[ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.239' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 627.596077][ T8812] IPVS: ftp: loaded support on port[0] = 21 executing program [ 627.662528][ T33] audit: type=1800 audit(1585429013.697:8): pid=8834 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor327" name="bus" dev="sda1" ino=15700 res=0 [ 627.683696][ T33] audit: type=1804 audit(1585429013.697:9): pid=8834 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor327" name="/root/syzkaller.aiBnkI/0/bus" dev="sda1" ino=15700 res=1 executing program [ 627.714451][ T33] audit: type=1800 audit(1585429013.757:10): pid=8837 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor327" name="bus" dev="sda1" ino=15700 res=0 [ 627.735852][ T33] audit: type=1804 audit(1585429013.757:11): pid=8837 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor327" name="/root/syzkaller.aiBnkI/1/bus" dev="sda1" ino=15700 res=1 executing program [ 627.769910][ T33] audit: type=1800 audit(1585429013.807:12): pid=8840 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor327" name="bus" dev="sda1" ino=15700 res=0 [ 627.791026][ T33] audit: type=1804 audit(1585429013.817:13): pid=8840 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor327" name="/root/syzkaller.aiBnkI/2/bus" dev="sda1" ino=15700 res=1 executing program [ 627.820902][ T33] audit: type=1800 audit(1585429013.857:14): pid=8843 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor327" name="bus" dev="sda1" ino=15700 res=0 [ 627.841816][ T33] audit: type=1804 audit(1585429013.867:15): pid=8843 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor327" name="/root/syzkaller.aiBnkI/3/bus" dev="sda1" ino=15700 res=1 executing program executing program [ 627.875362][ T33] audit: type=1800 audit(1585429013.917:16): pid=8846 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor327" name="bus" dev="sda1" ino=15700 res=0 [ 627.896410][ T33] audit: type=1804 audit(1585429013.917:17): pid=8846 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor327" name="/root/syzkaller.aiBnkI/4/bus" dev="sda1" ino=15700 res=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 628.110680][ T8881] ===================================================== [ 628.117807][ T8881] BUG: KMSAN: uninit-value in kmsan_handle_dma+0x9f/0xb0 [ 628.124813][ T8881] CPU: 1 PID: 8881 Comm: syz-executor327 Not tainted 5.6.0-rc7-syzkaller #0 [ 628.133459][ T8881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 628.143501][ T8881] Call Trace: [ 628.146831][ T8881] dump_stack+0x1c9/0x220 [ 628.151153][ T8881] kmsan_report+0xf7/0x1e0 [ 628.155561][ T8881] kmsan_internal_check_memory+0x238/0x3d0 [ 628.161347][ T8881] ? kmsan_task_context_state+0x47/0x90 [ 628.166884][ T8881] kmsan_handle_dma+0x9f/0xb0 [ 628.171561][ T8881] virtqueue_add+0x46db/0x70f0 [ 628.176319][ T8881] ? kmsan_task_context_state+0x47/0x90 [ 628.181854][ T8881] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 628.187917][ T8881] ? update_stack_state+0xa18/0xb40 [ 628.193116][ T8881] ? __module_address+0x68/0x600 [ 628.198059][ T8881] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 628.204118][ T8881] ? is_bpf_image_address+0x267/0x2b0 [ 628.209495][ T8881] virtqueue_add_sgs+0x319/0x330 [ 628.214431][ T8881] virtscsi_add_cmd+0x888/0xb20 [ 628.219281][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.224463][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.230250][ T8881] virtscsi_queuecommand+0xe7e/0x1090 [ 628.235612][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.241413][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.246596][ T8881] ? virtscsi_init+0x1220/0x1220 [ 628.251531][ T8881] scsi_queue_rq+0x41c5/0x4d20 [ 628.256307][ T8881] ? scsi_vpd_tpg_id+0x3e0/0x3e0 [ 628.261238][ T8881] blk_mq_dispatch_rq_list+0xf81/0x2850 [ 628.266779][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.272581][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.277776][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.283694][ T8881] ? __list_add_valid+0xb8/0x420 [ 628.288629][ T8881] blk_mq_sched_dispatch_requests+0xbe0/0x1840 [ 628.294805][ T8881] ? rb_insert_color+0xbcd/0x1180 [ 628.299828][ T8881] __blk_mq_run_hw_queue+0x171/0x3a0 [ 628.305102][ T8881] __blk_mq_delay_run_hw_queue+0x15d/0x6a0 [ 628.310895][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.316077][ T8881] blk_mq_run_hw_queue+0x4ac/0x670 [ 628.321207][ T8881] blk_mq_sched_insert_requests+0x496/0x640 [ 628.327108][ T8881] blk_mq_flush_plug_list+0xb31/0xca0 [ 628.332469][ T8881] blk_flush_plug_list+0x70f/0x790 [ 628.337638][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.342825][ T8881] blk_finish_plug+0xa0/0xd0 [ 628.347399][ T8881] ext4_writepages+0x57e1/0x62a0 [ 628.352365][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.358158][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.363393][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.368632][ T8881] ? ext4_readpage+0x440/0x440 [ 628.373423][ T8881] do_writepages+0x143/0x400 [ 628.378036][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.383256][ T8881] __filemap_fdatawrite_range+0x53b/0x5b0 [ 628.388987][ T8881] filemap_flush+0x66/0x70 [ 628.393384][ T8881] ext4_alloc_da_blocks+0x22d/0x290 [ 628.398645][ T8881] ext4_release_file+0xa0/0x3e0 [ 628.403542][ T8881] ? ext4_file_open+0xb50/0xb50 [ 628.408374][ T8881] __fput+0x4c7/0xb90 [ 628.412356][ T8881] ____fput+0x37/0x40 [ 628.416330][ T8881] ? fput_many+0x2a0/0x2a0 [ 628.420728][ T8881] task_work_run+0x214/0x2b0 [ 628.425306][ T8881] prepare_exit_to_usermode+0x3c8/0x520 [ 628.430847][ T8881] syscall_return_slowpath+0x95/0x5f0 [ 628.436244][ T8881] ? kmsan_get_metadata+0x4f/0x180 [ 628.441338][ T8881] do_fast_syscall_32+0x422/0x6e0 [ 628.446379][ T8881] entry_SYSENTER_compat+0x68/0x77 [ 628.451520][ T8881] RIP: 0023:0xf7f86d99 [ 628.455570][ T8881] Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 628.475163][ T8881] RSP: 002b:00000000ffd8507c EFLAGS: 00000296 ORIG_RAX: 0000000000000006 [ 628.483611][ T8881] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 628.491566][ T8881] RDX: 0000000000000004 RSI: 00000000080fd00c RDI: 0000000000000006 [ 628.499637][ T8881] RBP: 00000000ffd850c4 R08: 0000000000000000 R09: 0000000000000000 [ 628.507663][ T8881] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 628.515621][ T8881] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 628.523581][ T8881] [ 628.525891][ T8881] Uninit was stored to memory at: [ 628.530897][ T8881] kmsan_internal_chain_origin+0xad/0x130 [ 628.536596][ T8881] kmsan_memcpy_memmove_metadata+0x272/0x2e0 [ 628.542577][ T8881] kmsan_memcpy_metadata+0xb/0x10 [ 628.547624][ T8881] __msan_memcpy+0x43/0x50 [ 628.552032][ T8881] iov_iter_copy_from_user_atomic+0xf5b/0x1500 [ 628.558164][ T8881] generic_perform_write+0x499/0x9a0 [ 628.563452][ T8881] ext4_buffered_write_iter+0x795/0xac0 [ 628.568984][ T8881] ext4_file_write_iter+0x1330/0x2c70 [ 628.574336][ T8881] do_iter_readv_writev+0xa23/0xc70 [ 628.579524][ T8881] do_iter_write+0x304/0xdc0 [ 628.584102][ T8881] vfs_iter_write+0x118/0x180 [ 628.588767][ T8881] iter_file_splice_write+0xb1b/0x17b0 [ 628.594266][ T8881] direct_splice_actor+0x19e/0x200 [ 628.599416][ T8881] splice_direct_to_actor+0x8a9/0x11e0 [ 628.604859][ T8881] do_splice_direct+0x342/0x580 [ 628.609737][ T8881] do_sendfile+0xff5/0x1d10 [ 628.614219][ T8881] __se_compat_sys_sendfile+0x301/0x3c0 [ 628.619740][ T8881] __ia32_compat_sys_sendfile+0x11a/0x160 [ 628.625441][ T8881] do_fast_syscall_32+0x3c7/0x6e0 [ 628.630464][ T8881] entry_SYSENTER_compat+0x68/0x77 [ 628.635544][ T8881] [ 628.637848][ T8881] Uninit was stored to memory at: [ 628.642954][ T8881] kmsan_internal_chain_origin+0xad/0x130 [ 628.648650][ T8881] kmsan_memcpy_memmove_metadata+0x272/0x2e0 [ 628.654608][ T8881] kmsan_memcpy_metadata+0xb/0x10 [ 628.659610][ T8881] kmsan_copy_to_user+0x50/0x90 [ 628.664440][ T8881] _copy_to_user+0x15a/0x1f0 [ 628.669021][ T8881] __do_proc_dointvec+0xed3/0x1a70 [ 628.674117][ T8881] proc_dointvec+0x139/0x160 [ 628.678698][ T8881] proc_sys_call_handler+0xa92/0xd00 [ 628.683956][ T8881] proc_sys_read+0xc6/0xe0 [ 628.688349][ T8881] do_iter_read+0x8df/0xe10 [ 628.692826][ T8881] vfs_readv+0x1ee/0x280 [ 628.697118][ T8881] default_file_splice_read+0xb1d/0x11d0 [ 628.702744][ T8881] splice_direct_to_actor+0x5d8/0x11e0 [ 628.708197][ T8881] do_splice_direct+0x342/0x580 [ 628.713022][ T8881] do_sendfile+0xff5/0x1d10 [ 628.717505][ T8881] __se_compat_sys_sendfile+0x301/0x3c0 [ 628.723051][ T8881] __ia32_compat_sys_sendfile+0x11a/0x160 [ 628.728769][ T8881] do_fast_syscall_32+0x3c7/0x6e0 [ 628.733774][ T8881] entry_SYSENTER_compat+0x68/0x77 [ 628.738858][ T8881] [ 628.741159][ T8881] Local variable ----tmp.i@__do_proc_dointvec created at: [ 628.748255][ T8881] __do_proc_dointvec+0xd1b/0x1a70 [ 628.753342][ T8881] __do_proc_dointvec+0xd1b/0x1a70 [ 628.758421][ T8881] [ 628.760737][ T8881] Byte 1 of 4096 is uninitialized [ 628.765731][ T8881] Memory access of size 4096 starts at ffff9e1ef3e37000 [ 628.772645][ T8881] ===================================================== [ 628.779622][ T8881] Disabling lock debugging due to kernel taint [ 628.785804][ T8881] Kernel panic - not syncing: panic_on_warn set ... [ 628.792407][ T8881] CPU: 1 PID: 8881 Comm: syz-executor327 Tainted: G B 5.6.0-rc7-syzkaller #0 [ 628.802446][ T8881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 628.812492][ T8881] Call Trace: [ 628.815792][ T8881] dump_stack+0x1c9/0x220 [ 628.820120][ T8881] panic+0x3d5/0xc3e [ 628.824027][ T8881] kmsan_report+0x1df/0x1e0 [ 628.828555][ T8881] kmsan_internal_check_memory+0x238/0x3d0 [ 628.834368][ T8881] ? kmsan_task_context_state+0x47/0x90 [ 628.839902][ T8881] kmsan_handle_dma+0x9f/0xb0 [ 628.844561][ T8881] virtqueue_add+0x46db/0x70f0 [ 628.849305][ T8881] ? kmsan_task_context_state+0x47/0x90 [ 628.854853][ T8881] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 628.860900][ T8881] ? update_stack_state+0xa18/0xb40 [ 628.866103][ T8881] ? __module_address+0x68/0x600 [ 628.871038][ T8881] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 628.877118][ T8881] ? is_bpf_image_address+0x267/0x2b0 [ 628.882506][ T8881] virtqueue_add_sgs+0x319/0x330 [ 628.887450][ T8881] virtscsi_add_cmd+0x888/0xb20 [ 628.892302][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.897540][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.903359][ T8881] virtscsi_queuecommand+0xe7e/0x1090 [ 628.908739][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.914533][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.919714][ T8881] ? virtscsi_init+0x1220/0x1220 [ 628.924633][ T8881] scsi_queue_rq+0x41c5/0x4d20 [ 628.929896][ T8881] ? scsi_vpd_tpg_id+0x3e0/0x3e0 [ 628.934852][ T8881] blk_mq_dispatch_rq_list+0xf81/0x2850 [ 628.940490][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.946281][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.951474][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 628.957294][ T8881] ? __list_add_valid+0xb8/0x420 [ 628.962233][ T8881] blk_mq_sched_dispatch_requests+0xbe0/0x1840 [ 628.968367][ T8881] ? rb_insert_color+0xbcd/0x1180 [ 628.973396][ T8881] __blk_mq_run_hw_queue+0x171/0x3a0 [ 628.978779][ T8881] __blk_mq_delay_run_hw_queue+0x15d/0x6a0 [ 628.984581][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 628.989816][ T8881] blk_mq_run_hw_queue+0x4ac/0x670 [ 628.994936][ T8881] blk_mq_sched_insert_requests+0x496/0x640 [ 629.000820][ T8881] blk_mq_flush_plug_list+0xb31/0xca0 [ 629.006187][ T8881] blk_flush_plug_list+0x70f/0x790 [ 629.011284][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 629.016498][ T8881] blk_finish_plug+0xa0/0xd0 [ 629.021126][ T8881] ext4_writepages+0x57e1/0x62a0 [ 629.026247][ T8881] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 629.032036][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 629.037218][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 629.042402][ T8881] ? ext4_readpage+0x440/0x440 [ 629.047146][ T8881] do_writepages+0x143/0x400 [ 629.051723][ T8881] ? kmsan_get_metadata+0x11d/0x180 [ 629.056908][ T8881] __filemap_fdatawrite_range+0x53b/0x5b0 [ 629.062621][ T8881] filemap_flush+0x66/0x70 [ 629.067022][ T8881] ext4_alloc_da_blocks+0x22d/0x290 [ 629.072210][ T8881] ext4_release_file+0xa0/0x3e0 [ 629.077050][ T8881] ? ext4_file_open+0xb50/0xb50 [ 629.081880][ T8881] __fput+0x4c7/0xb90 [ 629.085850][ T8881] ____fput+0x37/0x40 [ 629.089810][ T8881] ? fput_many+0x2a0/0x2a0 [ 629.094207][ T8881] task_work_run+0x214/0x2b0 [ 629.098783][ T8881] prepare_exit_to_usermode+0x3c8/0x520 [ 629.104309][ T8881] syscall_return_slowpath+0x95/0x5f0 [ 629.109672][ T8881] ? kmsan_get_metadata+0x4f/0x180 [ 629.114777][ T8881] do_fast_syscall_32+0x422/0x6e0 [ 629.119785][ T8881] entry_SYSENTER_compat+0x68/0x77 [ 629.124876][ T8881] RIP: 0023:0xf7f86d99 [ 629.128925][ T8881] Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 629.148505][ T8881] RSP: 002b:00000000ffd8507c EFLAGS: 00000296 ORIG_RAX: 0000000000000006 [ 629.156909][ T8881] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 629.164869][ T8881] RDX: 0000000000000004 RSI: 00000000080fd00c RDI: 0000000000000006 [ 629.172829][ T8881] RBP: 00000000ffd850c4 R08: 0000000000000000 R09: 0000000000000000 [ 629.180793][ T8881] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 629.188748][ T8881] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 629.198146][ T8881] Kernel Offset: 0x1b400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 629.209777][ T8881] Rebooting in 86400 seconds..