[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 76.133202][ T31] audit: type=1800 audit(1570356100.183:25): pid=11337 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 76.155982][ T31] audit: type=1800 audit(1570356100.203:26): pid=11337 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 76.181159][ T31] audit: type=1800 audit(1570356100.223:27): pid=11337 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.46' (ECDSA) to the list of known hosts. syzkaller login: [ 96.588297][T11488] IPVS: ftp: loaded support on port[0] = 21 [ 96.656295][T11488] chnl_net:caif_netlink_parms(): no params data found [ 96.689426][T11488] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.696610][T11488] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.704890][T11488] device bridge_slave_0 entered promiscuous mode [ 96.713396][T11488] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.720484][T11488] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.728728][T11488] device bridge_slave_1 entered promiscuous mode [ 96.749620][T11488] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.760671][T11488] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.782657][T11488] team0: Port device team_slave_0 added [ 96.790122][T11488] team0: Port device team_slave_1 added [ 96.844686][T11488] device hsr_slave_0 entered promiscuous mode [ 96.892374][T11488] device hsr_slave_1 entered promiscuous mode [ 96.942790][T11488] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.949928][T11488] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.957622][T11488] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.964769][T11488] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.008802][T11488] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.025407][ T3371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 97.035359][ T3371] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.044388][ T3371] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.053380][ T3371] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 97.067704][T11488] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.079745][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 97.088762][ T30] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.095896][ T30] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.108655][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 97.117587][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.124808][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.147882][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 97.157979][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 97.173975][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 97.187396][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 97.200358][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready executing program [ 97.211646][T11488] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 97.235265][T11488] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.278741][ C0] ===================================================== [ 97.285712][ C0] BUG: KMSAN: uninit-value in gre_rcv+0x1cb/0x1900 [ 97.292290][ C0] CPU: 0 PID: 11488 Comm: syz-executor381 Not tainted 5.3.0-rc7+ #0 [ 97.300239][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 97.310268][ C0] Call Trace: [ 97.313538][ C0] [ 97.316373][ C0] dump_stack+0x191/0x1f0 [ 97.320690][ C0] kmsan_report+0x13a/0x2b0 [ 97.325178][ C0] __msan_warning+0x73/0xe0 [ 97.329660][ C0] gre_parse_header+0x1395/0x1690 [ 97.334665][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 97.340283][ C0] gre_rcv+0x1cb/0x1900 [ 97.344435][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 97.350304][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 97.356346][ C0] ? raw_local_deliver+0xdd/0x1930 [ 97.361445][ C0] ? erspan_xmit+0x35c0/0x35c0 [ 97.366188][ C0] gre_rcv+0x2dd/0x3c0 [ 97.370236][ C0] ? gre_parse_header+0x1690/0x1690 [ 97.375420][ C0] ip_protocol_deliver_rcu+0x722/0xbc0 [ 97.380860][ C0] ip_local_deliver+0x62a/0x7c0 [ 97.385695][ C0] ? ip_local_deliver+0x7c0/0x7c0 [ 97.390694][ C0] ? ip_protocol_deliver_rcu+0xbc0/0xbc0 [ 97.396301][ C0] ip_rcv+0x6c5/0x740 [ 97.400263][ C0] ? ip_rcv_core+0x11d0/0x11d0 [ 97.405004][ C0] process_backlog+0xef5/0x1410 [ 97.409837][ C0] ? ip_local_deliver_finish+0x350/0x350 [ 97.415452][ C0] ? rps_trigger_softirq+0x2e0/0x2e0 [ 97.420713][ C0] net_rx_action+0x74b/0x1950 [ 97.425379][ C0] ? net_tx_action+0xba0/0xba0 [ 97.430120][ C0] __do_softirq+0x4a1/0x83a [ 97.434638][ C0] do_softirq_own_stack+0x49/0x80 [ 97.439646][ C0] [ 97.442563][ C0] __local_bh_enable_ip+0x184/0x1d0 [ 97.447741][ C0] local_bh_enable+0x36/0x40 [ 97.452319][ C0] ip_finish_output2+0x20dc/0x25d0 [ 97.457416][ C0] ? ctnetlink_net_exit_batch+0x180/0x180 [ 97.463113][ C0] ? nf_ct_deliver_cached_events+0x4c7/0x6e0 [ 97.469081][ C0] __ip_finish_output+0xaf8/0xda0 [ 97.474092][ C0] ip_finish_output+0x2db/0x420 [ 97.478936][ C0] ip_output+0x541/0x610 [ 97.483168][ C0] ? ip_mc_finish_output+0x6d0/0x6d0 [ 97.488430][ C0] ? ip_finish_output+0x420/0x420 [ 97.493433][ C0] ip_send_skb+0x179/0x360 [ 97.497830][ C0] udp_send_skb+0xeda/0x1870 [ 97.502410][ C0] udp_sendmsg+0x397c/0x4170 [ 97.506977][ C0] ? ip_do_fragment+0x35f0/0x35f0 [ 97.511983][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 97.517652][ C0] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 97.523709][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 97.529577][ C0] ? udp_cmsg_send+0x5d0/0x5d0 [ 97.534318][ C0] ? udp_cmsg_send+0x5d0/0x5d0 [ 97.539072][ C0] inet_sendmsg+0x276/0x2e0 [ 97.543557][ C0] ? inet_send_prepare+0x600/0x600 [ 97.548643][ C0] ___sys_sendmsg+0x12c4/0x1590 [ 97.553487][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 97.559356][ C0] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 97.565400][ C0] ? __fget_light+0x1b8/0x710 [ 97.570052][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 97.575709][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 97.581585][ C0] __sys_sendmmsg+0x53a/0xae0 [ 97.586249][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 97.592132][ C0] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 97.598178][ C0] ? prepare_exit_to_usermode+0x19a/0x4d0 [ 97.603874][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 97.609748][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 97.614493][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 97.619320][ C0] do_syscall_64+0xbc/0xf0 [ 97.623715][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 97.629581][ C0] RIP: 0033:0x4419e9 [ 97.633453][ C0] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 97.653046][ C0] RSP: 002b:00007ffc09dd73a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 97.661441][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004419e9 [ 97.669389][ C0] RDX: 0400000000000030 RSI: 0000000020007fc0 RDI: 0000000000000003 [ 97.677339][ C0] RBP: 00007ffc09dd73c0 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 97.685287][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.693233][ C0] R13: 0000000000402f80 R14: 0000000000000000 R15: 0000000000000000 [ 97.701187][ C0] [ 97.703489][ C0] Uninit was stored to memory at: [ 97.708495][ C0] kmsan_internal_chain_origin+0xd2/0x170 [ 97.714194][ C0] kmsan_memcpy_memmove_metadata+0x25b/0x2d0 [ 97.720144][ C0] kmsan_memcpy_metadata+0xb/0x10 [ 97.725146][ C0] __msan_memcpy+0x56/0x70 [ 97.729536][ C0] pskb_expand_head+0x38a/0x19f0 [ 97.734472][ C0] ip_tunnel_xmit+0x2971/0x3320 [ 97.739300][ C0] erspan_xmit+0x1ef8/0x35c0 [ 97.743865][ C0] dev_hard_start_xmit+0x51a/0xab0 [ 97.748949][ C0] sch_direct_xmit+0x56c/0x18c0 [ 97.753776][ C0] __dev_queue_xmit+0x1e53/0x4270 [ 97.758773][ C0] dev_queue_xmit+0x4b/0x60 [ 97.763251][ C0] neigh_resolve_output+0xab7/0xb50 [ 97.768424][ C0] ip_finish_output2+0x1a8e/0x25d0 [ 97.773516][ C0] __ip_finish_output+0xaf8/0xda0 [ 97.778515][ C0] ip_finish_output+0x2db/0x420 [ 97.783340][ C0] ip_output+0x541/0x610 [ 97.787558][ C0] ip_send_skb+0x179/0x360 [ 97.791950][ C0] udp_send_skb+0xeda/0x1870 [ 97.796515][ C0] udp_sendmsg+0x397c/0x4170 [ 97.801175][ C0] inet_sendmsg+0x276/0x2e0 [ 97.805665][ C0] ___sys_sendmsg+0x12c4/0x1590 [ 97.810499][ C0] __sys_sendmmsg+0x53a/0xae0 [ 97.815152][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 97.819888][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 97.824717][ C0] do_syscall_64+0xbc/0xf0 [ 97.829124][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 97.834999][ C0] [ 97.837299][ C0] Uninit was created at: [ 97.841526][ C0] kmsan_internal_poison_shadow+0x53/0x100 [ 97.847309][ C0] kmsan_slab_alloc+0xaa/0x120 [ 97.852066][ C0] __kmalloc_node_track_caller+0xb55/0x1320 [ 97.857961][ C0] __alloc_skb+0x306/0xa10 [ 97.862357][ C0] alloc_skb_with_frags+0x18c/0xa80 [ 97.867531][ C0] sock_alloc_send_pskb+0xafd/0x10a0 [ 97.872793][ C0] sock_alloc_send_skb+0xca/0xe0 [ 97.877705][ C0] __ip_append_data+0x375d/0x52f0 [ 97.882707][ C0] ip_make_skb+0x392/0x890 [ 97.887111][ C0] udp_sendmsg+0x367e/0x4170 [ 97.891674][ C0] inet_sendmsg+0x276/0x2e0 [ 97.896153][ C0] ___sys_sendmsg+0x12c4/0x1590 [ 97.900979][ C0] __sys_sendmmsg+0x53a/0xae0 [ 97.905632][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 97.910369][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 97.915197][ C0] do_syscall_64+0xbc/0xf0 [ 97.919601][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 97.925463][ C0] ===================================================== [ 97.932373][ C0] Disabling lock debugging due to kernel taint [ 97.938512][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 97.945082][ C0] CPU: 0 PID: 11488 Comm: syz-executor381 Tainted: G B 5.3.0-rc7+ #0 [ 97.954421][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 97.964456][ C0] Call Trace: [ 97.967723][ C0] [ 97.970559][ C0] dump_stack+0x191/0x1f0 [ 97.974874][ C0] panic+0x3c9/0xc1e [ 97.978759][ C0] kmsan_report+0x2a2/0x2b0 [ 97.983244][ C0] __msan_warning+0x73/0xe0 [ 97.987726][ C0] gre_parse_header+0x1395/0x1690 [ 97.992732][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 97.998360][ C0] gre_rcv+0x1cb/0x1900 [ 98.002505][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 98.008376][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 98.014427][ C0] ? raw_local_deliver+0xdd/0x1930 [ 98.019522][ C0] ? erspan_xmit+0x35c0/0x35c0 [ 98.024264][ C0] gre_rcv+0x2dd/0x3c0 [ 98.028315][ C0] ? gre_parse_header+0x1690/0x1690 [ 98.033503][ C0] ip_protocol_deliver_rcu+0x722/0xbc0 [ 98.038961][ C0] ip_local_deliver+0x62a/0x7c0 [ 98.043820][ C0] ? ip_local_deliver+0x7c0/0x7c0 [ 98.048822][ C0] ? ip_protocol_deliver_rcu+0xbc0/0xbc0 [ 98.054433][ C0] ip_rcv+0x6c5/0x740 [ 98.058403][ C0] ? ip_rcv_core+0x11d0/0x11d0 [ 98.063149][ C0] process_backlog+0xef5/0x1410 [ 98.067981][ C0] ? ip_local_deliver_finish+0x350/0x350 [ 98.073595][ C0] ? rps_trigger_softirq+0x2e0/0x2e0 [ 98.078856][ C0] net_rx_action+0x74b/0x1950 [ 98.083522][ C0] ? net_tx_action+0xba0/0xba0 [ 98.088273][ C0] __do_softirq+0x4a1/0x83a [ 98.092782][ C0] do_softirq_own_stack+0x49/0x80 [ 98.097796][ C0] [ 98.100718][ C0] __local_bh_enable_ip+0x184/0x1d0 [ 98.105901][ C0] local_bh_enable+0x36/0x40 [ 98.110469][ C0] ip_finish_output2+0x20dc/0x25d0 [ 98.115557][ C0] ? ctnetlink_net_exit_batch+0x180/0x180 [ 98.121266][ C0] ? nf_ct_deliver_cached_events+0x4c7/0x6e0 [ 98.127246][ C0] __ip_finish_output+0xaf8/0xda0 [ 98.132258][ C0] ip_finish_output+0x2db/0x420 [ 98.137199][ C0] ip_output+0x541/0x610 [ 98.141424][ C0] ? ip_mc_finish_output+0x6d0/0x6d0 [ 98.146691][ C0] ? ip_finish_output+0x420/0x420 [ 98.151692][ C0] ip_send_skb+0x179/0x360 [ 98.156089][ C0] udp_send_skb+0xeda/0x1870 [ 98.160672][ C0] udp_sendmsg+0x397c/0x4170 [ 98.165241][ C0] ? ip_do_fragment+0x35f0/0x35f0 [ 98.170333][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 98.175967][ C0] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 98.182020][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 98.187891][ C0] ? udp_cmsg_send+0x5d0/0x5d0 [ 98.192631][ C0] ? udp_cmsg_send+0x5d0/0x5d0 [ 98.197369][ C0] inet_sendmsg+0x276/0x2e0 [ 98.201864][ C0] ? inet_send_prepare+0x600/0x600 [ 98.206963][ C0] ___sys_sendmsg+0x12c4/0x1590 [ 98.211825][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 98.217706][ C0] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 98.223748][ C0] ? __fget_light+0x1b8/0x710 [ 98.228398][ C0] ? kmsan_internal_set_origin+0x6a/0xb0 [ 98.234012][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 98.239892][ C0] __sys_sendmmsg+0x53a/0xae0 [ 98.244559][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 98.250428][ C0] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 98.256473][ C0] ? prepare_exit_to_usermode+0x19a/0x4d0 [ 98.262167][ C0] ? kmsan_get_shadow_origin_ptr+0x6e/0x4c0 [ 98.268042][ C0] __se_sys_sendmmsg+0xbd/0xe0 [ 98.272789][ C0] __x64_sys_sendmmsg+0x56/0x70 [ 98.277617][ C0] do_syscall_64+0xbc/0xf0 [ 98.282014][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 98.287889][ C0] RIP: 0033:0x4419e9 [ 98.291764][ C0] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.311361][ C0] RSP: 002b:00007ffc09dd73a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 98.319763][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004419e9 [ 98.327724][ C0] RDX: 0400000000000030 RSI: 0000000020007fc0 RDI: 0000000000000003 [ 98.335729][ C0] RBP: 00007ffc09dd73c0 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 98.343687][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.351689][ C0] R13: 0000000000402f80 R14: 0000000000000000 R15: 0000000000000000 [ 98.361099][ C0] Kernel Offset: disabled [ 98.365426][ C0] Rebooting in 86400 seconds..