random: sshd: uninitialized urandom read (32 bytes read, 119 bits of entropy available)
==================================================================
BUG: KASAN: slab-out-of-bounds in list_empty include/linux/list.h:189 [inline]
BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130
Read of size 8 at addr ffff8800b4604140 by task syzkaller854528/3316

CPU: 0 PID: 3316 Comm: syzkaller854528 Not tainted 4.4.112-g3fc4284 #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 dc43c4f23e398565 ffff8801cd60f9f0 ffffffff81d054ed
 ffffea0002d18100 ffff8800b4604140 0000000000000000 ffff8800b4604140
 ffff8800b4168238 ffff8801cd60fa28 ffffffff814fd953 ffff8800b4604140
Call Trace:
 [<ffffffff81d054ed>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d054ed>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fd953>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fde65>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fde65>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fdfc4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff825ba2c9>] list_empty include/linux/list.h:189 [inline]
 [<ffffffff825ba2c9>] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130
 [<ffffffff825ba845>] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1848
 [<ffffffff825bc681>] sg_read+0xa21/0x1490 drivers/scsi/sg.c:538
 [<ffffffff8151d171>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:680
 [<ffffffff8151f4cd>] do_readv_writev+0x5dd/0x6e0 fs/read_write.c:810
 [<ffffffff8151f648>] vfs_readv+0x78/0xb0 fs/read_write.c:834
 [<ffffffff81521999>] SYSC_readv fs/read_write.c:860 [inline]
 [<ffffffff81521999>] SyS_readv+0xd9/0x240 fs/read_write.c:852
 [<ffffffff837761d9>] entry_SYSCALL_64_fastpath+0x16/0x92

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8800b4604100
 which belongs to the cache fasync_cache of size 96
The buggy address is located 64 bytes inside of
 96-byte region [ffff8800b4604100, ffff8800b4604160)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
BUG: unable to handle kernel paging request at fffffffdef82a740
IP: [<ffffffff8122a565>] cpuacct_charge+0x155/0x390 kernel/sched/cpuacct.c:247
PGD 420f067 PUD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3318 Comm: getty Not tainted 4.4.112-g3fc4284 #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d2284740 task.stack: ffff8800b41e8000
RIP: 0010:[<ffffffff8122a565>]  [<ffffffff8122a565>] cpuacct_charge+0x155/0x390 kernel/sched/cpuacct.c:247
RSP: 0018:ffff8801db307a20  EFLAGS: 00010046
RAX: 1ffffffff0854dff RBX: 0000000000018528 RCX: ffffffff847ea4c0
RDX: fffffbffbdf054e8 RSI: fffffffdef82a740 RDI: ffffffff842a6ff8
RBP: ffff8801db307a68 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed0043fffa09 R11: 0000000000000000 R12: ffffffff842a6f20
R13: dffffc0000000000 R14: 00000000108ced2f R15: ffffffffcd608050
FS:  00007f22e542a700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffdef82a740 CR3: 00000000b5538000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8122a470 ffffffff81d49b1e 0000000000000000 ffff8801db307a78
 ffff8801d22e5f60 ffffffff83843ba0 00000000108ced2f ffff8801d22e5fb0
 ffff8801d22e5f00 ffff8801db307ab8 ffffffff811dc087 ffff8801db21f4c0
Call Trace:
 [<ffffffff811dc087>] update_curr+0x2c7/0x6c0 kernel/sched/fair.c:882
 [<ffffffff811e4213>] enqueue_entity kernel/sched/fair.c:3511 [inline]
 [<ffffffff811e4213>] enqueue_task_fair+0x313/0x2940 kernel/sched/fair.c:4694
 [<ffffffff811bba38>] enqueue_task kernel/sched/core.c:856 [inline]
 [<ffffffff811bba38>] activate_task+0x148/0x270 kernel/sched/core.c:872
 [<ffffffff811bc9df>] ttwu_activate kernel/sched/core.c:1734 [inline]
 [<ffffffff811bc9df>] ttwu_do_activate.constprop.131+0xbf/0x1e0 kernel/sched/core.c:1787
 [<ffffffff811bfdad>] ttwu_queue kernel/sched/core.c:1932 [inline]
 [<ffffffff811bfdad>] try_to_wake_up+0x68d/0xf60 kernel/sched/core.c:2066
 [<ffffffff811c0805>] default_wake_function+0x35/0x50 kernel/sched/core.c:3490
 [<ffffffff8121fc53>] autoremove_wake_function+0x13/0x90 kernel/sched/wait.c:293
 [<ffffffff8121e7a4>] __wake_up_common+0xb4/0x150 kernel/sched/wait.c:73
 [<ffffffff8121e874>] __wake_up+0x34/0x50 kernel/sched/wait.c:95
 [<ffffffff8126af56>] wake_up_klogd_work_func+0x56/0x80 kernel/printk/printk.c:2736
 [<ffffffff813e4d7a>] irq_work_run_list+0xca/0x140 kernel/irq_work.c:156
 [<ffffffff813e53de>] irq_work_tick+0x10e/0x170 kernel/irq_work.c:182
 [<ffffffff812aa192>] update_process_times+0x52/0x70 kernel/time/timer.c:1423
 [<ffffffff812d47a5>] tick_sched_handle.isra.16+0x55/0xf0 kernel/time/tick-sched.c:151
 [<ffffffff812d60c2>] tick_sched_timer+0x72/0x120 kernel/time/tick-sched.c:1097
 [<ffffffff812ac976>] __run_hrtimer kernel/time/hrtimer.c:1253 [inline]
 [<ffffffff812ac976>] __hrtimer_run_queues+0x306/0xfe0 kernel/time/hrtimer.c:1317
 [<ffffffff812aee46>] hrtimer_interrupt+0x1a6/0x440 kernel/time/hrtimer.c:1351
 [<ffffffff810b0dda>] local_apic_timer_interrupt+0x6a/0xb0 arch/x86/kernel/apic/apic.c:901
 [<ffffffff83778e36>] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:925
 [<ffffffff83777d90>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:725
 <EOI> [   28.027842]  [<ffffffff81268de0>] ? console_cont_flush kernel/printk/printk.c:2217 [inline]
 <EOI> [   28.027842]  [<ffffffff81268de0>] ? console_unlock+0x790/0xa00 kernel/printk/printk.c:2265
 [<ffffffff812695ae>] vprintk_emit+0x55e/0x850 kernel/printk/printk.c:1832
 [<ffffffff812698c8>] vprintk+0x28/0x30 kernel/printk/printk.c:1843
 [<ffffffff812698ed>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844
 [<ffffffff8141aa1d>] printk+0xb7/0xe2 kernel/printk/printk.c:1922
 [<ffffffff810f0d21>] kasan_die_handler+0x31/0x40 arch/x86/mm/kasan_init_64.c:58
 [<ffffffff81194255>] notifier_call_chain+0x95/0x1b0 kernel/notifier.c:93
 [<ffffffff8119587b>] __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
 [<ffffffff8119587b>] atomic_notifier_call_chain+0x7b/0x140 kernel/notifier.c:193
 [<ffffffff81195a1f>] notify_die+0xdf/0x160 kernel/notifier.c:549
 [<ffffffff81011fa7>] do_general_protection+0x2f7/0x390 arch/x86/kernel/traps.c:461
 [<ffffffff837775a8>] general_protection+0x28/0x30 arch/x86/entry/entry_64.S:1020
 [<ffffffff8148e7fa>] list_del_init include/linux/list.h:145 [inline]
 [<ffffffff8148e7fa>] list_lru_del+0x6a/0x170 mm/list_lru.c:138
 [<ffffffff81572350>] inode_lru_list_del fs/inode.c:417 [inline]
 [<ffffffff81572350>] iput_final fs/inode.c:1474 [inline]
 [<ffffffff81572350>] iput+0x480/0x960 fs/inode.c:1504
 [<ffffffff81563ddc>] dentry_iput fs/dcache.c:372 [inline]
 [<ffffffff81563ddc>] __dentry_kill+0x51c/0x620 fs/dcache.c:559
 [<ffffffff81568128>] dentry_kill fs/dcache.c:603 [inline]
 [<ffffffff81568128>] dput.part.19+0x638/0x760 fs/dcache.c:813
 [<ffffffff8156826f>] dput+0x1f/0x30 fs/dcache.c:777
 [<ffffffff81523171>] __fput+0x411/0x6d0 fs/file_table.c:226
 [<ffffffff815234b5>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8118bb54>] task_work_run+0x104/0x180 kernel/task_work.c:115
 [<ffffffff81003625>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff81003625>] exit_to_usermode_loop+0x145/0x170 arch/x86/entry/common.c:251
 [<ffffffff81006545>] prepare_exit_to_usermode arch/x86/entry/common.c:282 [inline]
 [<ffffffff81006545>] syscall_return_slowpath+0x1b5/0x1f0 arch/x86/entry/common.c:347
 [<ffffffff8377635d>] int_ret_from_sys_call+0x25/0xa3
Code: 49 8d bc 24 d8 00 00 00 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 9e 01 00 00 49 8b 9c 24 d8 00 00 00 80 3a 00 0f 85 0a 02 00 00 <4a> 03 1c f9 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 cf 01 00 
RIP  [<ffffffff8122a565>] cpuacct_charge+0x155/0x390 kernel/sched/cpuacct.c:247
 RSP <ffff8801db307a20>
CR2: fffffffdef82a740
---[ end trace b95b1b3eca16b682 ]---