[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 108.065048][ T32] audit: type=1800 audit(1583595263.112:25): pid=11583 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 108.093446][ T32] audit: type=1800 audit(1583595263.142:26): pid=11583 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 108.138418][ T32] audit: type=1800 audit(1583595263.162:27): pid=11583 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.15' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 137.868686][T11736] ===================================================== [ 137.875859][T11736] BUG: KMSAN: uninit-value in __iptunnel_pull_header+0x30c/0xbd0 [ 137.883599][T11736] CPU: 0 PID: 11736 Comm: syz-executor147 Not tainted 5.6.0-rc2-syzkaller #0 [ 137.892363][T11736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 137.902889][T11736] Call Trace: [ 137.906217][T11736] dump_stack+0x1c9/0x220 [ 137.910573][T11736] kmsan_report+0xf7/0x1e0 executing program [ 137.915015][T11736] __msan_warning+0x58/0xa0 [ 137.919891][T11736] __iptunnel_pull_header+0x30c/0xbd0 [ 137.925393][T11736] gre_rcv+0x15e/0x19c0 [ 137.929662][T11736] ? __local_bh_enable_ip+0x97/0x1d0 [ 137.934982][T11736] ? ipv6_chk_mcast_addr+0x713/0x7d0 [ 137.940297][T11736] ? kmsan_get_metadata+0x11d/0x180 [ 137.945520][T11736] ip6_protocol_deliver_rcu+0x181b/0x22c0 [ 137.951292][T11736] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 137.957186][T11736] ? ipv6_confirm+0x257/0x650 [ 137.961891][T11736] ip6_mc_input+0xdf2/0x1460 [ 137.966494][T11736] ? ip6_input+0x340/0x340 [ 137.970904][T11736] ? ip6_input_finish+0xa0/0xa0 [ 137.975770][T11736] ipv6_rcv+0x683/0x710 [ 137.979939][T11736] ? local_bh_enable+0x40/0x40 [ 137.984699][T11736] netif_receive_skb+0x66b/0xf20 [ 137.989643][T11736] ? __msan_poison_alloca+0xf0/0x120 [ 137.994930][T11736] tun_get_user+0x6aef/0x6f60 [ 137.999669][T11736] ? kmsan_get_metadata+0x11d/0x180 [ 138.004863][T11736] tun_chr_write_iter+0x1f2/0x360 [ 138.009885][T11736] ? tun_chr_read_iter+0x460/0x460 [ 138.014989][T11736] __vfs_write+0xa5a/0xca0 [ 138.019420][T11736] vfs_write+0x44a/0x8f0 [ 138.023664][T11736] ksys_write+0x267/0x450 [ 138.027996][T11736] __se_sys_write+0x92/0xb0 [ 138.032732][T11736] __x64_sys_write+0x4a/0x70 [ 138.037336][T11736] do_syscall_64+0xb8/0x160 [ 138.041886][T11736] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 138.047797][T11736] RIP: 0033:0x441379 [ 138.051703][T11736] Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 138.071301][T11736] RSP: 002b:00007ffd3e8e4c18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.079705][T11736] RAX: ffffffffffffffda RBX: 0000000000003172 RCX: 0000000000441379 [ 138.087680][T11736] RDX: 0000000000000fca RSI: 0000000020002580 RDI: 0000000000000003 [ 138.095644][T11736] RBP: 656c6c616b7a7973 R08: 00000000004002c8 R09: 00000000004002c8 [ 138.103606][T11736] R10: 00000000004002c8 R11: 0000000000000246 R12: 00000000004020f0 [ 138.111568][T11736] R13: 0000000000402180 R14: 0000000000000000 R15: 0000000000000000 [ 138.119540][T11736] [ 138.121854][T11736] Uninit was created at: [ 138.126090][T11736] kmsan_internal_poison_shadow+0x66/0xd0 [ 138.131819][T11736] kmsan_slab_alloc+0x8a/0xe0 [ 138.136482][T11736] __kmalloc_node_track_caller+0xb40/0x1200 [ 138.142364][T11736] __alloc_skb+0x2fd/0xac0 [ 138.146769][T11736] alloc_skb_with_frags+0x18c/0xa70 [ 138.151969][T11736] sock_alloc_send_pskb+0xada/0xc60 [ 138.157155][T11736] tun_get_user+0x10ae/0x6f60 [ 138.161821][T11736] tun_chr_write_iter+0x1f2/0x360 [ 138.166832][T11736] __vfs_write+0xa5a/0xca0 [ 138.171235][T11736] vfs_write+0x44a/0x8f0 [ 138.175485][T11736] ksys_write+0x267/0x450 [ 138.179804][T11736] __se_sys_write+0x92/0xb0 [ 138.184296][T11736] __x64_sys_write+0x4a/0x70 [ 138.188879][T11736] do_syscall_64+0xb8/0x160 [ 138.193373][T11736] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 138.199244][T11736] ===================================================== [ 138.206162][T11736] Disabling lock debugging due to kernel taint [ 138.212299][T11736] Kernel panic - not syncing: panic_on_warn set ... [ 138.218876][T11736] CPU: 0 PID: 11736 Comm: syz-executor147 Tainted: G B 5.6.0-rc2-syzkaller #0 [ 138.229036][T11736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 138.239111][T11736] Call Trace: [ 138.242513][T11736] dump_stack+0x1c9/0x220 [ 138.246849][T11736] panic+0x3d5/0xc3e [ 138.250776][T11736] kmsan_report+0x1df/0x1e0 [ 138.255282][T11736] __msan_warning+0x58/0xa0 [ 138.259811][T11736] __iptunnel_pull_header+0x30c/0xbd0 [ 138.265217][T11736] gre_rcv+0x15e/0x19c0 [ 138.269372][T11736] ? __local_bh_enable_ip+0x97/0x1d0 [ 138.275212][T11736] ? ipv6_chk_mcast_addr+0x713/0x7d0 [ 138.280594][T11736] ? kmsan_get_metadata+0x11d/0x180 [ 138.285799][T11736] ip6_protocol_deliver_rcu+0x181b/0x22c0 [ 138.291525][T11736] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 138.297332][T11736] ? ipv6_confirm+0x257/0x650 [ 138.302030][T11736] ip6_mc_input+0xdf2/0x1460 [ 138.306634][T11736] ? ip6_input+0x340/0x340 [ 138.311052][T11736] ? ip6_input_finish+0xa0/0xa0 [ 138.315891][T11736] ipv6_rcv+0x683/0x710 [ 138.320044][T11736] ? local_bh_enable+0x40/0x40 [ 138.324803][T11736] netif_receive_skb+0x66b/0xf20 [ 138.330189][T11736] ? __msan_poison_alloca+0xf0/0x120 [ 138.335473][T11736] tun_get_user+0x6aef/0x6f60 [ 138.340178][T11736] ? kmsan_get_metadata+0x11d/0x180 [ 138.345373][T11736] tun_chr_write_iter+0x1f2/0x360 [ 138.350416][T11736] ? tun_chr_read_iter+0x460/0x460 [ 138.355536][T11736] __vfs_write+0xa5a/0xca0 [ 138.359984][T11736] vfs_write+0x44a/0x8f0 [ 138.364254][T11736] ksys_write+0x267/0x450 [ 138.368612][T11736] __se_sys_write+0x92/0xb0 [ 138.373156][T11736] __x64_sys_write+0x4a/0x70 [ 138.379481][T11736] do_syscall_64+0xb8/0x160 [ 138.383991][T11736] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 138.389877][T11736] RIP: 0033:0x441379 [ 138.393776][T11736] Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 138.413556][T11736] RSP: 002b:00007ffd3e8e4c18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.421962][T11736] RAX: ffffffffffffffda RBX: 0000000000003172 RCX: 0000000000441379 [ 138.429933][T11736] RDX: 0000000000000fca RSI: 0000000020002580 RDI: 0000000000000003 [ 138.437894][T11736] RBP: 656c6c616b7a7973 R08: 00000000004002c8 R09: 00000000004002c8 [ 138.445852][T11736] R10: 00000000004002c8 R11: 0000000000000246 R12: 00000000004020f0 [ 138.453811][T11736] R13: 0000000000402180 R14: 0000000000000000 R15: 0000000000000000 [ 138.463204][T11736] Kernel Offset: 0x2bc00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 138.474827][T11736] Rebooting in 86400 seconds..