[ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started System Logging Service. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.227' (ECDSA) to the list of known hosts. syzkaller login: [ 141.397417][ T8236] IPVS: ftp: loaded support on port[0] = 21 [ 141.565301][ T8236] chnl_net:caif_netlink_parms(): no params data found [ 141.653464][ T8236] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.660600][ T8236] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.670734][ T8236] device bridge_slave_0 entered promiscuous mode [ 141.681137][ T8236] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.689300][ T8236] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.698663][ T8236] device bridge_slave_1 entered promiscuous mode [ 141.730988][ T8236] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 141.745144][ T8236] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 141.778443][ T8236] team0: Port device team_slave_0 added [ 141.787823][ T8236] team0: Port device team_slave_1 added [ 141.820965][ T8236] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 141.828164][ T8236] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 141.854312][ T8236] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 141.867731][ T8236] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 141.874942][ T8236] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 141.901295][ T8236] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 141.944614][ T8236] device hsr_slave_0 entered promiscuous mode [ 141.952122][ T8236] device hsr_slave_1 entered promiscuous mode [ 142.133188][ T8236] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 142.145563][ T8236] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 142.163523][ T8236] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 142.181252][ T8236] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 142.267975][ T8236] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.275323][ T8236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.283241][ T8236] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.290439][ T8236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.368705][ T8236] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.390027][ T2076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 142.400794][ T2076] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.411060][ T2076] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.423351][ T2076] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 142.441914][ T8236] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.459863][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 142.468940][ T3478] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.476363][ T3478] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.492282][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 142.501568][ T8444] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.508895][ T8444] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.524670][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 142.540789][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 142.559035][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 142.568999][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 142.580644][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 142.597251][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 142.607973][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 142.625657][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 142.635424][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 142.654671][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 142.664224][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 142.684442][ T8236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 142.715495][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 142.723585][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 142.744581][ T8236] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 142.778685][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 142.788805][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 142.825870][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 142.835158][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 142.849440][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 142.858919][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 142.870849][ T8236] device veth0_vlan entered promiscuous mode [ 142.890422][ T8236] device veth1_vlan entered promiscuous mode [ 142.930465][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 142.939395][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 142.948879][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 142.958653][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 142.975987][ T8236] device veth0_macvtap entered promiscuous mode [ 142.991152][ T8236] device veth1_macvtap entered promiscuous mode [ 143.021724][ T8236] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 143.030575][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 143.040097][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 143.048817][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 143.058694][ T3478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 143.076417][ T8236] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 143.083992][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 143.093768][ T8444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 143.110067][ T8236] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.119407][ T8236] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.128463][ T8236] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.138949][ T8236] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 executing program [ 143.272418][ C0] ===================================================== [ 143.279423][ C0] BUG: KMSAN: uninit-value in ip_rcv_core+0xf4c/0x1480 [ 143.286289][ C0] CPU: 0 PID: 8447 Comm: syz-executor335 Not tainted 5.10.0-rc4-syzkaller #0 [ 143.295048][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 143.305100][ C0] Call Trace: [ 143.308383][ C0] [ 143.311248][ C0] dump_stack+0x21c/0x280 [ 143.315587][ C0] kmsan_report+0xfb/0x1e0 [ 143.320006][ C0] __msan_warning+0x5f/0xa0 [ 143.324510][ C0] ip_rcv_core+0xf4c/0x1480 [ 143.329019][ C0] ip_rcv+0xc7/0x820 [ 143.332917][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.338125][ C0] __netif_receive_skb+0x1ec/0x640 [ 143.343245][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.348889][ C0] ? ip_local_deliver_finish+0x370/0x370 [ 143.354552][ C0] process_backlog+0x517/0xbd0 [ 143.359340][ C0] ? rps_trigger_softirq+0x2e0/0x2e0 [ 143.364633][ C0] napi_poll+0x40a/0x1020 [ 143.368974][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.374624][ C0] net_rx_action+0x34c/0xd30 [ 143.379219][ C0] ? net_tx_action+0xd30/0xd30 [ 143.383986][ C0] __do_softirq+0x1a9/0x6fa [ 143.388500][ C0] asm_call_irq_on_stack+0xf/0x20 [ 143.393518][ C0] [ 143.396465][ C0] do_softirq_own_stack+0x6e/0x90 [ 143.401494][ C0] __local_bh_enable_ip+0x184/0x1d0 [ 143.406704][ C0] local_bh_enable+0x36/0x40 [ 143.411301][ C0] __dev_queue_xmit+0x3b3e/0x4590 [ 143.416342][ C0] dev_queue_xmit+0x4b/0x60 [ 143.420851][ C0] ? netdev_core_pick_tx+0x5a0/0x5a0 [ 143.426140][ C0] packet_sendmsg+0x8778/0x9a60 [ 143.431002][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 143.437089][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.442266][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.447505][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.453129][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.458323][ C0] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 143.464164][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 143.470215][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 143.475051][ C0] ? packet_getsockopt+0x1120/0x1120 [ 143.480321][ C0] __sys_sendmmsg+0xa89/0x1070 [ 143.485068][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.490697][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 143.496764][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.501938][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.507567][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 143.513644][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 143.518401][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 143.523307][ C0] do_syscall_64+0x9f/0x140 [ 143.527839][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 143.533749][ C0] RIP: 0033:0x444489 [ 143.537642][ C0] Code: e8 6c 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 143.557330][ C0] RSP: 002b:00007fff91805138 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 143.565728][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000444489 [ 143.573693][ C0] RDX: 0000000000000001 RSI: 0000000020004e80 RDI: 0000000000000003 [ 143.581662][ C0] RBP: 00007fff91805150 R08: 00000000bb1414ac R09: 00000000bb1414ac [ 143.589648][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff91805180 [ 143.597643][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 143.605619][ C0] [ 143.607922][ C0] Uninit was stored to memory at: [ 143.613032][ C0] kmsan_internal_chain_origin+0xad/0x130 [ 143.618759][ C0] __msan_chain_origin+0x57/0xa0 [ 143.623695][ C0] iptunnel_xmit+0xbd6/0xf20 [ 143.628263][ C0] udp_tunnel_xmit_skb+0x526/0x640 [ 143.633349][ C0] geneve_xmit+0x209e/0x3c20 [ 143.637928][ C0] xmit_one+0x2b6/0x760 [ 143.642067][ C0] __dev_queue_xmit+0x3426/0x4590 [ 143.647084][ C0] dev_queue_xmit+0x4b/0x60 [ 143.651566][ C0] packet_sendmsg+0x8778/0x9a60 [ 143.656404][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 143.661248][ C0] __sys_sendmmsg+0xa89/0x1070 [ 143.665990][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 143.670730][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 143.675566][ C0] do_syscall_64+0x9f/0x140 [ 143.680049][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 143.685912][ C0] [ 143.688214][ C0] Uninit was created at: [ 143.692449][ C0] kmsan_internal_poison_shadow+0x5c/0xf0 [ 143.698163][ C0] kmsan_slab_alloc+0x8d/0xe0 [ 143.702932][ C0] __kmalloc_node_track_caller+0xa48/0x1610 [ 143.708799][ C0] __alloc_skb+0x318/0xb00 [ 143.713192][ C0] alloc_skb_with_frags+0x1f3/0xc10 [ 143.718363][ C0] sock_alloc_send_pskb+0xcc4/0xe80 [ 143.723537][ C0] packet_sendmsg+0x6aab/0x9a60 [ 143.728364][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 143.733208][ C0] __sys_sendmmsg+0xa89/0x1070 [ 143.737978][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 143.742721][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 143.747568][ C0] do_syscall_64+0x9f/0x140 [ 143.752067][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 143.757943][ C0] ===================================================== [ 143.764861][ C0] Disabling lock debugging due to kernel taint [ 143.771003][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 143.777588][ C0] CPU: 0 PID: 8447 Comm: syz-executor335 Tainted: G B 5.10.0-rc4-syzkaller #0 [ 143.787816][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 143.797853][ C0] Call Trace: [ 143.801115][ C0] [ 143.803972][ C0] dump_stack+0x21c/0x280 [ 143.808305][ C0] panic+0x4c6/0xea7 [ 143.812179][ C0] ? add_taint+0x17c/0x210 [ 143.816576][ C0] kmsan_report+0x1de/0x1e0 [ 143.821053][ C0] __msan_warning+0x5f/0xa0 [ 143.825548][ C0] ip_rcv_core+0xf4c/0x1480 [ 143.830029][ C0] ip_rcv+0xc7/0x820 [ 143.833902][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.839091][ C0] __netif_receive_skb+0x1ec/0x640 [ 143.844198][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.849825][ C0] ? ip_local_deliver_finish+0x370/0x370 [ 143.855457][ C0] process_backlog+0x517/0xbd0 [ 143.860219][ C0] ? rps_trigger_softirq+0x2e0/0x2e0 [ 143.865483][ C0] napi_poll+0x40a/0x1020 [ 143.869808][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.875466][ C0] net_rx_action+0x34c/0xd30 [ 143.880034][ C0] ? net_tx_action+0xd30/0xd30 [ 143.884776][ C0] __do_softirq+0x1a9/0x6fa [ 143.889258][ C0] asm_call_irq_on_stack+0xf/0x20 [ 143.894273][ C0] [ 143.897192][ C0] do_softirq_own_stack+0x6e/0x90 [ 143.902189][ C0] __local_bh_enable_ip+0x184/0x1d0 [ 143.907366][ C0] local_bh_enable+0x36/0x40 [ 143.911951][ C0] __dev_queue_xmit+0x3b3e/0x4590 [ 143.916957][ C0] dev_queue_xmit+0x4b/0x60 [ 143.921436][ C0] ? netdev_core_pick_tx+0x5a0/0x5a0 [ 143.926714][ C0] packet_sendmsg+0x8778/0x9a60 [ 143.931561][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 143.937611][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.942786][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.947962][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.953571][ C0] ? kmsan_get_metadata+0x116/0x180 [ 143.958759][ C0] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 143.964544][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 143.970594][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 143.975424][ C0] ? packet_getsockopt+0x1120/0x1120 [ 143.980687][ C0] __sys_sendmmsg+0xa89/0x1070 [ 143.985433][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 143.991045][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 143.997090][ C0] ? kmsan_get_metadata+0x116/0x180 [ 144.002289][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 144.007913][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 144.016574][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 144.021319][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 144.026151][ C0] do_syscall_64+0x9f/0x140 [ 144.030633][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 144.036505][ C0] RIP: 0033:0x444489 [ 144.040377][ C0] Code: e8 6c 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 144.059974][ C0] RSP: 002b:00007fff91805138 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 144.068368][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000444489 [ 144.076328][ C0] RDX: 0000000000000001 RSI: 0000000020004e80 RDI: 0000000000000003 [ 144.084280][ C0] RBP: 00007fff91805150 R08: 00000000bb1414ac R09: 00000000bb1414ac [ 144.092229][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff91805180 [ 144.100240][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 144.108842][ C0] Kernel Offset: disabled [ 144.113158][ C0] Rebooting in 86400 seconds..