random: sshd: uninitialized urandom read (32 bytes read, 115 bits of entropy available)
==================================================================
BUG: KASAN: slab-out-of-bounds in list_empty include/linux/list.h:189 [inline]
BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2120
Read of size 8 at addr ffff8801d25a3140 by task syzkaller844979/3308

CPU: 1 PID: 3308 Comm: syzkaller844979 Not tainted 4.4.113-ge70c132 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 5eecf77f16fc3b54 ffff8801ccdd79f0 ffffffff81d0278d
 ffffea00074968c0 ffff8801d25a3140 0000000000000000 ffff8801d25a3140
 ffff8800b4a2c438 ffff8801ccdd7a28 ffffffff814fd053 ffff8801d25a3140
Call Trace:
 [<ffffffff81d0278d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0278d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fd053>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fd565>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fd565>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fd6c4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff825b6d79>] list_empty include/linux/list.h:189 [inline]
 [<ffffffff825b6d79>] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2120
 [<ffffffff825b72f5>] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1837
 [<ffffffff825b919b>] sg_read+0xa1b/0x1490 drivers/scsi/sg.c:537
 [<ffffffff8151c561>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:680
 [<ffffffff8151e8bd>] do_readv_writev+0x5dd/0x6e0 fs/read_write.c:810
 [<ffffffff8151ea38>] vfs_readv+0x78/0xb0 fs/read_write.c:834
 [<ffffffff81520d69>] SYSC_readv fs/read_write.c:860 [inline]
 [<ffffffff81520d69>] SyS_readv+0xd9/0x240 fs/read_write.c:852
 [<ffffffff83771b5f>] entry_SYSCALL_64_fastpath+0x1c/0x98

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801d25a3100
 which belongs to the cache fasync_cache of size 96
The buggy address is located 64 bytes inside of
 96-byte region [ffff8801d25a3100, ffff8801d25a3160)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: CONFIG_KASAN_INLINE enabledkasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3309 Comm: init Not tainted 4.4.113-ge70c132 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800b5082f80 task.stack: ffff8801d0820000
RIP: 0010:[<ffffffff810ebd4b>]  [<ffffffff810ebd4b>] write_cr3 arch/x86/include/asm/paravirt.h:86 [inline]
RIP: 0010:[<ffffffff810ebd4b>]  [<ffffffff810ebd4b>] load_new_mm_cr3+0x5b/0xa0 arch/x86/mm/tlb.c:65
RSP: 0018:ffff8801d0827420  EFLAGS: 00010093
RAX: ffff8800b5082f80 RBX: 0000780000000000 RCX: ffffffff810f0d8e
RDX: 0000000000000000 RSI: ffffffff839fe320 RDI: 0000780000000000
RBP: ffff8801d0827428 R08: ffffffff83844340 R09: 0000000000000001
R10: ffff8801d37d0274 R11: 0000000000000001 R12: ffff8801d0801e00
R13: 0000000000000000 R14: ffff8800b50833c0 R15: 0000000667274e49
FS:  00007fa3d859a7a0(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc0db10d28 CR3: 00000001d08b2000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801ccd74a00 ffff8801d0827478 ffffffff810ec97c ffff8801db21f4c0
 ffff8800b50835c0 ccd88cfff7ebdbca ffff8801db21f4c0 ffff8801d0801e00
 ffff8801ccd74a00 ffff8800b50833c0 0000000667274e49 ffff8801d0827500
Call Trace:
 [<ffffffff810ec97c>] switch_mm_irqs_off+0x6c/0xc30 arch/x86/mm/tlb.c:139
 [<ffffffff8376259e>] context_switch kernel/sched/core.c:2784 [inline]
 [<ffffffff8376259e>] __schedule+0x9ee/0x1c70 kernel/sched/core.c:3322
 [<ffffffff83763842>] preempt_schedule_common+0x22/0x60 kernel/sched/core.c:3392
 [<ffffffff837638a5>] preempt_schedule+0x25/0x30 kernel/sched/core.c:3417
 [<ffffffff81003058>] ___preempt_schedule+0x12/0x14
 [<ffffffff81269878>] vprintk+0x28/0x30 kernel/printk/printk.c:1843
 [<ffffffff8126989d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844
 [<ffffffff8141a7bd>] printk+0xb7/0xe2 kernel/printk/printk.c:1922
 [<ffffffff810f0d51>] kasan_die_handler+0x31/0x40 arch/x86/mm/kasan_init_64.c:58
 [<ffffffff81194075>] notifier_call_chain+0x95/0x1b0 kernel/notifier.c:93
 [<ffffffff8119569b>] __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
 [<ffffffff8119569b>] atomic_notifier_call_chain+0x7b/0x140 kernel/notifier.c:193
 [<ffffffff8119583f>] notify_die+0xdf/0x160 kernel/notifier.c:549
 [<ffffffff81011fa7>] do_general_protection+0x2f7/0x390 arch/x86/kernel/traps.c:461
 [<ffffffff83772f28>] general_protection+0x28/0x30 arch/x86/entry/entry_64.S:1032
 [<ffffffff81d11252>] radix_tree_lookup_slot+0x72/0xc0 lib/radix-tree.c:555
 [<ffffffff8141fcbe>] find_get_entry+0x8e/0x340 mm/filemap.c:1048
 [<ffffffff8141ff9b>] find_lock_entry+0x2b/0x110 mm/filemap.c:1104
 [<ffffffff81467cf2>] shmem_getpage_gfp+0x142/0x11b0 mm/shmem.c:1071
 [<ffffffff8146cac0>] shmem_getpage mm/shmem.c:130 [inline]
 [<ffffffff8146cac0>] shmem_file_read_iter+0x440/0x850 mm/shmem.c:1573
 [<ffffffff8151bec9>] new_sync_read fs/read_write.c:422 [inline]
 [<ffffffff8151bec9>] __vfs_read+0x339/0x440 fs/read_write.c:434
 [<ffffffff8151db33>] vfs_read+0x123/0x3a0 fs/read_write.c:454
 [<ffffffff81520479>] SYSC_read fs/read_write.c:569 [inline]
 [<ffffffff81520479>] SyS_read+0xd9/0x1b0 fs/read_write.c:562
 [<ffffffff83771b5f>] entry_SYSCALL_64_fastpath+0x1c/0x98
Code: 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1c 8b 05 91 fd 6f 03 85 c0 74 05 e8 18 50 00 00 48 89 df <0f> 22 df 0f 1f 40 00 5b 5d c3 e8 36 19 41 00 eb dd 48 c7 c7 10 
RIP  [<ffffffff810ebd4b>] write_cr3 arch/x86/include/asm/paravirt.h:86 [inline]
RIP  [<ffffffff810ebd4b>] load_new_mm_cr3+0x5b/0xa0 arch/x86/mm/tlb.c:65
 RSP <ffff8801d0827420>
---[ end trace 58014a07b45e92d0 ]---