[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 85.755535] audit: type=1800 audit(1556411303.800:25): pid=11073 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 85.780674] audit: type=1800 audit(1556411303.830:26): pid=11073 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 85.817422] audit: type=1800 audit(1556411303.850:27): pid=11073 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.5' (ECDSA) to the list of known hosts. 2019/04/28 00:28:38 fuzzer started 2019/04/28 00:28:43 dialing manager at 10.128.0.26:41587 2019/04/28 00:28:44 syscalls: 2284 2019/04/28 00:28:44 code coverage: enabled 2019/04/28 00:28:44 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/04/28 00:28:44 extra coverage: extra coverage is not supported by the kernel 2019/04/28 00:28:44 setuid sandbox: enabled 2019/04/28 00:28:44 namespace sandbox: enabled 2019/04/28 00:28:44 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/28 00:28:44 fault injection: enabled 2019/04/28 00:28:44 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/28 00:28:44 net packet injection: enabled 2019/04/28 00:28:44 net device setup: enabled 00:31:45 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000048c0)={@multicast1}, 0x10) syzkaller login: [ 288.462403] IPVS: ftp: loaded support on port[0] = 21 [ 288.598582] chnl_net:caif_netlink_parms(): no params data found [ 288.663469] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.670067] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.678539] device bridge_slave_0 entered promiscuous mode [ 288.687384] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.694170] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.702488] device bridge_slave_1 entered promiscuous mode [ 288.733057] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 288.744193] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 288.774471] team0: Port device team_slave_0 added [ 288.787992] team0: Port device team_slave_1 added [ 288.906745] device hsr_slave_0 entered promiscuous mode [ 289.032540] device hsr_slave_1 entered promiscuous mode [ 289.348977] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.355672] bridge0: port 2(bridge_slave_1) entered forwarding state [ 289.363963] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.371052] bridge0: port 1(bridge_slave_0) entered forwarding state [ 289.441278] 8021q: adding VLAN 0 to HW filter on device bond0 [ 289.460279] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 289.471054] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.481528] bridge0: port 2(bridge_slave_1) entered disabled state [ 289.493235] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 289.511864] 8021q: adding VLAN 0 to HW filter on device team0 [ 289.527463] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 289.536702] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.543276] bridge0: port 1(bridge_slave_0) entered forwarding state [ 289.583684] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 289.592218] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.599783] bridge0: port 2(bridge_slave_1) entered forwarding state [ 289.609362] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 289.618337] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 289.630332] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 289.642206] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 289.650424] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 289.665093] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 289.677362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 289.686548] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 289.694990] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 289.727319] 8021q: adding VLAN 0 to HW filter on device batadv0 00:31:47 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 289.933155] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 289.945029] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 290.056069] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 290.173183] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) socket$inet_udplite(0x2, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 290.282397] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) socket$inet_udplite(0x2, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 290.391302] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) socket$inet_udplite(0x2, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 290.492147] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 290.577395] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) [ 290.655485] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 290.738222] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:48 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: connect$inet(0xffffffffffffffff, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: connect$inet(0xffffffffffffffff, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: connect$inet(0xffffffffffffffff, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x0, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x0, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x0, 0x5, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x40000000015, 0x0, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x40000000015, 0x0, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:49 executing program 0: r0 = socket(0x40000000015, 0x0, 0x0) connect$inet(r0, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:50 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:50 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:50 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000900)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:50 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x10000}, 0x1c) 00:31:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000180)={{0x200000080}, 'port0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000240)={{0x0, 0x1}, {0x80}, 0x0, 0x6}) [ 292.346241] ================================================================== [ 292.354607] BUG: KMSAN: uninit-value in rds_connect+0x16c/0x900 [ 292.361014] CPU: 0 PID: 11327 Comm: syz-executor.0 Not tainted 5.1.0-rc4+ #1 [ 292.368216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 292.377688] Call Trace: [ 292.380331] dump_stack+0x173/0x1d0 [ 292.384052] kmsan_report+0x131/0x2a0 [ 292.387861] __msan_warning+0x7a/0xf0 [ 292.391667] rds_connect+0x16c/0x900 [ 292.395427] __sys_connect+0x664/0x820 [ 292.399316] ? rds_release+0x620/0x620 [ 292.403207] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 292.408663] ? prepare_exit_to_usermode+0x114/0x420 [ 292.413763] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 292.419122] ? syscall_return_slowpath+0x50/0x650 [ 292.424021] __se_sys_connect+0x8d/0xb0 [ 292.428017] __x64_sys_connect+0x4a/0x70 [ 292.432075] do_syscall_64+0xbc/0xf0 [ 292.435861] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 292.441048] RIP: 0033:0x458da9 [ 292.444233] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 292.463308] RSP: 002b:00007f92753b1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 292.471081] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458da9 [ 292.478431] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 292.486307] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 292.493570] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f92753b26d4 [ 292.500836] R13: 00000000004bf1e4 R14: 00000000004d02a8 R15: 00000000ffffffff [ 292.508109] [ 292.509738] Local variable description: ----address@__sys_connect [ 292.515972] Variable was created at: [ 292.519770] __sys_connect+0x87/0x820 [ 292.523578] __se_sys_connect+0x8d/0xb0 [ 292.527536] ================================================================== [ 292.534985] Disabling lock debugging due to kernel taint [ 292.540422] Kernel panic - not syncing: panic_on_warn set ... [ 292.546301] CPU: 0 PID: 11327 Comm: syz-executor.0 Tainted: G B 5.1.0-rc4+ #1 [ 292.554877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 292.564226] Call Trace: [ 292.566833] dump_stack+0x173/0x1d0 [ 292.570461] panic+0x3d1/0xb01 [ 292.573691] kmsan_report+0x29a/0x2a0 [ 292.577493] __msan_warning+0x7a/0xf0 [ 292.581384] rds_connect+0x16c/0x900 [ 292.585105] __sys_connect+0x664/0x820 [ 292.588990] ? rds_release+0x620/0x620 [ 292.592880] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 292.598322] ? prepare_exit_to_usermode+0x114/0x420 [ 292.603424] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 292.609912] ? syscall_return_slowpath+0x50/0x650 [ 292.614760] __se_sys_connect+0x8d/0xb0 [ 292.618860] __x64_sys_connect+0x4a/0x70 [ 292.622919] do_syscall_64+0xbc/0xf0 [ 292.626632] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 292.631828] RIP: 0033:0x458da9 [ 292.635014] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 292.653914] RSP: 002b:00007f92753b1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 292.661618] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458da9 [ 292.668883] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 292.676152] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 292.683421] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f92753b26d4 [ 292.690685] R13: 00000000004bf1e4 R14: 00000000004d02a8 R15: 00000000ffffffff [ 292.699472] Kernel Offset: disabled [ 292.703285] Rebooting in 86400 seconds..