In Linux 4.17, rand_initialize() in /drivers/char/random.c does not handles the failure of memory allocation. When crng = kmalloc_node(sizeof(struct crng_state),
GFP_KERNEL | __GFP_NOFAIL, i) fails, accessing this pointer memory via this pointer crng->lock will cause a null pointer dereference bug.

Source code link:
https://elixir.bootlin.com/linux/v4.10.17/source/drivers/char/random.c#L1656

Source code:
crng = kmalloc_node(sizeof(struct crng_state),
				    GFP_KERNEL | __GFP_NOFAIL, i);
		spin_lock_init(&crng->lock); // dose not check if crng is null.
		crng_initialize(crng);