random: sshd: uninitialized urandom read (32 bytes read, 114 bits of entropy available)
==================================================================
BUG: KASAN: slab-out-of-bounds in list_empty include/linux/list.h:189 [inline]
BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130
Read of size 8 at addr ffff8801d1df4140 by task syzkaller382263/3325

CPU: 0 PID: 3325 Comm: syzkaller382263 Not tainted 4.4.111-g3301b55 #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 f69e5953fe26df0e ffff8801d1f2fab0 ffffffff81d0509d
 ffffea0007477d00 ffff8801d1df4140 0000000000000000 ffff8801d1df4140
 ffff8801d125c438 ffff8801d1f2fae8 ffffffff814fd433 ffff8801d1df4140
Call Trace:
 [<ffffffff81d0509d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0509d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fd433>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fd945>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fd945>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fdaa4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff825b9d09>] list_empty include/linux/list.h:189 [inline]
 [<ffffffff825b9d09>] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130
 [<ffffffff825ba285>] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1848
 [<ffffffff825bc0c1>] sg_read+0xa21/0x1490 drivers/scsi/sg.c:538
 [<ffffffff8151c383>] __vfs_read+0x103/0x440 fs/read_write.c:432
 [<ffffffff8151e223>] vfs_read+0x123/0x3a0 fs/read_write.c:454
 [<ffffffff81520b69>] SYSC_read fs/read_write.c:569 [inline]
 [<ffffffff81520b69>] SyS_read+0xd9/0x1b0 fs/read_write.c:562
 [<ffffffff83775899>] entry_SYSCALL_64_fastpath+0x16/0x92

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801d1df4100
 which belongs to the cache fasync_cache of size 96
The buggy address is located 64 bytes inside of
 96-byte region [ffff8801d1df4100, ffff8801d1df4160)
The buggy address belongs to the page:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 0 at lib/list_debug.c:59 __list_del_entry+0x14f/0x1d0 lib/list_debug.c:57()
list_del corruption. prev->next should be ffff8801d1d247c8, but was ffff8801d1d24850
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.111-g3301b55 #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 57a78308be5a364d ffff8801db307970 ffffffff81d0509d
 ffffffff83842f60 ffff8801db307a48 ffffffff839fdaa0 0000000000000009
 000000000000003b ffff8801db307a38 ffffffff81419a3a 0000000041b58ab3
Call Trace:
 <IRQ>  [<ffffffff81d0509d>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81d0509d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81419a3a>] panic+0x1aa/0x388 kernel/panic.c:112
 [<ffffffff8112d7c5>] warn_slowpath_common+0x125/0x140 kernel/panic.c:455
 [<ffffffff8112d8a1>] warn_slowpath_fmt+0xc1/0x110 kernel/panic.c:471
 [<ffffffff81d653af>] __list_del_entry+0x14f/0x1d0 lib/list_debug.c:57
 [<ffffffff811fdd7a>] list_move_tail include/linux/list.h:168 [inline]
 [<ffffffff811fdd7a>] detach_tasks kernel/sched/fair.c:7633 [inline]
 [<ffffffff811fdd7a>] load_balance+0xc2a/0x2c90 kernel/sched/fair.c:9029
 [<ffffffff812025f8>] rebalance_domains+0x5f8/0xb00 kernel/sched/fair.c:9647
 [<ffffffff81202e36>] run_rebalance_domains+0x336/0x4e0 kernel/sched/fair.c:9863
 [<ffffffff83778dbd>] __do_softirq+0x24d/0xa59 kernel/softirq.c:273
 [<ffffffff8113da09>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff8113da09>] irq_exit+0x119/0x140 kernel/softirq.c:391
 [<ffffffff837784fb>] exiting_irq arch/x86/include/asm/apic.h:653 [inline]
 [<ffffffff837784fb>] smp_apic_timer_interrupt+0x7b/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff83777450>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:725
 <EOI>  [<ffffffff810d0526>] ? native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:49
 [<ffffffff81027e15>] arch_safe_halt arch/x86/include/asm/paravirt.h:117 [inline]
 [<ffffffff81027e15>] default_idle+0x55/0x3c0 arch/x86/kernel/process.c:291
 [<ffffffff8102938a>] arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:282
 [<ffffffff81220508>] default_idle_call+0x48/0x70 kernel/sched/idle.c:93
 [<ffffffff81220c15>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
 [<ffffffff81220c15>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
 [<ffffffff81220c15>] cpu_startup_entry+0x605/0x820 kernel/sched/idle.c:301
 [<ffffffff810ad7a4>] start_secondary+0x304/0x3e0 arch/x86/kernel/smpboot.c:242
Shutting down cpus with NMI
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..