Warning: Permanently added '10.128.15.195' (ECDSA) to the list of known hosts. 2019/11/10 19:01:56 fuzzer started 2019/11/10 19:02:01 dialing manager at 10.128.0.26:45743 2019/11/10 19:02:01 syscalls: 2397 2019/11/10 19:02:01 code coverage: enabled 2019/11/10 19:02:01 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/11/10 19:02:01 extra coverage: enabled 2019/11/10 19:02:01 setuid sandbox: enabled 2019/11/10 19:02:01 namespace sandbox: enabled 2019/11/10 19:02:01 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/10 19:02:01 fault injection: enabled 2019/11/10 19:02:01 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/10 19:02:01 net packet injection: enabled 2019/11/10 19:02:01 net device setup: enabled 2019/11/10 19:02:01 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/10 19:02:01 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 133.664715][T11521] ===================================================== [ 133.671737][T11521] BUG: KMSAN: use-after-free in kmem_cache_free+0x3df/0x2b70 [ 133.679121][T11521] CPU: 0 PID: 11521 Comm: syz-fuzzer Not tainted 5.4.0-rc5+ #0 [ 133.686663][T11521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 133.696722][T11521] Call Trace: [ 133.700036][T11521] dump_stack+0x191/0x1f0 [ 133.704384][T11521] kmsan_report+0x128/0x220 [ 133.708900][T11521] __msan_warning+0x73/0xe0 [ 133.713503][T11521] kmem_cache_free+0x3df/0x2b70 [ 133.718366][T11521] ? kmsan_internal_set_origin+0x6a/0xb0 [ 133.724015][T11521] ? kfree_skb+0x473/0x4c0 [ 133.728439][T11521] ? kmsan_internal_unpoison_shadow+0x42/0x80 [ 133.734616][T11521] kfree_skb+0x473/0x4c0 [ 133.738967][T11521] ? packet_rcv_spkt+0x68d/0x7c0 [ 133.743916][T11521] packet_rcv_spkt+0x68d/0x7c0 [ 133.748698][T11521] ? packet_rcv+0x2110/0x2110 [ 133.753414][T11521] dev_queue_xmit_nit+0x1125/0x1200 [ 133.758641][T11521] dev_hard_start_xmit+0x21e/0xab0 [ 133.763856][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 133.769764][T11521] sch_direct_xmit+0x56c/0x18c0 [ 133.774701][T11521] __dev_queue_xmit+0x212d/0x4200 [ 133.780077][T11521] dev_queue_xmit+0x4b/0x60 [ 133.784586][T11521] ip_finish_output2+0x20d6/0x25d0 [ 133.789745][T11521] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 133.795983][T11521] ? nf_ct_deliver_cached_events+0x4d5/0x6e0 [ 133.801983][T11521] __ip_finish_output+0xaf8/0xda0 [ 133.807008][T11521] ip_finish_output+0x2db/0x420 [ 133.812247][T11521] ip_output+0x541/0x610 [ 133.816504][T11521] ? ip_mc_finish_output+0x6d0/0x6d0 [ 133.821780][T11521] ? ip_finish_output+0x420/0x420 [ 133.826787][T11521] __ip_queue_xmit+0x1caf/0x21f0 [ 133.831711][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 133.837595][T11521] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 133.843654][T11521] ip_queue_xmit+0xcc/0xf0 [ 133.848058][T11521] ? tcp_v4_inbound_md5_hash+0xd10/0xd10 [ 133.853710][T11521] __tcp_transmit_skb+0x40e3/0x5d90 [ 133.858920][T11521] __tcp_send_ack+0x701/0x840 [ 133.863588][T11521] tcp_send_ack+0x68/0x90 [ 133.867992][T11521] tcp_cleanup_rbuf+0x764/0x800 [ 133.872852][T11521] tcp_recvmsg+0x334d/0x4ff0 [ 133.877447][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 133.883319][T11521] ? tcp_mmap+0x150/0x150 [ 133.887637][T11521] ? tcp_mmap+0x150/0x150 [ 133.891944][T11521] inet_recvmsg+0x237/0x7d0 [ 133.896436][T11521] ? inet_sendpage+0x2c0/0x2c0 [ 133.901178][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 133.907047][T11521] ? inet_sendpage+0x2c0/0x2c0 [ 133.912219][T11521] ? inet_sendpage+0x2c0/0x2c0 [ 133.916976][T11521] sock_read_iter+0x5be/0x660 [ 133.921786][T11521] ? kernel_sock_ip_overhead+0x340/0x340 [ 133.928394][T11521] __vfs_read+0xa67/0xc90 [ 133.932726][T11521] vfs_read+0x359/0x6f0 [ 133.936867][T11521] ksys_read+0x265/0x430 [ 133.941094][T11521] __se_sys_read+0x92/0xb0 [ 133.945491][T11521] __x64_sys_read+0x4a/0x70 [ 133.949973][T11521] do_syscall_64+0xb6/0x160 [ 133.954457][T11521] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 133.960370][T11521] RIP: 0033:0x47fd44 [ 133.964258][T11521] Code: ff ff cc cc cc cc e8 9b 40 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 45 31 d2 45 31 c0 45 31 c9 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 133.983847][T11521] RSP: 002b:000000c4203a3760 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 133.992253][T11521] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fd44 [ 134.000214][T11521] RDX: 0000000000001000 RSI: 000000c42039c000 RDI: 0000000000000003 [ 134.008177][T11521] RBP: 000000c4203a37b0 R08: 0000000000000000 R09: 0000000000000000 [ 134.016314][T11521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010 [ 134.024274][T11521] R13: 0000000000000010 R14: 0000000000000040 R15: ffffffffffffffff [ 134.032237][T11521] [ 134.034545][T11521] Uninit was stored to memory at: [ 134.039555][T11521] kmsan_internal_chain_origin+0xbd/0x180 [ 134.045252][T11521] __msan_chain_origin+0x6b/0xd0 [ 134.050180][T11521] ___slab_alloc+0x1dbc/0x1fb0 [ 134.054931][T11521] kmem_cache_alloc+0xadf/0xd20 [ 134.059758][T11521] skb_clone+0x326/0x5d0 [ 134.063977][T11521] dev_queue_xmit_nit+0x539/0x1200 [ 134.069063][T11521] dev_hard_start_xmit+0x21e/0xab0 [ 134.074150][T11521] sch_direct_xmit+0x56c/0x18c0 [ 134.078989][T11521] __dev_queue_xmit+0x212d/0x4200 [ 134.083997][T11521] dev_queue_xmit+0x4b/0x60 [ 134.088478][T11521] ip_finish_output2+0x20d6/0x25d0 [ 134.093577][T11521] __ip_finish_output+0xaf8/0xda0 [ 134.098575][T11521] ip_finish_output+0x2db/0x420 [ 134.103399][T11521] ip_output+0x541/0x610 [ 134.107621][T11521] __ip_queue_xmit+0x1caf/0x21f0 [ 134.112535][T11521] ip_queue_xmit+0xcc/0xf0 [ 134.116943][T11521] __tcp_transmit_skb+0x40e3/0x5d90 [ 134.122628][T11521] __tcp_send_ack+0x701/0x840 [ 134.127505][T11521] tcp_send_ack+0x68/0x90 [ 134.132092][T11521] tcp_cleanup_rbuf+0x764/0x800 [ 134.136936][T11521] tcp_recvmsg+0x334d/0x4ff0 [ 134.141610][T11521] inet_recvmsg+0x237/0x7d0 [ 134.146112][T11521] sock_read_iter+0x5be/0x660 [ 134.150873][T11521] __vfs_read+0xa67/0xc90 [ 134.155197][T11521] vfs_read+0x359/0x6f0 [ 134.159959][T11521] ksys_read+0x265/0x430 [ 134.164196][T11521] __se_sys_read+0x92/0xb0 [ 134.168598][T11521] __x64_sys_read+0x4a/0x70 [ 134.173113][T11521] do_syscall_64+0xb6/0x160 [ 134.177599][T11521] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 134.183464][T11521] [ 134.185790][T11521] Uninit was created at: [ 134.190020][T11521] kmsan_internal_poison_shadow+0x60/0x120 [ 134.195831][T11521] kmsan_slab_free+0x8d/0xf0 [ 134.200484][T11521] kmem_cache_free_bulk+0x3ad9/0x3f10 [ 134.205849][T11521] __kfree_skb_flush+0xb0/0x100 [ 134.210940][T11521] net_rx_action+0x1a5e/0x1aa0 [ 134.215682][T11521] __do_softirq+0x4a1/0x83a [ 134.220174][T11521] irq_exit+0x230/0x280 [ 134.224320][T11521] do_IRQ+0x123/0x360 [ 134.228289][T11521] ret_from_intr+0x0/0x33 [ 134.232603][T11521] ===================================================== [ 134.239518][T11521] Disabling lock debugging due to kernel taint [ 134.246425][T11521] Kernel panic - not syncing: panic_on_warn set ... [ 134.252992][T11521] CPU: 0 PID: 11521 Comm: syz-fuzzer Tainted: G B 5.4.0-rc5+ #0 [ 134.261911][T11521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 134.271943][T11521] Call Trace: [ 134.275217][T11521] dump_stack+0x191/0x1f0 [ 134.279529][T11521] panic+0x3c9/0xc1e [ 134.283512][T11521] kmsan_report+0x215/0x220 [ 134.287998][T11521] __msan_warning+0x73/0xe0 [ 134.292494][T11521] kmem_cache_free+0x3df/0x2b70 [ 134.297356][T11521] ? kmsan_internal_set_origin+0x6a/0xb0 [ 134.303002][T11521] ? kfree_skb+0x473/0x4c0 [ 134.307409][T11521] ? kmsan_internal_unpoison_shadow+0x42/0x80 [ 134.313481][T11521] kfree_skb+0x473/0x4c0 [ 134.317802][T11521] ? packet_rcv_spkt+0x68d/0x7c0 [ 134.322737][T11521] packet_rcv_spkt+0x68d/0x7c0 [ 134.327638][T11521] ? packet_rcv+0x2110/0x2110 [ 134.332303][T11521] dev_queue_xmit_nit+0x1125/0x1200 [ 134.337529][T11521] dev_hard_start_xmit+0x21e/0xab0 [ 134.342671][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 134.348559][T11521] sch_direct_xmit+0x56c/0x18c0 [ 134.353409][T11521] __dev_queue_xmit+0x212d/0x4200 [ 134.358441][T11521] dev_queue_xmit+0x4b/0x60 [ 134.362928][T11521] ip_finish_output2+0x20d6/0x25d0 [ 134.368173][T11521] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 134.374318][T11521] ? nf_ct_deliver_cached_events+0x4d5/0x6e0 [ 134.380304][T11521] __ip_finish_output+0xaf8/0xda0 [ 134.385862][T11521] ip_finish_output+0x2db/0x420 [ 134.390719][T11521] ip_output+0x541/0x610 [ 134.394967][T11521] ? ip_mc_finish_output+0x6d0/0x6d0 [ 134.400241][T11521] ? ip_finish_output+0x420/0x420 [ 134.405330][T11521] __ip_queue_xmit+0x1caf/0x21f0 [ 134.410337][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 134.416225][T11521] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 134.423785][T11521] ip_queue_xmit+0xcc/0xf0 [ 134.428204][T11521] ? tcp_v4_inbound_md5_hash+0xd10/0xd10 [ 134.433837][T11521] __tcp_transmit_skb+0x40e3/0x5d90 [ 134.439145][T11521] __tcp_send_ack+0x701/0x840 [ 134.443815][T11521] tcp_send_ack+0x68/0x90 [ 134.448124][T11521] tcp_cleanup_rbuf+0x764/0x800 [ 134.452960][T11521] tcp_recvmsg+0x334d/0x4ff0 [ 134.457652][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 134.463550][T11521] ? tcp_mmap+0x150/0x150 [ 134.467879][T11521] ? tcp_mmap+0x150/0x150 [ 134.472197][T11521] inet_recvmsg+0x237/0x7d0 [ 134.476684][T11521] ? inet_sendpage+0x2c0/0x2c0 [ 134.481447][T11521] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 134.487403][T11521] ? inet_sendpage+0x2c0/0x2c0 [ 134.492141][T11521] ? inet_sendpage+0x2c0/0x2c0 [ 134.496903][T11521] sock_read_iter+0x5be/0x660 [ 134.501589][T11521] ? kernel_sock_ip_overhead+0x340/0x340 [ 134.507223][T11521] __vfs_read+0xa67/0xc90 [ 134.511567][T11521] vfs_read+0x359/0x6f0 [ 134.515728][T11521] ksys_read+0x265/0x430 [ 134.519970][T11521] __se_sys_read+0x92/0xb0 [ 134.524476][T11521] __x64_sys_read+0x4a/0x70 [ 134.528970][T11521] do_syscall_64+0xb6/0x160 [ 134.534520][T11521] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 134.540407][T11521] RIP: 0033:0x47fd44 [ 134.544384][T11521] Code: ff ff cc cc cc cc e8 9b 40 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 45 31 d2 45 31 c0 45 31 c9 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 134.564189][T11521] RSP: 002b:000000c4203a3760 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 134.572593][T11521] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fd44 [ 134.580544][T11521] RDX: 0000000000001000 RSI: 000000c42039c000 RDI: 0000000000000003 [ 134.588520][T11521] RBP: 000000c4203a37b0 R08: 0000000000000000 R09: 0000000000000000 [ 134.596477][T11521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010 [ 134.604431][T11521] R13: 0000000000000010 R14: 0000000000000040 R15: ffffffffffffffff [ 134.613879][T11521] Kernel Offset: disabled [ 134.618214][T11521] Rebooting in 86400 seconds..