random: sshd: uninitialized urandom read (32 bytes read, 119 bits of entropy available)
==================================================================
BUG: KASAN: slab-out-of-bounds in list_empty include/linux/list.h:189 [inline]
BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130
Read of size 8 at addr ffff8800b633a140 by task syzkaller835797/3324

CPU: 1 PID: 3324 Comm: syzkaller835797 Not tainted 4.4.111-gc2f631b #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 e48a30e942bc739d ffff8801d02c7970 ffffffff81d0513d
 ffffea0002d8ce80 ffff8800b633a140 0000000000000000 ffff8800b633a140
 ffff8801d0360238 ffff8801d02c79a8 ffffffff814fd433 ffff8800b633a140
Call Trace:
 [<ffffffff81d0513d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0513d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fd433>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fd945>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fd945>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fdaa4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff825b9da9>] list_empty include/linux/list.h:189 [inline]
 [<ffffffff825b9da9>] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130
 [<ffffffff825ba325>] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1848
 [<ffffffff825bc161>] sg_read+0xa21/0x1490 drivers/scsi/sg.c:538
 [<ffffffff8151cc51>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:680
 [<ffffffff8151f7ef>] compat_do_readv_writev+0x5df/0x6e0 fs/read_write.c:984
 [<ffffffff8151f9c9>] compat_readv+0xd9/0x140 fs/read_write.c:1013
 [<ffffffff81521d58>] C_SYSC_readv fs/read_write.c:1033 [inline]
 [<ffffffff81521d58>] compat_SyS_readv+0xd8/0x1b0 fs/read_write.c:1022
 [<ffffffff81006d84>] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline]
 [<ffffffff81006d84>] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457
 [<ffffffff837772aa>] sysenter_flags_fixed+0xd/0x17

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8800b633a100
 which belongs to the cache fasync_cache of size 96
The buggy address is located 64 bytes inside of
 96-byte region [ffff8800b633a100, ffff8800b633a160)
The buggy address belongs to the page:
BUG: spinlock bad magic on CPU#0, init/1
 lock: 0xffff8801cf04f200, .magic: 00000000, .owner: ��H�����/0, .owner_cpu: 0
CPU: 0 PID: 1 Comm: init Not tainted 4.4.111-gc2f631b #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 9624ee3e0a73ee50 ffff8801da3176b8 ffffffff81d0513d
 ffff8801cf04f200 ffff8801cf04f250 ffff8801da308000 ffff8801da317960
 ffff8801da317990 ffff8801da3176f8 ffffffff81245acd ffff880100000000
Call Trace:
 [<ffffffff81d0513d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0513d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81245acd>] spin_dump+0x14d/0x280 kernel/locking/spinlock_debug.c:67
 [<ffffffff81245eb8>] spin_bug kernel/locking/spinlock_debug.c:75 [inline]
 [<ffffffff81245eb8>] debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]
 [<ffffffff81245eb8>] do_raw_spin_lock+0x228/0x2c0 kernel/locking/spinlock_debug.c:135
 [<ffffffff83775516>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [inline]
 [<ffffffff83775516>] _raw_spin_lock_irqsave+0x56/0x70 kernel/locking/spinlock.c:159
 [<ffffffff8121f194>] remove_wait_queue+0x14/0x40 kernel/sched/wait.c:49
 [<ffffffff8155b542>] free_poll_entry fs/select.c:132 [inline]
 [<ffffffff8155b542>] poll_freewait+0xd2/0x250 fs/select.c:141
 [<ffffffff8155d293>] do_select+0x1003/0x13f0 fs/select.c:534
 [<ffffffff8155da58>] core_sys_select+0x3d8/0x740 fs/select.c:599
 [<ffffffff8155df0a>] SYSC_select fs/select.c:640 [inline]
 [<ffffffff8155df0a>] SyS_select+0x14a/0x1d0 fs/select.c:622
 [<ffffffff83775919>] entry_SYSCALL_64_fastpath+0x16/0x92
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at lib/list_debug.c:59 __list_del_entry+0x14f/0x1d0 lib/list_debug.c:57()
list_del corruption. prev->next should be ffff8801da3179b8, but was ffffffff838a8360