[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.750648] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.268324] random: sshd: uninitialized urandom read (32 bytes read) [ 24.768856] random: sshd: uninitialized urandom read (32 bytes read) [ 25.533908] random: sshd: uninitialized urandom read (32 bytes read) [ 25.691681] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.43' (ECDSA) to the list of known hosts. [ 31.195745] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 31.297474] ------------[ cut here ]------------ [ 31.302376] Bad or missing usercopy whitelist? Kernel memory exposure attempt detected from SLAB object 'kvm_vcpu' (offset 23192, size 8)! [ 31.315178] WARNING: CPU: 0 PID: 4554 at mm/usercopy.c:81 usercopy_warn+0xf5/0x120 [ 31.322883] Kernel panic - not syncing: panic_on_warn set ... [ 31.322883] [ 31.330231] CPU: 0 PID: 4554 Comm: syz-executor726 Not tainted 4.17.0-rc5+ #58 [ 31.337573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.346907] Call Trace: [ 31.349482] dump_stack+0x1b9/0x294 [ 31.353095] ? dump_stack_print_info.cold.2+0x52/0x52 [ 31.358271] ? usercopy_warn+0xf0/0x120 [ 31.362226] panic+0x22f/0x4de [ 31.365400] ? add_taint.cold.5+0x16/0x16 [ 31.369535] ? __warn.cold.8+0x148/0x1b3 [ 31.373575] ? __warn.cold.8+0x117/0x1b3 [ 31.377620] ? usercopy_warn+0xf5/0x120 [ 31.381579] __warn.cold.8+0x163/0x1b3 [ 31.385454] ? usercopy_warn+0xf5/0x120 [ 31.389414] report_bug+0x252/0x2d0 [ 31.393028] do_error_trap+0x1de/0x490 [ 31.396898] ? math_error+0x420/0x420 [ 31.400685] ? vprintk_default+0x28/0x30 [ 31.404731] ? vprintk_func+0x81/0xe7 [ 31.408518] ? printk+0x9e/0xba [ 31.411785] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.416610] do_invalid_op+0x1b/0x20 [ 31.420305] invalid_op+0x14/0x20 [ 31.423741] RIP: 0010:usercopy_warn+0xf5/0x120 [ 31.428299] RSP: 0018:ffff8801ad54f0b0 EFLAGS: 00010286 [ 31.433645] RAX: 000000000000007e RBX: ffffffff889d52f0 RCX: ffffffff8160aa5d [ 31.440896] RDX: 0000000000000000 RSI: ffffffff8160f711 RDI: ffff8801ad54ec10 [ 31.448148] RBP: ffff8801ad54f110 R08: ffff8801d96c8680 R09: 0000000000000006 [ 31.455398] R10: ffff8801d96c8680 R11: 0000000000000000 R12: ffffffff87d2fa60 [ 31.462652] R13: ffffffff87c19ec0 R14: 0000000000000000 R15: 0000000000000008 [ 31.469921] ? console_unlock+0x8ad/0x1100 [ 31.474141] ? vprintk_func+0x81/0xe7 [ 31.477930] __check_heap_object+0x89/0xb5 [ 31.482150] __check_object_size+0x4c7/0x5d9 [ 31.486544] ? usercopy_warn+0x120/0x120 [ 31.490708] ? __might_sleep+0x95/0x190 [ 31.494678] __kvm_write_guest_page+0x90/0x140 [ 31.499244] kvm_vcpu_write_guest+0x65/0xe0 [ 31.503549] kvm_write_guest_virt_system+0x8a/0x190 [ 31.508547] ? vmx_vcpu_run+0xb16/0x25f0 [ 31.512595] handle_vmptrst+0x1d2/0x260 [ 31.516551] ? handle_vmclear+0x550/0x550 [ 31.520683] ? __lock_is_held+0xb5/0x140 [ 31.524726] ? __vmx_complete_interrupts+0x103/0x3e0 [ 31.529817] ? handle_vmclear+0x550/0x550 [ 31.533946] vmx_handle_exit+0x2c0/0x17b0 [ 31.538097] ? lock_acquire+0x1dc/0x520 [ 31.542055] ? vcpu_enter_guest+0x11f8/0x6060 [ 31.546533] ? vmx_save_host_state+0xa60/0xa60 [ 31.551100] ? handle_vmfunc+0x9c0/0x9c0 [ 31.555151] ? vcpu_enter_guest+0x119a/0x6060 [ 31.559633] vcpu_enter_guest+0x13af/0x6060 [ 31.563945] ? kasan_check_read+0x11/0x20 [ 31.568082] ? kvm_set_msr_common+0x2680/0x2680 [ 31.572734] ? vmx_vcpu_load+0xadd/0xfe0 [ 31.576779] ? find_held_lock+0x36/0x1c0 [ 31.580824] ? vmx_vcpu_reset+0x1030/0x1030 [ 31.585127] ? graph_lock+0x170/0x170 [ 31.588912] ? graph_lock+0x170/0x170 [ 31.592696] ? lock_downgrade+0x8e0/0x8e0 [ 31.596829] ? __kasan_slab_free+0x11a/0x170 [ 31.601218] ? kasan_slab_free+0xe/0x10 [ 31.605174] ? kfree+0xd9/0x260 [ 31.608436] ? kvm_vcpu_ioctl+0xb26/0x12e0 [ 31.612653] ? do_vfs_ioctl+0x1cf/0x16a0 [ 31.616700] ? __lock_is_held+0xb5/0x140 [ 31.620744] ? lock_acquire+0x1dc/0x520 [ 31.624700] ? kvm_check_async_pf_completion+0x39b/0x5a0 [ 31.630143] ? kvm_clear_async_pf_completion_queue+0x780/0x780 [ 31.636109] ? kvm_arch_dev_ioctl+0x5f0/0x5f0 [ 31.640621] ? preempt_notifier_dec+0x20/0x20 [ 31.645110] kvm_arch_vcpu_ioctl_run+0x33e/0x1690 [ 31.649937] ? kvm_arch_vcpu_ioctl_run+0x33e/0x1690 [ 31.654943] kvm_vcpu_ioctl+0x79d/0x12e0 [ 31.658989] ? kvm_uevent_notify_change.part.29+0x440/0x440 [ 31.664690] ? kasan_check_read+0x11/0x20 [ 31.668859] ? do_raw_spin_unlock+0x9e/0x2e0 [ 31.673293] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 31.677902] ? add_mm_counter_fast+0xd0/0xd0 [ 31.682329] ? lock_downgrade+0x8e0/0x8e0 [ 31.686470] ? _raw_spin_unlock+0x22/0x30 [ 31.690601] ? __handle_mm_fault+0x93a/0x4310 [ 31.695083] ? vm_insert_mixed_mkwrite+0x40/0x40 [ 31.699820] ? graph_lock+0x170/0x170 [ 31.703604] ? rcu_is_watching+0x85/0x140 [ 31.707731] ? graph_lock+0x170/0x170 [ 31.711513] ? find_held_lock+0x36/0x1c0 [ 31.715560] ? find_held_lock+0x36/0x1c0 [ 31.719616] ? lock_downgrade+0x8e0/0x8e0 [ 31.723759] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 31.728934] ? kvm_uevent_notify_change.part.29+0x440/0x440 [ 31.734630] do_vfs_ioctl+0x1cf/0x16a0 [ 31.738502] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 31.744034] ? ioctl_preallocate+0x2e0/0x2e0 [ 31.748430] ? fget_raw+0x20/0x20 [ 31.751868] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.757398] ? __do_page_fault+0x441/0xe40 [ 31.761618] ? mm_fault_error+0x380/0x380 [ 31.765747] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 31.771268] ? security_file_ioctl+0x94/0xc0 [ 31.775661] ksys_ioctl+0xa9/0xd0 [ 31.779101] __x64_sys_ioctl+0x73/0xb0 [ 31.782972] do_syscall_64+0x1b1/0x800 [ 31.786843] ? syscall_return_slowpath+0x5c0/0x5c0 [ 31.791755] ? syscall_return_slowpath+0x30f/0x5c0 [ 31.796668] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 31.802023] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.806942] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.812122] RIP: 0033:0x443039 [ 31.815291] RSP: 002b:00007ffc272242b8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010 [ 31.822981] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000443039 [ 31.830230] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 31.837482] RBP: 00000000006cd018 R08: 0000000020000580 R09: 0000000020000580 [ 31.844732] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000404080 [ 31.851980] R13: 0000000000404110 R14: 0000000000000000 R15: 0000000000000000 [ 31.859890] Dumping ftrace buffer: [ 31.863565] (ftrace buffer empty) [ 31.867256] Kernel Offset: disabled [ 31.870866] Rebooting in 86400 seconds..