Output a pad (un-keyed, variable length) from an input seed (fixed value for same seed) I want a function $y = f(x, len)$:


$x$ is the seed. $y$ is the output. $len \in \mathbb{Z^+}$ is the length (bytes) of $y$
Select a seed string $x$ to generate a string $y$.
For each same pair of $x$ and $len$, the value of $y$ is same.
seed should have a reasonable short length. $y$'s length may support a certain range (*remark)
Every byte value of $y$ should be uniformly (or close to uniformly) distributed 


Remark of 4 - please consider two possible functions:


$y$ length is a multiple of $16$ (block length $16$). If I use hash function, the problem is that the length options are limited and not consecutive (e.g., $16 \cdot n$, $n=1, 2, 3,\ldots$).
$y$ can be any length within a range


(No need to protect $f(x)$ as a secret)
It sounds like the SHAKE functions (there are two flavors, SHAKE-128 and SHAKE-256) are designed to do exactly what you're asking for.

SHAKE takes a value ($x$ in your case), and generates an arbitrarily long output from it.  You can take the first $len$ bytes from it, and that's your $y$

As for your requirements:


  
  For each same pair of $x$ and $len$, the value of $y$ is same.
  


For any input seed $x$, SHAKE always generates the same key stream.  This does mean that (for example) $\text{SHAKE}( \text{"abc"}, 128 )$ is a prefix of $\text{SHAKE}( \text{"abc"}, 256 )$.  Your requirements didn't mention that as a concern, but if it is, you can always use $x || len$ as the input to SHAKE


  
  seed should have a reasonable short length.
  


SHAKE can handle any seed length you want.


  4a. $y$'s length may support a certain range (*remark)


SHAKE can generate any length of output


  
  Every byte value of $y$ should be uniformly (or close to uniformly) distributed 
  


As far as we know, the output of SHAKE is uniformly distributed.

And while it's not difficult at all to generate the same functionality from a fixed length hash function, the nice thing about SHAKE is that all the logic about generating multiple hashes and truncating the last one is already done for you.

Here is the standard implementation of SHAKE (as well as a number of related functions)