[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 93.576448] audit: type=1800 audit(1553662996.620:25): pid=10391 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 93.596086] audit: type=1800 audit(1553662996.620:26): pid=10391 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 93.615850] audit: type=1800 audit(1553662996.650:27): pid=10391 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.121' (ECDSA) to the list of known hosts. 2019/03/27 05:03:32 parsed 1 programs 2019/03/27 05:03:39 executed programs: 0 syzkaller login: [ 116.685828] IPVS: ftp: loaded support on port[0] = 21 [ 116.776998] chnl_net:caif_netlink_parms(): no params data found [ 116.822201] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.828686] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.836628] device bridge_slave_0 entered promiscuous mode [ 116.844356] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.850776] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.858795] device bridge_slave_1 entered promiscuous mode [ 116.881961] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 116.892504] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 116.915635] team0: Port device team_slave_0 added [ 116.923347] team0: Port device team_slave_1 added [ 116.984804] device hsr_slave_0 entered promiscuous mode [ 117.032302] device hsr_slave_1 entered promiscuous mode [ 117.084458] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.090928] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.098104] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.104618] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.155190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.169124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 117.178474] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.186561] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.194702] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 117.209367] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.221089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 117.229346] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.235814] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.249009] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 117.257211] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.263825] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.288796] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 117.298374] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 117.313018] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 117.325730] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 117.340191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 117.353071] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 117.379338] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.458015] ================================================================== [ 117.465447] BUG: KMSAN: uninit-value in gre_parse_header+0x1396/0x1690 [ 117.472143] CPU: 1 PID: 10560 Comm: syz-executor.0 Not tainted 5.0.0+ #17 [ 117.479075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 117.488429] Call Trace: [ 117.491002] [ 117.493182] dump_stack+0x173/0x1d0 [ 117.496827] kmsan_report+0x131/0x2a0 [ 117.500634] __msan_warning+0x7a/0xf0 [ 117.504440] gre_parse_header+0x1396/0x1690 [ 117.508779] gre_rcv+0x1db/0x1720 [ 117.512258] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 117.517624] ? raw_local_deliver+0xfc/0x1960 [ 117.522046] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 117.527432] ? erspan_xmit+0x38f0/0x38f0 [ 117.531491] gre_rcv+0x2dd/0x3c0 [ 117.534864] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 117.540057] ? gre_parse_header+0x1690/0x1690 [ 117.544546] ip_protocol_deliver_rcu+0x584/0xbb0 [ 117.549316] ip_local_deliver+0x624/0x7b0 [ 117.553470] ? ip_local_deliver+0x7b0/0x7b0 [ 117.557784] ? ip_protocol_deliver_rcu+0xbb0/0xbb0 [ 117.562706] ip_rcv+0x6bd/0x740 [ 117.566008] ? ip_rcv_core+0x11d0/0x11d0 [ 117.570081] process_backlog+0x756/0x10e0 [ 117.574235] ? pfifo_fast_enqueue+0x760/0x760 [ 117.578759] ? ip_local_deliver_finish+0x320/0x320 [ 117.583693] ? rps_trigger_softirq+0x2e0/0x2e0 [ 117.588280] net_rx_action+0x78b/0x1a60 [ 117.592299] ? net_tx_action+0xca0/0xca0 [ 117.596356] __do_softirq+0x53f/0x93a [ 117.600213] do_softirq_own_stack+0x49/0x80 [ 117.604544] [ 117.606785] __local_bh_enable_ip+0x16f/0x1a0 [ 117.611305] local_bh_enable+0x36/0x40 [ 117.615193] ip_finish_output2+0x1627/0x1820 [ 117.619626] ip_finish_output+0xd2b/0xfd0 [ 117.623791] ip_mc_output+0x117a/0x1700 [ 117.627802] ? ip_mc_finish_output+0x3b0/0x3b0 [ 117.632407] ? ip_build_and_send_pkt+0xe80/0xe80 [ 117.637158] raw_sendmsg+0x4182/0x4610 [ 117.641077] ? aa_sk_perm+0x605/0x950 [ 117.644881] ? raw_getfrag+0x590/0x590 [ 117.648785] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 117.653972] ? compat_raw_ioctl+0x100/0x100 [ 117.658297] inet_sendmsg+0x54a/0x720 [ 117.662146] ? inet_getname+0x490/0x490 [ 117.666124] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 117.671339] ? inet_getname+0x490/0x490 [ 117.675311] __sys_sendto+0x8c4/0xac0 [ 117.679533] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 117.684724] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 117.690171] ? prepare_exit_to_usermode+0x114/0x420 [ 117.695203] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 117.700395] ? syscall_return_slowpath+0x50/0x650 [ 117.705240] __se_sys_sendto+0x107/0x130 [ 117.710219] __x64_sys_sendto+0x6e/0x90 [ 117.714193] do_syscall_64+0xbc/0xf0 [ 117.717924] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 117.723136] RIP: 0033:0x458209 [ 117.726340] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 117.745253] RSP: 002b:00007ffdd1b51ac8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 117.753016] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458209 [ 117.760295] RDX: 00000000000005aa RSI: 00000000200000c0 RDI: 0000000000000003 [ 117.767588] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000120 [ 117.774859] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000274e914 [ 117.782146] R13: 00000000004c58b8 R14: 00000000004d9838 R15: 00000000ffffffff [ 117.789464] [ 117.791082] Uninit was stored to memory at: [ 117.795418] kmsan_internal_chain_origin+0x134/0x230 [ 117.800511] kmsan_memcpy_memmove_metadata+0xb5b/0xfe0 [ 117.805780] kmsan_memcpy_metadata+0xb/0x10 [ 117.810088] __msan_memcpy+0x58/0x70 [ 117.813795] pskb_expand_head+0x34c/0x18f0 [ 117.818027] ip_tunnel_xmit+0x3290/0x3ca0 [ 117.822167] erspan_xmit+0x27c7/0x38f0 [ 117.826053] dev_hard_start_xmit+0x604/0xc40 [ 117.830465] sch_direct_xmit+0x58a/0x880 [ 117.834521] __qdisc_run+0x1cb7/0x34d0 [ 117.838404] __dev_queue_xmit+0x215c/0x3b80 [ 117.842714] dev_queue_xmit+0x4b/0x60 [ 117.846503] neigh_resolve_output+0xab7/0xb40 [ 117.851005] ip_finish_output2+0x1611/0x1820 [ 117.855424] ip_finish_output+0xd2b/0xfd0 [ 117.859561] ip_mc_output+0x117a/0x1700 [ 117.863525] raw_sendmsg+0x4182/0x4610 [ 117.867405] inet_sendmsg+0x54a/0x720 [ 117.871197] __sys_sendto+0x8c4/0xac0 [ 117.874985] __se_sys_sendto+0x107/0x130 [ 117.879055] __x64_sys_sendto+0x6e/0x90 [ 117.883036] do_syscall_64+0xbc/0xf0 [ 117.886741] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 117.891919] [ 117.893559] Uninit was created at: [ 117.897090] kmsan_internal_poison_shadow+0x92/0x150 [ 117.902181] kmsan_kmalloc+0xa6/0x130 [ 117.905978] kmsan_slab_alloc+0xe/0x10 [ 117.909871] __kmalloc_node_track_caller+0xe9e/0xff0 [ 117.914962] __alloc_skb+0x309/0xa20 [ 117.918665] alloc_skb_with_frags+0x186/0xa60 [ 117.923149] sock_alloc_send_pskb+0xafd/0x10a0 [ 117.927716] sock_alloc_send_skb+0xca/0xe0 [ 117.931950] raw_sendmsg+0x25f5/0x4610 [ 117.935866] inet_sendmsg+0x54a/0x720 [ 117.939660] __sys_sendto+0x8c4/0xac0 [ 117.943470] __se_sys_sendto+0x107/0x130 [ 117.947521] __x64_sys_sendto+0x6e/0x90 [ 117.951671] do_syscall_64+0xbc/0xf0 [ 117.955394] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 117.960564] ================================================================== [ 117.967906] Disabling lock debugging due to kernel taint [ 117.973350] Kernel panic - not syncing: panic_on_warn set ... [ 117.979247] CPU: 1 PID: 10560 Comm: syz-executor.0 Tainted: G B 5.0.0+ #17 [ 117.987571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 117.996915] Call Trace: [ 117.999510] [ 118.001672] dump_stack+0x173/0x1d0 [ 118.005313] panic+0x3d1/0xb01 [ 118.008532] kmsan_report+0x29a/0x2a0 [ 118.012425] __msan_warning+0x7a/0xf0 [ 118.016222] gre_parse_header+0x1396/0x1690 [ 118.020874] gre_rcv+0x1db/0x1720 [ 118.024323] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 118.029939] ? raw_local_deliver+0xfc/0x1960 [ 118.034472] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 118.039854] ? erspan_xmit+0x38f0/0x38f0 [ 118.043929] gre_rcv+0x2dd/0x3c0 [ 118.047297] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 118.052484] ? gre_parse_header+0x1690/0x1690 [ 118.056976] ip_protocol_deliver_rcu+0x584/0xbb0 [ 118.061752] ip_local_deliver+0x624/0x7b0 [ 118.065908] ? ip_local_deliver+0x7b0/0x7b0 [ 118.070224] ? ip_protocol_deliver_rcu+0xbb0/0xbb0 [ 118.075152] ip_rcv+0x6bd/0x740 [ 118.078610] ? ip_rcv_core+0x11d0/0x11d0 [ 118.082669] process_backlog+0x756/0x10e0 [ 118.086812] ? pfifo_fast_enqueue+0x760/0x760 [ 118.091314] ? ip_local_deliver_finish+0x320/0x320 [ 118.096246] ? rps_trigger_softirq+0x2e0/0x2e0 [ 118.100857] net_rx_action+0x78b/0x1a60 [ 118.104883] ? net_tx_action+0xca0/0xca0 [ 118.108942] __do_softirq+0x53f/0x93a [ 118.112749] do_softirq_own_stack+0x49/0x80 [ 118.117057] [ 118.119294] __local_bh_enable_ip+0x16f/0x1a0 [ 118.123802] local_bh_enable+0x36/0x40 [ 118.127688] ip_finish_output2+0x1627/0x1820 [ 118.132136] ip_finish_output+0xd2b/0xfd0 [ 118.136317] ip_mc_output+0x117a/0x1700 [ 118.140316] ? ip_mc_finish_output+0x3b0/0x3b0 [ 118.144907] ? ip_build_and_send_pkt+0xe80/0xe80 [ 118.149745] raw_sendmsg+0x4182/0x4610 [ 118.153684] ? aa_sk_perm+0x605/0x950 [ 118.157491] ? raw_getfrag+0x590/0x590 [ 118.161391] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 118.166589] ? compat_raw_ioctl+0x100/0x100 [ 118.170901] inet_sendmsg+0x54a/0x720 [ 118.174712] ? inet_getname+0x490/0x490 [ 118.178684] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 118.183871] ? inet_getname+0x490/0x490 [ 118.187839] __sys_sendto+0x8c4/0xac0 [ 118.191672] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 118.196874] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 118.203728] ? prepare_exit_to_usermode+0x114/0x420 [ 118.208749] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 118.213929] ? syscall_return_slowpath+0x50/0x650 [ 118.218770] __se_sys_sendto+0x107/0x130 [ 118.222836] __x64_sys_sendto+0x6e/0x90 [ 118.226807] do_syscall_64+0xbc/0xf0 [ 118.230516] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 118.235697] RIP: 0033:0x458209 [ 118.238879] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 118.257774] RSP: 002b:00007ffdd1b51ac8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 118.265478] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458209 [ 118.272758] RDX: 00000000000005aa RSI: 00000000200000c0 RDI: 0000000000000003 [ 118.280016] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000120 [ 118.287284] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000274e914 [ 118.294555] R13: 00000000004c58b8 R14: 00000000004d9838 R15: 00000000ffffffff [ 118.302532] Kernel Offset: disabled [ 118.306183] Rebooting in 86400 seconds..