353025] Call Trace: [ 46.355605] dump_stack+0x1c9/0x2b4 [ 46.359222] ? dump_stack_print_info.cold.2+0x52/0x52 [ 46.364432] ? printk+0xa7/0xcf [ 46.367705] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 46.372481] ? p9_poll_workfn+0x660/0x6d0 [ 46.376663] print_address_description+0x6c/0x20b [ 46.381520] ? p9_poll_workfn+0x660/0x6d0 [ 46.385660] kasan_report.cold.7+0x242/0x2fe [ 46.390052] __asan_report_load4_noabort+0x14/0x20 [ 46.394973] p9_poll_workfn+0x660/0x6d0 [ 46.398956] ? p9_read_work+0x1060/0x1060 [ 46.403093] ? graph_lock+0x170/0x170 [ 46.406883] ? lock_acquire+0x1e4/0x540 [ 46.410863] ? process_one_work+0xb9b/0x1ba0 [ 46.415295] ? kasan_check_read+0x11/0x20 [ 46.419433] ? __lock_is_held+0xb5/0x140 [ 46.423497] process_one_work+0xc73/0x1ba0 [ 46.427814] ? trace_hardirqs_on+0x10/0x10 [ 46.432046] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 46.436707] ? lock_repin_lock+0x430/0x430 [ 46.440946] ? __sched_text_start+0x8/0x8 [ 46.445079] ? graph_lock+0x170/0x170 [ 46.448864] ? lock_downgrade+0x8f0/0x8f0 [ 46.453000] ? kasan_check_read+0x11/0x20 [ 46.457134] ? do_raw_spin_unlock+0xa7/0x2f0 [ 46.461538] ? lock_acquire+0x1e4/0x540 [ 46.465495] ? worker_thread+0x3dc/0x13c0 [ 46.469642] ? lock_downgrade+0x8f0/0x8f0 [ 46.473787] ? lock_release+0xa30/0xa30 [ 46.477753] ? kasan_check_read+0x11/0x20 [ 46.481890] ? do_raw_spin_unlock+0xa7/0x2f0 [ 46.486281] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 46.490846] ? kasan_check_write+0x14/0x20 [ 46.495069] ? do_raw_spin_lock+0xc1/0x200 [ 46.499300] worker_thread+0x189/0x13c0 [ 46.503271] ? process_one_work+0x1ba0/0x1ba0 [ 46.507752] ? graph_lock+0x170/0x170 [ 46.511626] ? graph_lock+0x170/0x170 [ 46.515405] ? find_held_lock+0x36/0x1c0 [ 46.519466] ? find_held_lock+0x36/0x1c0 [ 46.523512] ? lock_downgrade+0x8f0/0x8f0 [ 46.527729] ? kasan_check_read+0x11/0x20 [ 46.531854] ? do_raw_spin_unlock+0xa7/0x2f0 [ 46.536261] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 46.541434] ? __kthread_parkme+0x58/0x1b0 [ 46.545664] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 46.550664] ? trace_hardirqs_on+0xd/0x10 [ 46.554809] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 46.560372] ? __kthread_parkme+0x106/0x1b0 [ 46.564702] kthread+0x345/0x410 [ 46.568055] ? process_one_work+0x1ba0/0x1ba0 [ 46.572532] ? kthread_bind+0x40/0x40 [ 46.576330] ret_from_fork+0x3a/0x50 [ 46.580121] [ 46.581729] Allocated by task 5408: [ 46.585359] save_stack+0x43/0xd0 [ 46.588801] kasan_kmalloc+0xc4/0xe0 [ 46.592523] kmem_cache_alloc_trace+0x152/0x780 [ 46.597198] p9_fd_create+0x1a7/0x3f0 [ 46.600982] p9_client_create+0x8ed/0x1770 [ 46.605217] v9fs_session_init+0x21a/0x1a80 [ 46.609528] v9fs_mount+0x7c/0x900 [ 46.613047] mount_fs+0xae/0x328 [ 46.616398] vfs_kern_mount.part.34+0xdc/0x4e0 [ 46.620957] do_mount+0x581/0x30e0 [ 46.624477] ksys_mount+0x12d/0x140 [ 46.628087] __x64_sys_mount+0xbe/0x150 [ 46.632046] do_syscall_64+0x1b9/0x820 [ 46.635936] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 46.641111] [ 46.642721] Freed by task 5408: [ 46.646005] save_stack+0x43/0xd0 [ 46.649454] __kasan_slab_free+0x11a/0x170 [ 46.653901] kasan_slab_free+0xe/0x10 [ 46.657683] kfree+0xd9/0x260 [