INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.21' (ECDSA) to the list of known hosts. 2018/04/07 18:11:09 fuzzer started 2018/04/07 18:11:09 dialing manager at 10.128.0.26:41897 2018/04/07 18:11:15 kcov=true, comps=false 2018/04/07 18:11:18 executing program 0: r0 = socket$inet(0x2, 0x3, 0xdc) sendmmsg(r0, &(0x7f0000001e80)=[{{&(0x7f0000000000)=@in={0x2}, 0x80, &(0x7f0000000080), 0x0, &(0x7f0000000080)}}, {{&(0x7f00000002c0)=@generic={0x0, "f07418eb11dd25792616f1e89da489a89f12436d6a6950b1bd1552d0f6452e0e00d99064a07e2487565703c0db63ddcd9fb6055b227ea412c11b17e78b547248b1c0da4568dcb4cf71cd0328cc9bdee5d592e16a4f7468948bf37c3554291a9540e0c63f30f2d7c5175d2879a089284a77e2e2ec9361db88b8a9a4ec17e4"}, 0x80, &(0x7f0000000600), 0x0, &(0x7f0000000340)=[{0x10, 0x1, 0x8fb}], 0x10}}], 0x2, 0x0) 2018/04/07 18:11:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r0, &(0x7f00000002c0)={&(0x7f0000000140)={0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0xb, 0x401}, 0x14}, 0x1}, 0x0) recvmsg(r0, &(0x7f00000003c0)={&(0x7f0000000000)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @multicast2}}}, 0x80, &(0x7f0000000380)=[{&(0x7f0000002040)=""/4096, 0x1000}], 0x1, &(0x7f0000000400)=""/222, 0xde}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000200)={&(0x7f00009f7000)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000001000)={0x14, 0x42, 0x2ff}, 0x14}, 0x1}, 0x0) 2018/04/07 18:11:18 executing program 7: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xae0000)=nil, 0xae0000, 0x0, 0x4d031, 0xffffffffffffffff, 0x0) ioctl$LOOP_CLR_FD(r0, 0x7003) read$eventfd(r0, &(0x7f0000000140), 0x4) 2018/04/07 18:11:18 executing program 2: syz_emit_ethernet(0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c2000000ffffffffffff86dd6063e86900082c00fea7ec410b8000000000000000000000000000aa0000000000000000000000000000000000000000394969ca7388a2a21001657c118b5a39130c35012b3cd041c9d334148f31fe246f58250c41af86e2285b62527ca1018cf289a3f4125cb25fa390466fd65eb9885de3727ca11d3154637a07396e38d6b4a9f0a413f0f0349a26f3478dd50f3f9ba50ffb452eff148ea7d5bea79ccd6d15ff6ccf09cf2988310be22b48194d2e0cd9457c565bd1a396d84a070b9e7ca2176be5c810a425a4d4dc654a1beb7c75b00a5a9c7a095a55525fda9173a25b9e3d506e0cef1e01881748d3aed0397643543d87eed45985cabe"], 0x0) 2018/04/07 18:11:18 executing program 4: 2018/04/07 18:11:18 executing program 5: 2018/04/07 18:11:18 executing program 3: 2018/04/07 18:11:18 executing program 6: syzkaller login: [ 42.350318] ip (3759) used greatest stack depth: 54672 bytes left [ 43.247807] ip (3851) used greatest stack depth: 54200 bytes left [ 45.726705] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 45.794872] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 45.833670] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 45.882392] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 45.905983] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 46.002730] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 46.016667] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 46.030541] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.212242] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.261869] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.311615] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.477931] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.516818] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.657925] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.673477] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.720184] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.919729] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 54.928120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.944686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.992557] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 54.998783] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.011992] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.061009] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 55.067348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.085267] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.237894] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 55.244153] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.254602] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.281208] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 55.287606] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.303216] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.418936] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 55.425449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.433647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.471815] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 55.478093] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.492205] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.602431] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 55.608664] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.622730] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/04/07 18:11:34 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)="7461736b7300a4e2895f70fb9c65372f91de08cde1b7ad489a4cc7004b448c27073d774459994bb7f0e358df33ed3e5a89259cc95e6a75b5bf2172b4b3015b47fba72ac5c7d62dac3ffdbc76b10119071d73b8e25917c5b04d670a8237639b6ada2330eb", 0x2, 0x0) pread64(r1, &(0x7f0000000480)=""/197, 0xc5, 0x0) 2018/04/07 18:11:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="180000001600010300000000800000000a008910"], 0x1}, 0x1}, 0x0) 2018/04/07 18:11:34 executing program 3: bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f00000000c0)="b82283392dc50ff1fb635a5849d2f5916ae2fdc24e95e12aa8daccf7393e72be9cc66f"}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x4, 0xe3}, 0xfffffffffffffd84) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x8000000201a7f19, 0x0, 0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000f6bffb)='GPL\x00', 0x0, 0x299, &(0x7f00001a7f05)=""/251}, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={r0, 0x50, &(0x7f00000000c0)}, 0x10) socketpair$inet_icmp(0xf, 0x400000, 0x10, &(0x7f0000000000)) 2018/04/07 18:11:34 executing program 7: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xae0000)=nil, 0xae0000, 0x0, 0x4d031, 0xffffffffffffffff, 0x0) ioctl$LOOP_CLR_FD(r0, 0x7003) read$eventfd(r0, &(0x7f0000000140), 0x4) 2018/04/07 18:11:34 executing program 1: r0 = socket(0x11, 0x100000802, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x4001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'ifb0\x00', 0xa201}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="0000000c000000000000000000006071685b00140000fe8000000000000000000000000000aa0000000000000000000000000000000000000400", @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x3) [ 56.402809] raw_sendmsg: syz-executor0 forgot to set AF_INET. Fix it! 2018/04/07 18:11:35 executing program 0: request_key(&(0x7f0000000280)='id_resolver\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a}, &(0x7f0000000300)='selinuxnodevvmnet1,cgroupsecurity@!cpusetsecurityselfsystem\x00', 0xfffffffffffffffe) 2018/04/07 18:11:35 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x8000000000002c) connect$inet6(r0, &(0x7f0000002fe4)={0xa}, 0x1c) sendmsg(r0, &(0x7f0000007000)={0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000100)}, 0x2000c080) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)='\x00\x00\x00\x00\x00\x00\x00\a', 0x8}], 0x1) 2018/04/07 18:11:35 executing program 1: r0 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23}], 0x1c) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/04/07 18:11:35 executing program 4: r0 = socket$inet(0x2, 0xc000000000000005, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000040)={0x0, 0x2}, 0x8) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @rand_addr}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x101cd, 0x0, &(0x7f0000e68000)={0x2, 0x4e23, @loopback=0x7f000001}, 0x10) 2018/04/07 18:11:35 executing program 5: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f000000f000)="240000001a00030207fffd946fa283bc04eee6d87986c49727008568b51ba3a2d188737e", 0x24}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540), 0x0, &(0x7f0000000200)=""/128, 0x80}, 0x0) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000600)=""/77, 0x4d}, 0x0) 2018/04/07 18:11:35 executing program 6: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f000067d000)=0x19, 0x4) bind$unix(r1, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) listen(r1, 0x0) connect$unix(r0, &(0x7f0000932000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x4a, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4$packet(r1, &(0x7f00005d6000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00005c3000)=0x14, 0x0) 2018/04/07 18:11:35 executing program 7: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xae0000)=nil, 0xae0000, 0x0, 0x4d031, 0xffffffffffffffff, 0x0) ioctl$LOOP_CLR_FD(r0, 0x7003) read$eventfd(r0, &(0x7f0000000140), 0x4) 2018/04/07 18:11:35 executing program 2: r0 = socket(0x2, 0x3, 0x40000000000000ff) ioctl$sock_ipx_SIOCAIPXPRISLT(r0, 0x89e1, &(0x7f00000008c0)) [ 57.288465] ================================================================== [ 57.295895] BUG: KMSAN: uninit-value in ipv6_frag_rcv+0xfa5/0x6970 [ 57.302216] CPU: 1 PID: 5087 Comm: syz-executor3 Not tainted 4.16.0+ #82 [ 57.309050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.318392] Call Trace: [ 57.320968] [ 57.323121] dump_stack+0x185/0x1d0 [ 57.326746] ? ipv6_frag_rcv+0xfa5/0x6970 [ 57.330892] kmsan_report+0x142/0x240 [ 57.334695] __msan_warning_32+0x6c/0xb0 [ 57.338756] ipv6_frag_rcv+0xfa5/0x6970 [ 57.342732] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 57.348105] ? ipv6_frag_exit+0x90/0x90 [ 57.352078] ip6_input_finish+0xa62/0x2110 [ 57.356317] ? ip6table_filter_hook+0xb5/0xe0 [ 57.360813] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 57.366183] ip6_input+0x294/0x320 [ 57.369725] ? ip6_input+0x320/0x320 [ 57.373438] ? ipv6_rcv+0x26d0/0x26d0 [ 57.377235] ipv6_rcv+0x20ec/0x26d0 [ 57.380860] ? local_bh_enable+0x40/0x40 [ 57.384927] __netif_receive_skb_core+0x47cf/0x4a80 [ 57.389941] ? kmsan_set_origin_inline+0x6b/0x120 [ 57.394777] ? kmsan_internal_memset_shadow_inline+0xd0/0xd0 [ 57.400572] ? traceprobe_parse_probe_arg+0xe1b/0x1600 [ 57.405841] ? ip6_rcv_finish+0x4d0/0x4d0 [ 57.409987] process_backlog+0x62d/0xe20 [ 57.414060] ? rps_trigger_softirq+0x2f0/0x2f0 [ 57.418633] net_rx_action+0x7c1/0x1a70 [ 57.422609] ? net_tx_action+0xab0/0xab0 [ 57.426671] __do_softirq+0x56d/0x93d [ 57.430471] do_softirq_own_stack+0x2a/0x40 [ 57.434779] 2018/04/07 18:11:35 executing program 2: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/raw6\x00') preadv(r0, &(0x7f00000002c0)=[{&(0x7f0000000340)=""/2, 0x2}], 0x1, 0x100000) [ 57.437009] __local_bh_enable_ip+0x114/0x140 [ 57.441509] local_bh_enable+0x36/0x40 [ 57.445393] ip6_finish_output2+0x1b6c/0x1f20 [ 57.449904] ip6_finish_output+0xb3f/0xc00 [ 57.454145] ip6_output+0x597/0x6c0 [ 57.457773] ? ip6_output+0x6c0/0x6c0 [ 57.461574] ? ac6_seq_show+0x200/0x200 [ 57.465549] ip6_local_out+0x573/0x640 [ 57.469441] ? __ip6_local_out+0x4f0/0x4f0 [ 57.473679] ip6_push_pending_frames+0x218/0x4d0 [ 57.478447] rawv6_sendmsg+0x4500/0x4cc0 [ 57.482525] ? kmsan_set_origin_inline+0x6b/0x120 2018/04/07 18:11:35 executing program 6: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10) r0 = socket(0x11, 0x4000000000080003, 0x0) setsockopt(r0, 0x107, 0xd, &(0x7f0000001000), 0x47e) sendmmsg(r0, &(0x7f0000003e80)=[{{&(0x7f0000000280)=@in6={0xa, 0x0, 0x3, @mcast1={0xff, 0x1, [], 0x1}}, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000340)}}, {{&(0x7f0000000e80)=@ax25={0x3, {"d8a46d0d8e06f7"}}, 0x80, &(0x7f0000000f80), 0x0, &(0x7f0000001040)=ANY=[]}}], 0x2, 0x0) [ 57.487376] ? futex_wait_queue_me+0x4ba/0x710 [ 57.491955] ? futex_wait_queue_me+0x4ee/0x710 [ 57.496536] ? compat_rawv6_ioctl+0x30/0x30 [ 57.500853] inet_sendmsg+0x48d/0x740 [ 57.504644] ? security_socket_sendmsg+0x9e/0x210 [ 57.509486] ? inet_getname+0x500/0x500 [ 57.513459] sock_write_iter+0x3b9/0x470 [ 57.517526] ? sock_read_iter+0x480/0x480 [ 57.521668] do_iter_readv_writev+0x7bb/0x970 [ 57.526167] ? sock_read_iter+0x480/0x480 [ 57.530313] do_iter_write+0x30d/0xd40 [ 57.534201] ? __msan_metadata_ptr_for_store_8+0x13/0x20 2018/04/07 18:11:35 executing program 2: mkdir(&(0x7f000022d000)='./file0\x00', 0x0) chroot(&(0x7f000009a000)='./file0\x00') mount(&(0x7f00005b9ff8)='./file0\x00', &(0x7f0000edaff8)='./file0\x00', &(0x7f0000d9fffa)='msdos\x00', 0x1002, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f0000000240)='./file0\x00') umount2(&(0x7f0000e28000)='..', 0x0) symlink(&(0x7f0000ed6ffe)='..', &(0x7f0000000040)='../file0\x00') clock_gettime(0x0, &(0x7f00000000c0)) utimes(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000100)={{0x0, 0x2710}}) [ 57.539656] do_writev+0x3c9/0x830 [ 57.543199] ? syscall_return_slowpath+0xe9/0x700 [ 57.548047] SYSC_writev+0x9b/0xb0 [ 57.551585] SyS_writev+0x56/0x80 [ 57.555035] do_syscall_64+0x309/0x430 [ 57.558920] ? SYSC_readv+0xb0/0xb0 [ 57.562547] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 57.567730] RIP: 0033:0x455259 [ 57.570913] RSP: 002b:00007f72b67fdc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 57.578615] RAX: ffffffffffffffda RBX: 00007f72b67fe6d4 RCX: 0000000000455259 [ 57.585873] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000013 [ 57.593135] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 57.600397] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 57.607664] R13: 00000000000006cd R14: 00000000006fd3d8 R15: 0000000000000000 [ 57.614928] [ 57.616545] Uninit was stored to memory at: [ 57.620874] kmsan_internal_chain_origin+0x12b/0x210 [ 57.625988] kmsan_memcpy_origins+0x11d/0x170 [ 57.630480] __msan_memcpy+0x19f/0x1f0 [ 57.634366] skb_copy_bits+0x63a/0xdb0 2018/04/07 18:11:35 executing program 2: r0 = socket$inet6_sctp(0xa, 0x10000000000005, 0x84) ioctl$sock_ifreq(r0, 0x40000089f0, &(0x7f0000001380)={"626f6e64300000000000000000f800", @ifru_names='ip6gretap0\x00'}) [ 57.638251] __pskb_pull_tail+0x483/0x22e0 [ 57.642482] ipv6_frag_rcv+0x1894/0x6970 [ 57.646544] ip6_input_finish+0xa62/0x2110 [ 57.650778] ip6_input+0x294/0x320 [ 57.654314] ipv6_rcv+0x20ec/0x26d0 [ 57.657940] __netif_receive_skb_core+0x47cf/0x4a80 [ 57.662950] process_backlog+0x62d/0xe20 [ 57.667001] net_rx_action+0x7c1/0x1a70 [ 57.670970] __do_softirq+0x56d/0x93d [ 57.674753] Uninit was created at: [ 57.678278] kmsan_alloc_meta_for_pages+0x161/0x3a0 [ 57.683269] kmsan_alloc_page+0x82/0xe0 [ 57.687227] __alloc_pages_nodemask+0xf5b/0x5dc0 [ 57.691967] alloc_pages_current+0x6b5/0x970 [ 57.696356] skb_page_frag_refill+0x3ba/0x5e0 [ 57.700834] sk_page_frag_refill+0xa4/0x340 [ 57.705135] __ip6_append_data+0x1a20/0x4bb0 [ 57.709519] ip6_append_data+0x40e/0x6b0 [ 57.713553] rawv6_sendmsg+0x2787/0x4cc0 [ 57.717588] inet_sendmsg+0x48d/0x740 [ 57.721365] sock_write_iter+0x3b9/0x470 [ 57.725402] do_iter_readv_writev+0x7bb/0x970 [ 57.729874] do_iter_write+0x30d/0xd40 [ 57.733733] do_writev+0x3c9/0x830 [ 57.737248] SYSC_writev+0x9b/0xb0 [ 57.740773] SyS_writev+0x56/0x80 [ 57.744215] do_syscall_64+0x309/0x430 [ 57.748096] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 57.753265] ================================================================== [ 57.760596] Disabling lock debugging due to kernel taint [ 57.766023] Kernel panic - not syncing: panic_on_warn set ... [ 57.766023] [ 57.773378] CPU: 1 PID: 5087 Comm: syz-executor3 Tainted: G B 4.16.0+ #82 [ 57.781505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.790841] Call Trace: [ 57.793404] [ 57.795533] dump_stack+0x185/0x1d0 [ 57.799149] panic+0x39d/0x940 [ 57.802342] ? ipv6_frag_rcv+0xfa5/0x6970 [ 57.806471] kmsan_report+0x238/0x240 [ 57.810270] __msan_warning_32+0x6c/0xb0 [ 57.814329] ipv6_frag_rcv+0xfa5/0x6970 [ 57.818289] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 57.823647] ? ipv6_frag_exit+0x90/0x90 [ 57.827610] ip6_input_finish+0xa62/0x2110 [ 57.831845] ? ip6table_filter_hook+0xb5/0xe0 [ 57.836330] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 57.841672] ip6_input+0x294/0x320 [ 57.845197] ? ip6_input+0x320/0x320 [ 57.848902] ? ipv6_rcv+0x26d0/0x26d0 [ 57.852684] ipv6_rcv+0x20ec/0x26d0 [ 57.856299] ? local_bh_enable+0x40/0x40 [ 57.860366] __netif_receive_skb_core+0x47cf/0x4a80 [ 57.865365] ? kmsan_set_origin_inline+0x6b/0x120 [ 57.870184] ? kmsan_internal_memset_shadow_inline+0xd0/0xd0 [ 57.875960] ? traceprobe_parse_probe_arg+0xe1b/0x1600 [ 57.881221] ? ip6_rcv_finish+0x4d0/0x4d0 [ 57.885346] process_backlog+0x62d/0xe20 [ 57.889386] ? rps_trigger_softirq+0x2f0/0x2f0 [ 57.893950] net_rx_action+0x7c1/0x1a70 [ 57.897910] ? net_tx_action+0xab0/0xab0 [ 57.901946] __do_softirq+0x56d/0x93d [ 57.905724] do_softirq_own_stack+0x2a/0x40 [ 57.910025] [ 57.912255] __local_bh_enable_ip+0x114/0x140 [ 57.916752] local_bh_enable+0x36/0x40 [ 57.920636] ip6_finish_output2+0x1b6c/0x1f20 [ 57.925122] ip6_finish_output+0xb3f/0xc00 [ 57.929339] ip6_output+0x597/0x6c0 [ 57.932943] ? ip6_output+0x6c0/0x6c0 [ 57.936726] ? ac6_seq_show+0x200/0x200 [ 57.940679] ip6_local_out+0x573/0x640 [ 57.944551] ? __ip6_local_out+0x4f0/0x4f0 [ 57.948772] ip6_push_pending_frames+0x218/0x4d0 [ 57.953510] rawv6_sendmsg+0x4500/0x4cc0 [ 57.957558] ? kmsan_set_origin_inline+0x6b/0x120 [ 57.962391] ? futex_wait_queue_me+0x4ba/0x710 [ 57.966969] ? futex_wait_queue_me+0x4ee/0x710 [ 57.971559] ? compat_rawv6_ioctl+0x30/0x30 [ 57.975872] inet_sendmsg+0x48d/0x740 [ 57.979665] ? security_socket_sendmsg+0x9e/0x210 [ 57.984490] ? inet_getname+0x500/0x500 [ 57.988445] sock_write_iter+0x3b9/0x470 [ 57.992486] ? sock_read_iter+0x480/0x480 [ 57.996612] do_iter_readv_writev+0x7bb/0x970 [ 58.001088] ? sock_read_iter+0x480/0x480 [ 58.005219] do_iter_write+0x30d/0xd40 [ 58.009094] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 58.014533] do_writev+0x3c9/0x830 [ 58.018068] ? syscall_return_slowpath+0xe9/0x700 [ 58.022902] SYSC_writev+0x9b/0xb0 [ 58.026429] SyS_writev+0x56/0x80 [ 58.029868] do_syscall_64+0x309/0x430 [ 58.033739] ? SYSC_readv+0xb0/0xb0 [ 58.037356] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 58.042527] RIP: 0033:0x455259 [ 58.045695] RSP: 002b:00007f72b67fdc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 58.053392] RAX: ffffffffffffffda RBX: 00007f72b67fe6d4 RCX: 0000000000455259 [ 58.060646] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000013 [ 58.067906] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 58.075161] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 58.082412] R13: 00000000000006cd R14: 00000000006fd3d8 R15: 0000000000000000 [ 58.090085] Dumping ftrace buffer: [ 58.093602] (ftrace buffer empty) [ 58.097285] Kernel Offset: disabled [ 58.100883] Rebooting in 86400 seconds..