[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 94.349858] audit: type=1800 audit(1546181985.395:25): pid=11327 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 94.369046] audit: type=1800 audit(1546181985.395:26): pid=11327 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 94.388481] audit: type=1800 audit(1546181985.425:27): pid=11327 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.126' (ECDSA) to the list of known hosts. 2018/12/30 14:59:58 fuzzer started 2018/12/30 15:00:02 dialing manager at 10.128.0.26:36695 2018/12/30 15:00:02 syscalls: 1 2018/12/30 15:00:02 code coverage: enabled 2018/12/30 15:00:02 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/12/30 15:00:02 setuid sandbox: enabled 2018/12/30 15:00:02 namespace sandbox: enabled 2018/12/30 15:00:02 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/30 15:00:02 fault injection: enabled 2018/12/30 15:00:02 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/30 15:00:02 net packet injection: enabled 2018/12/30 15:00:02 net device setup: enabled 15:02:49 executing program 0: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) creat(0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r0, 0x2081fc) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0) read(r1, &(0x7f0000000000)=""/250, 0x128b9372) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syzkaller login: [ 279.471961] IPVS: ftp: loaded support on port[0] = 21 [ 279.625442] chnl_net:caif_netlink_parms(): no params data found [ 279.692673] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.699189] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.707526] device bridge_slave_0 entered promiscuous mode [ 279.716653] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.723234] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.731635] device bridge_slave_1 entered promiscuous mode [ 279.764998] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 279.776813] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 279.806107] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 279.814672] team0: Port device team_slave_0 added [ 279.821468] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 279.830242] team0: Port device team_slave_1 added [ 279.836892] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 279.845267] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 280.005844] device hsr_slave_0 entered promiscuous mode [ 280.132549] device hsr_slave_1 entered promiscuous mode [ 280.393544] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 280.400990] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 280.431059] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.437618] bridge0: port 2(bridge_slave_1) entered forwarding state [ 280.444937] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.451541] bridge0: port 1(bridge_slave_0) entered forwarding state [ 280.539728] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 280.546017] 8021q: adding VLAN 0 to HW filter on device bond0 [ 280.558578] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 280.573406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 280.585137] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.593771] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.604816] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 280.621282] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 280.627457] 8021q: adding VLAN 0 to HW filter on device team0 [ 280.642722] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 280.649875] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 280.658732] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 280.667037] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.673580] bridge0: port 1(bridge_slave_0) entered forwarding state [ 280.688328] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 280.695819] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 280.704597] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 280.712879] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.719372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 280.733664] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 280.741811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 280.755679] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 280.762742] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 280.779407] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 280.786500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 280.795298] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 280.810271] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 280.817615] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 280.825718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 280.834536] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 280.849782] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 280.862555] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 280.872496] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 280.882249] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 280.894280] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 280.901923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 280.910455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 280.919284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 280.927747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 280.952498] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 280.959400] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 280.982735] 8021q: adding VLAN 0 to HW filter on device batadv0 15:02:52 executing program 0: creat(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000180)=@md0='/dev/md0\x00', &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='gfs2\x00', 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) write(0xffffffffffffffff, 0x0, 0x0) mq_open(0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 15:02:52 executing program 0: socketpair(0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000180)=@md0='/dev/md0\x00', &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='gfs2\x00', 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) 15:02:53 executing program 0: gettid() chdir(0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) prctl$PR_GET_PDEATHSIG(0x2, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x0, 0x0) r1 = dup(r0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, 0x0) write$P9_RGETATTR(0xffffffffffffffff, 0x0, 0xfffffffffffffeec) times(0x0) getegid() preadv(r1, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) 15:02:53 executing program 0: gettid() chdir(0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) prctl$PR_GET_PDEATHSIG(0x2, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x0, 0x0) r1 = dup(r0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, 0x0) write$P9_RGETATTR(0xffffffffffffffff, 0x0, 0xfffffffffffffeec) times(0x0) getegid() preadv(r1, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) 15:02:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x20001000008912, &(0x7f0000000040)="0af51f023c123f3188a070") r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$inet_sctp(r1, &(0x7f00000007c0)={&(0x7f0000000180)=@in={0x2, 0x0, @loopback}, 0x10, &(0x7f0000000640), 0x80, &(0x7f0000000240)=[@prinfo={0x18, 0x84, 0x7}], 0x18}, 0x0) 15:02:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket(0x1e, 0x1, 0x0) sendmsg(r1, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0xb) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) [ 282.429082] ================================================================== [ 282.436492] BUG: KMSAN: uninit-value in tipc_conn_rcv_sub+0x187/0x9d0 [ 282.443086] CPU: 0 PID: 305 Comm: kworker/u4:7 Not tainted 4.20.0-rc7+ #1 [ 282.450012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 282.459398] Workqueue: tipc_rcv tipc_conn_recv_work [ 282.464420] Call Trace: [ 282.467027] dump_stack+0x173/0x1d0 [ 282.470689] kmsan_report+0x12e/0x2a0 [ 282.474515] __msan_warning+0x82/0xf0 [ 282.478392] tipc_conn_rcv_sub+0x187/0x9d0 [ 282.482684] tipc_conn_recv_work+0x3dc/0x5e0 [ 282.487159] ? tipc_conn_send_work+0x11a0/0x11a0 [ 282.491930] ? tipc_conn_send_work+0x11a0/0x11a0 [ 282.496710] process_one_work+0x1607/0x1f80 [ 282.501084] worker_thread+0x111c/0x2460 [ 282.505195] kthread+0x4a1/0x4e0 [ 282.508623] ? process_one_work+0x1f80/0x1f80 [ 282.513125] ? schedule_tail+0x1b2/0x410 [ 282.517204] ? kthread_blkcg+0xf0/0xf0 [ 282.521110] ret_from_fork+0x35/0x40 [ 282.524853] 15:02:53 executing program 1: mlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000040)={0x6}) write$binfmt_elf32(r0, &(0x7f0000000080)={{0x7f, 0x45, 0x4c, 0x46, 0x401, 0xd3b7, 0x0, 0x1, 0xefb, 0x3, 0x0, 0x80000000, 0x38c, 0x38, 0x17e, 0x8000, 0x0, 0x20, 0x2, 0x8, 0x100000000, 0x3}, [{0x60000000, 0x1000, 0x40, 0x540, 0x8001, 0x100, 0x3f, 0x1}], "3fd270d440dfbf85edf0baf7719ae20d2cc550d918b3c29ea8c7ff9611513dd5f990081ef02c9875bf106e629f1dae2a04c438b9996cb437dc8fc4c8f9d329e493bb4bd8dff14d84321b70d991f05463b074673236cc7288767d9ca60b00a190fd99", [[]]}, 0x1ba) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000240)=0x8, 0x4) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VIDIOC_S_FBUF(r0, 0x4030560b, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000280)="25caf2da209a353a020f1881d98d28656d03bd8ae809c6892dcbf069140fb2243067f92744734acaa86bd961ec5f2d786ec4be2a1302f5208726703f155e941a3a1d40c27a4d1bd9f0a762e9a94d52163cf14dbbc74919fdb3fc47d4c1177882a227d324ccb38e6b7f71da20986dd1d196fc8209c35acee539f0c8034f092b7b3c85b40e8fc9fd4a8df6", {0x0, 0x5, 0x39565559, 0xd246de19baa974e9, 0x3, 0x1, 0x8, 0x6}}) ioctl$KVM_PPC_ALLOCATE_HTAB(r0, 0xc004aea7, &(0x7f0000000380)=0x100) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x9) clone(0x80000, &(0x7f00000003c0)="14ba2feb75593025b0e5852426c065e6430ba069e0d3807e268bb5d590c1995d0ef7a4b22f9f89f0e6d67aa99074c91bf08f245426f8a616617fcdce34d7e139820a26927a1486c43ab99b6001214facb315f71337f8f3295575536bfade1b2260e6475336bf95abee7c8fad73d08d753eb5826c705b86d26d6b19b15d2f48ebd745ecab69a4b6c1e037910b0ef3b8b9ab5a8afd50ae37f3769055dc6b08982c4756ebbc3e62d35e2c3641b29074e23f54cbda78fe0f7ce04103c218fd93436f33b6cb7fc700bd2108dcee7e", &(0x7f00000004c0), &(0x7f0000000500), &(0x7f0000000540)="27bb0026993fca5793a2c0483c6c5eaeb983851a5be594fb6b61d705ff00b6544524ee7166b240281d0c7b8dc4d7828fc59a997673953df908aecf9f2bacf184263c0d9860852487f0b8f5f867a0256b30fb5a61516e638b535006afa8755cfbb7bea44841f1c6c6e06683c881a06290af9f92b6c6155440") ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x0) r2 = openat$cgroup_type(r0, &(0x7f00000005c0)='cgroup.type\x00', 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000600)={0x40, 0x0, 0x10002, 0x3}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000640)={r3, 0x5}) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000680), 0x4) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f00000006c0), &(0x7f0000000700)=0x18) r4 = syz_open_dev$sndtimer(&(0x7f0000000740)='/dev/snd/timer\x00', 0x0, 0x10000) fadvise64(r2, 0x0, 0x7, 0x4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r4) sync_file_range(r1, 0xfffffffffffeffff, 0x200, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000007c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000780)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000800)={0x8, 0x120, 0xfa00, {0x2, {0xfff, 0x2, "b6ca5adb725d169e9335fbd1b28f21d4b6ff0f09d38312be198e84501ea667c9b5639dc67cc1b8358d63dd2ff4aa3b121df7d439ef9bcf5677bf427f5be0dd85cb8e2bb8e4193ece2e78646a598aa3467bc836fec0ef78ebf6df0aae5f8e3b4ba4d849eb35a55ce6050aef479a5850a04a0f448b9899952ef29ba79fc656a9d250113b6d470fd441db7a7c388dba844f8993838332a70db695a7a6146307464eb36c0d9331036e4327c83c4d03befd7e1b018c9eaa661ce76603a535db4103ecc1a19b715291d5ac4f8df182767245fdc9589cbcfe6003120a110c674a25e38b69a60f60bddc14736125b08afc6d7f7c6646e0759e3e89cc4e0823fa6f10060f", 0xb7, 0x2, 0x8, 0x4, 0x7c9e, 0x40, 0xffffffff, 0x8}, r5}}, 0x128) r6 = socket(0x1b, 0x0, 0x9) setsockopt$netlink_NETLINK_CAP_ACK(r6, 0x10e, 0xa, &(0x7f0000000940)=0x8, 0x4) r7 = shmget(0x3, 0x1000, 0x1188, &(0x7f0000ffc000/0x1000)=nil) shmctl$IPC_RMID(r7, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000980)={'veth1_to_bond\x00', 0xfffffffffffffffa}) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000a00)={@loopback, 0x0}, &(0x7f0000000a40)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000a80)={'vcan0\x00', r8}) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000ac0), &(0x7f0000000b40)=0x68) [ 282.526484] Local variable description: ----s.i@tipc_conn_recv_work [ 282.532882] Variable was created at: [ 282.536609] tipc_conn_recv_work+0x68/0x5e0 [ 282.540949] process_one_work+0x1607/0x1f80 [ 282.545302] ================================================================== [ 282.552671] Disabling lock debugging due to kernel taint [ 282.558129] Kernel panic - not syncing: panic_on_warn set ... [ 282.564028] CPU: 0 PID: 305 Comm: kworker/u4:7 Tainted: G B 4.20.0-rc7+ #1 [ 282.572353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 282.581727] Workqueue: tipc_rcv tipc_conn_recv_work [ 282.586748] Call Trace: [ 282.589356] dump_stack+0x173/0x1d0 [ 282.593041] panic+0x3ce/0x961 [ 282.596300] kmsan_report+0x293/0x2a0 [ 282.600154] __msan_warning+0x82/0xf0 [ 282.603981] tipc_conn_rcv_sub+0x187/0x9d0 [ 282.608267] tipc_conn_recv_work+0x3dc/0x5e0 [ 282.612750] ? tipc_conn_send_work+0x11a0/0x11a0 [ 282.617539] ? tipc_conn_send_work+0x11a0/0x11a0 [ 282.622331] process_one_work+0x1607/0x1f80 [ 282.626736] worker_thread+0x111c/0x2460 [ 282.630869] kthread+0x4a1/0x4e0 [ 282.634257] ? process_one_work+0x1f80/0x1f80 [ 282.638772] ? schedule_tail+0x1b2/0x410 [ 282.642875] ? kthread_blkcg+0xf0/0xf0 [ 282.646790] ret_from_fork+0x35/0x40 [ 282.651528] Kernel Offset: disabled [ 282.655157] Rebooting in 86400 seconds..