[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 82.820336][ T31] audit: type=1800 audit(1570556694.877:25): pid=12574 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 82.851895][ T31] audit: type=1800 audit(1570556694.907:26): pid=12574 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 82.872105][ T31] audit: type=1800 audit(1570556694.907:27): pid=12574 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.198' (ECDSA) to the list of known hosts. 2019/10/08 17:45:08 fuzzer started 2019/10/08 17:45:12 dialing manager at 10.128.0.26:43589 2019/10/08 17:45:13 syscalls: 2412 2019/10/08 17:45:13 code coverage: enabled 2019/10/08 17:45:13 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/10/08 17:45:13 extra coverage: enabled 2019/10/08 17:45:13 setuid sandbox: enabled 2019/10/08 17:45:13 namespace sandbox: enabled 2019/10/08 17:45:13 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/08 17:45:13 fault injection: enabled 2019/10/08 17:45:13 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/08 17:45:13 net packet injection: enabled 2019/10/08 17:45:13 net device setup: enabled 2019/10/08 17:45:13 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist syzkaller login: [ 137.622461][ C0] ===================================================== [ 137.629476][ C0] BUG: KMSAN: use-after-free in kfree_skb+0x473/0x4c0 [ 137.636309][ C0] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.3.0-rc7+ #0 [ 137.643574][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 137.653610][ C0] Call Trace: [ 137.656884][ C0] dump_stack+0x191/0x1f0 [ 137.661200][ C0] kmsan_report+0x17d/0x2f0 [ 137.665709][ C0] __msan_warning+0x73/0xe0 [ 137.670205][ C0] kmem_cache_free+0x3df/0x2b70 [ 137.675037][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 137.680662][ C0] ? kfree_skb+0x473/0x4c0 [ 137.685060][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x80 [ 137.691121][ C0] kfree_skb+0x473/0x4c0 [ 137.695357][ C0] ? packet_rcv_spkt+0x719/0x840 [ 137.700288][ C0] packet_rcv_spkt+0x719/0x840 [ 137.705038][ C0] ? packet_rcv+0x2190/0x2190 [ 137.709707][ C0] __netif_receive_skb_core+0x3aed/0x51a0 [ 137.715440][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 137.721323][ C0] netif_receive_skb_internal+0x3cc/0xc20 [ 137.727030][ C0] napi_gro_receive+0x682/0xb90 [ 137.731868][ C0] receive_buf+0x653b/0x8810 [ 137.736470][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 137.742346][ C0] virtnet_poll+0x666/0x19d0 [ 137.746935][ C0] ? refill_work+0x460/0x460 [ 137.751521][ C0] net_rx_action+0x74b/0x1950 [ 137.756192][ C0] ? net_tx_action+0xba0/0xba0 [ 137.760948][ C0] __do_softirq+0x4a1/0x83a [ 137.765442][ C0] ? ksoftirqd_should_run+0x30/0x30 [ 137.770618][ C0] ? takeover_tasklets+0x900/0x900 [ 137.775708][ C0] run_ksoftirqd+0x25/0x40 [ 137.780106][ C0] smpboot_thread_fn+0x4a3/0x990 [ 137.785030][ C0] kthread+0x4b5/0x4f0 [ 137.789084][ C0] ? cpu_report_death+0x190/0x190 [ 137.794122][ C0] ? kthread_blkcg+0xf0/0xf0 [ 137.798731][ C0] ret_from_fork+0x35/0x40 [ 137.803144][ C0] [ 137.805448][ C0] Uninit was stored to memory at: [ 137.810452][ C0] kmsan_internal_chain_origin+0xde/0x190 [ 137.816159][ C0] __msan_chain_origin+0x6b/0xe0 [ 137.821077][ C0] ___slab_alloc+0x1dbc/0x1fb0 [ 137.825818][ C0] kmem_cache_alloc+0xade/0xd10 [ 137.830643][ C0] skb_clone+0x326/0x5d0 [ 137.834865][ C0] packet_rcv_spkt+0x245/0x840 [ 137.839608][ C0] __netif_receive_skb_core+0x3aed/0x51a0 [ 137.845307][ C0] netif_receive_skb_internal+0x3cc/0xc20 [ 137.851002][ C0] napi_gro_receive+0x682/0xb90 [ 137.855836][ C0] receive_buf+0x653b/0x8810 [ 137.860401][ C0] virtnet_poll+0x666/0x19d0 [ 137.864968][ C0] net_rx_action+0x74b/0x1950 [ 137.869619][ C0] __do_softirq+0x4a1/0x83a [ 137.874110][ C0] run_ksoftirqd+0x25/0x40 [ 137.878507][ C0] smpboot_thread_fn+0x4a3/0x990 [ 137.883420][ C0] kthread+0x4b5/0x4f0 [ 137.887479][ C0] ret_from_fork+0x35/0x40 [ 137.891866][ C0] [ 137.894170][ C0] Uninit was created at: [ 137.898391][ C0] kmsan_internal_poison_shadow+0x60/0x120 [ 137.904175][ C0] kmsan_slab_free+0x8d/0x100 [ 137.908826][ C0] kmem_cache_free_bulk+0x3ad9/0x3f50 [ 137.914175][ C0] napi_consume_skb+0x593/0x5d0 [ 137.919012][ C0] free_old_xmit_skbs+0x1a1/0x450 [ 137.924021][ C0] virtnet_poll_tx+0x24c/0x4c0 [ 137.928779][ C0] net_rx_action+0x74b/0x1950 [ 137.933441][ C0] __do_softirq+0x4a1/0x83a [ 137.937933][ C0] irq_exit+0x230/0x280 [ 137.942076][ C0] do_IRQ+0x20d/0x3a0 [ 137.946047][ C0] ret_from_intr+0x0/0x33 [ 137.950376][ C0] default_idle+0x53/0x90 [ 137.954693][ C0] arch_cpu_idle+0x25/0x30 [ 137.959113][ C0] do_idle+0x1d7/0x790 [ 137.963172][ C0] cpu_startup_entry+0x45/0x50 [ 137.967987][ C0] start_secondary+0x370/0x470 [ 137.972727][ C0] secondary_startup_64+0xa4/0xb0 [ 137.977748][ C0] ===================================================== [ 137.984654][ C0] Disabling lock debugging due to kernel taint [ 137.990791][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 137.997371][ C0] CPU: 0 PID: 9 Comm: ksoftirqd/0 Tainted: G B 5.3.0-rc7+ #0 [ 138.006017][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 138.016062][ C0] Call Trace: [ 138.019371][ C0] dump_stack+0x191/0x1f0 [ 138.023709][ C0] panic+0x3c9/0xc1e [ 138.027614][ C0] kmsan_report+0x2e5/0x2f0 [ 138.032103][ C0] __msan_warning+0x73/0xe0 [ 138.036589][ C0] kmem_cache_free+0x3df/0x2b70 [ 138.041423][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 138.047123][ C0] ? kfree_skb+0x473/0x4c0 [ 138.051517][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x80 [ 138.057575][ C0] kfree_skb+0x473/0x4c0 [ 138.061800][ C0] ? packet_rcv_spkt+0x719/0x840 [ 138.066733][ C0] packet_rcv_spkt+0x719/0x840 [ 138.071491][ C0] ? packet_rcv+0x2190/0x2190 [ 138.076152][ C0] __netif_receive_skb_core+0x3aed/0x51a0 [ 138.081878][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 138.087757][ C0] netif_receive_skb_internal+0x3cc/0xc20 [ 138.093464][ C0] napi_gro_receive+0x682/0xb90 [ 138.098313][ C0] receive_buf+0x653b/0x8810 [ 138.102902][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 138.108787][ C0] virtnet_poll+0x666/0x19d0 [ 138.113380][ C0] ? refill_work+0x460/0x460 [ 138.117955][ C0] net_rx_action+0x74b/0x1950 [ 138.122620][ C0] ? net_tx_action+0xba0/0xba0 [ 138.127361][ C0] __do_softirq+0x4a1/0x83a [ 138.131863][ C0] ? ksoftirqd_should_run+0x30/0x30 [ 138.137058][ C0] ? takeover_tasklets+0x900/0x900 [ 138.142151][ C0] run_ksoftirqd+0x25/0x40 [ 138.146552][ C0] smpboot_thread_fn+0x4a3/0x990 [ 138.151478][ C0] kthread+0x4b5/0x4f0 [ 138.155526][ C0] ? cpu_report_death+0x190/0x190 [ 138.160639][ C0] ? kthread_blkcg+0xf0/0xf0 [ 138.165220][ C0] ret_from_fork+0x35/0x40 [ 138.171095][ C0] Kernel Offset: disabled [ 138.175424][ C0] Rebooting in 86400 seconds..