[ 16.823004] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.931385] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 21.374511] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 22.307299] random: sshd: uninitialized urandom read (32 bytes read, 109 bits of entropy available) [ 22.482997] random: sshd: uninitialized urandom read (32 bytes read, 115 bits of entropy available) Warning: Permanently added '10.128.0.47' (ECDSA) to the list of known hosts. [ 27.860957] random: sshd: uninitialized urandom read (32 bytes read, 123 bits of entropy available) executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 28.138336] ================================================================== [ 28.145724] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 [ 28.152711] Read of size 8 at addr ffff8801d30b0cc0 by task syzkaller320196/3319 [ 28.160216] [ 28.161823] CPU: 0 PID: 3319 Comm: syzkaller320196 Not tainted 4.4.113-gef588ef #33 [ 28.169596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.178922] 0000000000000000 c1b8670818685851 ffff8801d00bf9f0 ffffffff81d0278d [ 28.186899] ffffea00074c2c00 ffff8801d30b0cc0 0000000000000000 ffff8801d30b0cc0 [ 28.194876] ffff8801cc6b0238 ffff8801d00bfa28 ffffffff814fd053 ffff8801d30b0cc0 [ 28.202852] Call Trace: [ 28.205420] [] dump_stack+0xc1/0x124 [ 28.210758] [] print_address_description+0x73/0x260 [ 28.217395] [] kasan_report+0x285/0x370 [ 28.222992] [] ? sg_remove_request+0xf9/0x110 [ 28.229114] [] __asan_report_load8_noabort+0x14/0x20 [ 28.235847] [] sg_remove_request+0xf9/0x110 [ 28.241791] [] sg_finish_rem_req+0x295/0x340 [ 28.247821] [] sg_read+0xa1b/0x1490 [ 28.253079] [] ? __check_object_size+0x154/0x35b [ 28.259457] [] ? sg_proc_seq_show_debug+0xda0/0xda0 [ 28.266096] [] ? fsnotify+0xee0/0xee0 [ 28.271531] [] ? avc_policy_seqno+0x9/0x20 [ 28.277391] [] do_loop_readv_writev+0x141/0x1e0 [ 28.283682] [] ? security_file_permission+0x89/0x1e0 [ 28.290408] [] ? sg_proc_seq_show_debug+0xda0/0xda0 [ 28.297048] [] ? sg_proc_seq_show_debug+0xda0/0xda0 [ 28.303694] [] do_readv_writev+0x5dd/0x6e0 [ 28.309550] [] ? vfs_write+0x530/0x530 [ 28.315063] [] ? _raw_spin_unlock+0x2c/0x50 [ 28.321007] [] ? do_huge_pmd_anonymous_page+0x3dd/0xa10 [ 28.327992] [] ? __fget+0x20b/0x3b0 [ 28.333239] [] ? __fget+0x232/0x3b0 [ 28.338489] [] ? __fget+0x47/0x3b0 [ 28.343659] [] vfs_readv+0x78/0xb0 [ 28.348818] [] SyS_readv+0xd9/0x240 [ 28.354066] [] ? rw_copy_check_uvector+0x2b0/0x2b0 [ 28.360619] [] ? trace_hardirqs_on_thunk+0x17/0x19 [ 28.367192] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 28.373742] [ 28.375343] Allocated by task 0: [ 28.378684] (stack is not available) [ 28.382367] [ 28.383967] Freed by task 0: [ 28.386950] (stack is not available) [ 28.390630] [ 28.392227] The buggy address belongs to the object at ffff8801d30b0c80 [ 28.392227] which belongs to the cache fasync_cache of size 96 [ 28.404862] The buggy address is located 64 bytes inside of [ 28.404862] 96-byte region [ffff8801d30b0c80, ffff8801d30b0ce0) [ 28.416967] The buggy address belongs to the page: [ 30.117159] PANIC: double fault, error_code: 0x0 [ 30.121960] CPU: 0 PID: 3319 Comm: syzkaller320196 Not tainted 4.4.113-gef588ef #33 [ 30.129811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.139137] task: ffff8801d15f2f80 task.stack: ffff8801d00b8000 [ 30.145164] RIP: 0010:[] [] dump_page_badflags+0x8/0x250 [ 30.153934] RSP: 0018:ffff880100000000 EFLAGS: 00010046 [ 30.159353] RAX: ffff8801d15f2f80 RBX: ffffea00074c2c00 RCX: ffffffff8148f8d0 [ 30.166596] RDX: 0000000000000000 RSI: ffffffff838a8de0 RDI: ffffea00074c2c00 [ 30.173846] RBP: ffff880100000010 R08: 0000000000000001 R09: 0000000000000000 [ 30.181085] R10: 0000000000000002 R11: fffffbfff0ad7e26 R12: 0000000000000000 [ 30.188334] R13: ffffffff838a8de0 R14: 0000000000000000 R15: 0000000000000000 [ 30.195578] FS: 00007fce131cb700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 30.203785] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.209636] CR2: ffff8800fffffff8 CR3: 00000000bbbd4000 CR4: 0000000000160670 [ 30.216879] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.224119] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.231362] Stack: [ 30.233479] [ 30.235075] Call Trace: [ 30.237625] [ 30.239663] Code: 00 e9 83 fd ff ff e8 78 df 06 00 e9 50 fd ff ff e8 6e df 06 00 e9 1d fd ff ff 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 <41> 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec 08 e8 b1 04 [ 30.266747] Kernel panic - not syncing: Machine halted. [ 30.272083] CPU: 0 PID: 3319 Comm: syzkaller320196 Not tainted 4.4.113-gef588ef #33 [ 30.279847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.289172] 0000000000000000 c1b8670818685851 ffff8801db20ce38 ffffffff81d0278d [ 30.297148] ffffffff83837200 ffff8801db20cf10 ffffffff83808040 ffff880100000000 [ 30.305127] 0000000000000000 ffff8801db20cf00 ffffffff81419b6a 0000000041b58ab3 [ 30.313097] Call Trace: [ 30.315653] <#DF> [] dump_stack+0xc1/0x124 [ 30.321725] [] panic+0x1aa/0x388 [ 30.326713] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 30.333613] [] ? vprintk_emit+0x242/0x850 [ 30.339383] [] ? dump_page_badflags+0x1d/0x250 [ 30.345585] [] ? vprintk_emit+0x242/0x850 [ 30.351356] [] df_debug+0x2d/0x30 [ 30.356433] [] do_double_fault+0x10b/0x210 [ 30.362288] [] double_fault+0x2d/0x40 [ 30.367720] [] ? dump_page_badflags+0x180/0x250 [ 30.374021] [] ? dump_page_badflags+0x8/0x250 [ 30.380134] <> [ 30.383628] Dumping ftrace buffer: [ 30.387479] (ftrace buffer empty) [ 30.391162] Kernel Offset: disabled [ 30.394767] Rebooting in 86400 seconds..