random: sshd: uninitialized urandom read (32 bytes read, 123 bits of entropy available) ================================================================== BUG: KASAN: slab-out-of-bounds in list_empty include/linux/list.h:189 [inline] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130 Read of size 8 at addr ffff8801d18ec140 by task syzkaller402628/3333 CPU: 0 PID: 3333 Comm: syzkaller402628 Not tainted 4.4.111-gc2f631b #27 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 a6ddc28abc8b20d3 ffff8801d00efab0 ffffffff81d0513d ffffea0007463b00 ffff8801d18ec140 0000000000000000 ffff8801d18ec140 ffff8801d1afc438 ffff8801d00efae8 ffffffff814fd433 ffff8801d18ec140 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] list_empty include/linux/list.h:189 [inline] [] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130 [] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1848 [] sg_read+0xa21/0x1490 drivers/scsi/sg.c:538 [] __vfs_read+0x103/0x440 fs/read_write.c:432 [] vfs_read+0x123/0x3a0 fs/read_write.c:454 [] SYSC_read fs/read_write.c:569 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:562 [] entry_SYSCALL_64_fastpath+0x16/0x92 Allocated by task 0: (stack is not available) Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8801d18ec100 which belongs to the cache fasync_cache of size 96 The buggy address is located 64 bytes inside of 96-byte region [ffff8801d18ec100, ffff8801d18ec160) The buggy address belongs to the page: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accesskasan: CONFIG_KASAN_INLINE enabled BUG: unable to handle kernel paging request at fffffffe04f2a300 IP: [] cpuacct_charge+0x155/0x390 kernel/sched/cpuacct.c:247 PGD 420f067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 3323 Comm: getty Not tainted 4.4.111-gc2f631b #27 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d0cc8000 task.stack: ffff8801d0840000 RIP: 0010:[] [] cpuacct_charge+0x155/0x390 kernel/sched/cpuacct.c:247 RSP: 0018:ffff8801db307a20 EFLAGS: 00010046 RAX: 1ffffffff0854dff RBX: 0000000000018528 RCX: ffffffff847ea080 RDX: fffffbffc09e5460 RSI: fffffffe04f2a300 RDI: ffffffff842a6ff8 RBP: ffff8801db307a68 R08: 0000000000000000 R09: 0000000000000000 R10: ffffed0043fffa09 R11: 0000000000000000 R12: ffffffff842a6f20 R13: dffffc0000000000 R14: 00000000380c2e7e R15: ffffffffd00e8050 FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffe04f2a300 CR3: 00000001d2902000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff8122a4a0 ffffffff81d4976e 0000000000000000 ffff8801db307a78 ffff8800b59a47a0 ffffffff83843900 00000000380c2e7e ffff8800b59a47f0 ffff8800b59a4740 ffff8801db307ab8 ffffffff811dc017 ffff8801db21f4c0 Call Trace: [] update_curr+0x2c7/0x6c0 kernel/sched/fair.c:882 [] enqueue_entity kernel/sched/fair.c:3511 [inline] [] enqueue_task_fair+0x313/0x2940 kernel/sched/fair.c:4694 [] enqueue_task kernel/sched/core.c:856 [inline] [] activate_task+0x148/0x270 kernel/sched/core.c:872 [] ttwu_activate kernel/sched/core.c:1734 [inline] [] ttwu_do_activate.constprop.131+0xbf/0x1e0 kernel/sched/core.c:1787 [] ttwu_queue kernel/sched/core.c:1932 [inline] [] try_to_wake_up+0x68d/0xf60 kernel/sched/core.c:2066 [] default_wake_function+0x35/0x50 kernel/sched/core.c:3490 [] autoremove_wake_function+0x13/0x90 kernel/sched/wait.c:293 [] __wake_up_common+0xb4/0x150 kernel/sched/wait.c:73 [] __wake_up+0x34/0x50 kernel/sched/wait.c:95 [] wake_up_klogd_work_func+0x56/0x80 kernel/printk/printk.c:2736 [] irq_work_run_list+0xca/0x140 kernel/irq_work.c:156 [] irq_work_tick+0x10e/0x170 kernel/irq_work.c:182 [] update_process_times+0x52/0x70 kernel/time/timer.c:1423 [] tick_sched_handle.isra.16+0x55/0xf0 kernel/time/tick-sched.c:151 [] tick_sched_timer+0x72/0x120 kernel/time/tick-sched.c:1097 [] __run_hrtimer kernel/time/hrtimer.c:1253 [inline] [] __hrtimer_run_queues+0x306/0xfe0 kernel/time/hrtimer.c:1317 [] hrtimer_interrupt+0x1a6/0x440 kernel/time/hrtimer.c:1351 [] local_apic_timer_interrupt+0x6a/0xb0 arch/x86/kernel/apic/apic.c:901 [] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:925 [] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:725 [ 46.706976] [] ? console_cont_flush kernel/printk/printk.c:2217 [inline] [ 46.706976] [] ? console_unlock+0x790/0xa00 kernel/printk/printk.c:2265 [] vprintk_emit+0x55e/0x850 kernel/printk/printk.c:1832 [] vprintk+0x28/0x30 kernel/printk/printk.c:1843 [] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844 [] printk+0xb7/0xe2 kernel/printk/printk.c:1922 [] kasan_die_handler+0x31/0x40 arch/x86/mm/kasan_init_64.c:58 [] notifier_call_chain+0x95/0x1b0 kernel/notifier.c:93 [] __atomic_notifier_call_chain kernel/notifier.c:183 [inline] [] atomic_notifier_call_chain+0x7b/0x140 kernel/notifier.c:193 [] notify_die+0xdf/0x160 kernel/notifier.c:549 [] do_general_protection+0x2f7/0x390 arch/x86/kernel/traps.c:461 [] general_protection+0x28/0x30 arch/x86/entry/entry_64.S:1020 [] rb_erase_augmented include/linux/rbtree_augmented.h:246 [inline] [] vma_interval_tree_remove+0x88a/0xde0 mm/interval_tree.c:24 [] __remove_shared_vm_struct+0xb5/0xe0 mm/mmap.c:259 [] unlink_file_vma+0x83/0xb0 mm/mmap.c:274 [] free_pgtables+0x226/0x330 mm/memory.c:555 [] exit_mmap+0x1e3/0x3a0 mm/mmap.c:2926 [] __mmput kernel/fork.c:715 [inline] [] mmput+0xf8/0x2d0 kernel/fork.c:735 [] exit_mm kernel/exit.c:440 [inline] [] do_exit+0x75b/0x2a20 kernel/exit.c:742 [] do_group_exit+0x108/0x320 kernel/exit.c:885 [] SYSC_exit_group kernel/exit.c:896 [inline] [] SyS_exit_group+0x1d/0x20 kernel/exit.c:894 [] entry_SYSCALL_64_fastpath+0x16/0x92 Code: 49 8d bc 24 d8 00 00 00 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 9e 01 00 00 49 8b 9c 24 d8 00 00 00 80 3a 00 0f 85 0a 02 00 00 <4a> 03 1c f9 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 cf 01 00 RIP [] cpuacct_charge+0x155/0x390 kernel/sched/cpuacct.c:247 RSP CR2: fffffffe04f2a300 ---[ end trace 65cdcf4e76791b72 ]---