[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 57.554317] audit: type=1800 audit(1540106106.607:25): pid=6129 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 57.573447] audit: type=1800 audit(1540106106.607:26): pid=6129 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 57.592833] audit: type=1800 audit(1540106106.627:27): pid=6129 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.32' (ECDSA) to the list of known hosts. 2018/10/21 07:15:19 parsed 1 programs 2018/10/21 07:15:25 executed programs: 0 syzkaller login: [ 76.398755] IPVS: ftp: loaded support on port[0] = 21 [ 76.971175] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.977700] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.985829] device bridge_slave_0 entered promiscuous mode [ 77.023713] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.030100] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.038015] device bridge_slave_1 entered promiscuous mode [ 77.074743] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.111122] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.222429] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 77.262325] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 77.437537] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 77.445183] team0: Port device team_slave_0 added [ 77.482551] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 77.490009] team0: Port device team_slave_1 added [ 77.527508] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.570012] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.608471] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.646801] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.783224] ip (6371) used greatest stack depth: 53264 bytes left [ 78.026924] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.033379] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.040100] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.046614] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.054381] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 78.821982] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 79.532832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.659232] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 79.789717] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 79.796139] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 79.804107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 79.947881] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.800420] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 2018/10/21 07:15:30 executed programs: 5 [ 84.777644] ================================================================== [ 84.785085] BUG: KMSAN: kernel-infoleak in kvm_write_guest_page+0x366/0x4c0 [ 84.792195] CPU: 1 PID: 6736 Comm: syz-executor0 Not tainted 4.19.0-rc8+ #70 [ 84.799372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.808716] Call Trace: [ 84.811335] dump_stack+0x306/0x460 [ 84.815009] ? kvm_write_guest_page+0x366/0x4c0 [ 84.819688] kmsan_report+0x1a2/0x2e0 [ 84.823525] kmsan_internal_check_memory+0x374/0x460 [ 84.828625] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 84.834081] kmsan_copy_to_user+0x89/0xe0 [ 84.838227] kvm_write_guest_page+0x366/0x4c0 [ 84.842729] kvm_write_guest+0x1d6/0x350 [ 84.846799] kvm_emulate_hypercall+0x1cb9/0x20d0 [ 84.851628] handle_vmcall+0x41/0x50 [ 84.855376] ? handle_rdpmc+0x80/0x80 [ 84.859187] vmx_handle_exit+0x20f5/0xb900 [ 84.863439] ? vmx_flush_tlb_gva+0x450/0x450 [ 84.867845] kvm_arch_vcpu_ioctl_run+0xa22b/0x10ab0 [ 84.872956] ? futex_wait+0x745/0xa40 [ 84.876788] ? kmsan_set_origin+0x83/0x140 [ 84.881033] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 84.886398] ? __msan_get_context_state+0x9/0x30 [ 84.891175] ? INIT_BOOL+0xc/0x30 [ 84.894628] ? mutex_lock_killable+0x2c5/0x420 [ 84.899220] kvm_vcpu_ioctl+0x11a7/0x20b0 [ 84.903400] ? do_vfs_ioctl+0x187/0x2ca0 [ 84.907477] ? __se_sys_ioctl+0x1da/0x270 [ 84.911645] ? kvm_vm_release+0x90/0x90 [ 84.915629] do_vfs_ioctl+0xf28/0x2ca0 [ 84.919530] ? security_file_ioctl+0x92/0x200 [ 84.924041] __se_sys_ioctl+0x1da/0x270 [ 84.928018] __x64_sys_ioctl+0x4a/0x70 [ 84.931901] do_syscall_64+0xbe/0x100 [ 84.935706] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 84.940903] RIP: 0033:0x457569 [ 84.944116] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 84.963024] RSP: 002b:00007f8e30cfbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 84.970742] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 84.978005] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 84.985270] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 84.992531] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e30cfc6d4 [ 84.999788] R13: 00000000004c0027 R14: 00000000004d0108 R15: 00000000ffffffff [ 85.007060] [ 85.008694] Local variable description: ----clock_pairing.i@kvm_emulate_hypercall [ 85.016306] Variable was created at: [ 85.020033] kvm_emulate_hypercall+0x60/0x20d0 [ 85.024620] handle_vmcall+0x41/0x50 [ 85.028333] [ 85.029948] Bytes 28-63 of 64 are uninitialized [ 85.034617] Memory access of size 64 starts at ffff88019e53f440 [ 85.040660] ================================================================== [ 85.048008] Disabling lock debugging due to kernel taint [ 85.053455] Kernel panic - not syncing: panic_on_warn set ... [ 85.053455] [ 85.060829] CPU: 1 PID: 6736 Comm: syz-executor0 Tainted: G B 4.19.0-rc8+ #70 [ 85.069408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.078771] Call Trace: [ 85.081412] dump_stack+0x306/0x460 [ 85.085069] panic+0x54c/0xafa [ 85.088288] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 85.093740] kmsan_report+0x2d3/0x2e0 [ 85.097543] kmsan_internal_check_memory+0x374/0x460 [ 85.102643] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 85.108098] kmsan_copy_to_user+0x89/0xe0 [ 85.112247] kvm_write_guest_page+0x366/0x4c0 [ 85.116747] kvm_write_guest+0x1d6/0x350 [ 85.120858] kvm_emulate_hypercall+0x1cb9/0x20d0 [ 85.125716] handle_vmcall+0x41/0x50 [ 85.129473] ? handle_rdpmc+0x80/0x80 [ 85.133273] vmx_handle_exit+0x20f5/0xb900 [ 85.137540] ? vmx_flush_tlb_gva+0x450/0x450 [ 85.141948] kvm_arch_vcpu_ioctl_run+0xa22b/0x10ab0 [ 85.147075] ? futex_wait+0x745/0xa40 [ 85.150933] ? kmsan_set_origin+0x83/0x140 [ 85.155195] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 85.160580] ? __msan_get_context_state+0x9/0x30 [ 85.165378] ? INIT_BOOL+0xc/0x30 [ 85.168857] ? mutex_lock_killable+0x2c5/0x420 [ 85.173484] kvm_vcpu_ioctl+0x11a7/0x20b0 [ 85.177640] ? do_vfs_ioctl+0x187/0x2ca0 [ 85.181709] ? __se_sys_ioctl+0x1da/0x270 [ 85.185857] ? kvm_vm_release+0x90/0x90 [ 85.189827] do_vfs_ioctl+0xf28/0x2ca0 [ 85.193722] ? security_file_ioctl+0x92/0x200 [ 85.198224] __se_sys_ioctl+0x1da/0x270 [ 85.202206] __x64_sys_ioctl+0x4a/0x70 [ 85.206089] do_syscall_64+0xbe/0x100 [ 85.209927] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 85.215111] RIP: 0033:0x457569 [ 85.218314] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 85.237222] RSP: 002b:00007f8e30cfbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.244947] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 85.252217] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 85.259496] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 85.266772] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e30cfc6d4 [ 85.274036] R13: 00000000004c0027 R14: 00000000004d0108 R15: 00000000ffffffff [ 85.282197] Kernel Offset: disabled [ 85.285833] Rebooting in 86400 seconds..