[ 62.578810] audit: type=1800 audit(1541105086.629:25): pid=6390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 62.598293] audit: type=1800 audit(1541105086.649:26): pid=6390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 62.618019] audit: type=1800 audit(1541105086.659:27): pid=6390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 64.048783] sshd (6457) used greatest stack depth: 53712 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.49' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 77.576446] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 80.101690] hrtimer: interrupt took 254370 ns executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 107.275032] ================================================================== [ 107.282459] BUG: KMSAN: kernel-infoleak in kvm_vcpu_write_guest_page+0x39a/0x510 [ 107.290018] CPU: 0 PID: 7918 Comm: syz-executor542 Not tainted 4.19.0+ #77 [ 107.297045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 107.306422] Call Trace: [ 107.309049] dump_stack+0x32d/0x480 [ 107.312705] ? _raw_spin_lock_irqsave+0x237/0x340 [ 107.317589] ? kvm_vcpu_write_guest_page+0x39a/0x510 [ 107.322735] kmsan_report+0x1a2/0x2e0 [ 107.326588] kmsan_internal_check_memory+0x34c/0x430 [ 107.331731] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 107.337233] kmsan_copy_to_user+0x85/0xe0 [ 107.341427] kvm_vcpu_write_guest_page+0x39a/0x510 [ 107.346409] handle_vmptrld+0x2384/0x26b0 [ 107.350609] ? handle_vmlaunch+0x60/0x60 [ 107.354697] vmx_handle_exit+0x1e81/0xbac0 [ 107.358954] ? vmalloc_to_page+0x585/0x6c0 [ 107.363227] ? kmsan_get_shadow_origin_ptr+0x142/0x410 [ 107.368538] ? vmx_flush_tlb_gva+0x4b0/0x4b0 [ 107.372983] kvm_arch_vcpu_ioctl_run+0xac32/0x11d80 [ 107.378159] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 107.383546] ? __list_del_entry_valid+0x123/0x480 [ 107.388433] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 107.393905] ? wait_for_common+0x7a7/0x980 [ 107.398184] ? arch_local_irq_disable+0x10/0x10 [ 107.402885] ? kmsan_set_origin+0x83/0x130 [ 107.407164] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 107.412580] ? __msan_get_context_state+0x9/0x30 [ 107.417353] ? INIT_BOOL+0x17/0x30 [ 107.420911] ? put_pid+0x319/0x410 [ 107.424483] kvm_vcpu_ioctl+0xfb1/0x1f90 [ 107.428589] ? do_vfs_ioctl+0x187/0x2d30 [ 107.432683] ? kvm_vm_release+0x90/0x90 [ 107.436680] do_vfs_ioctl+0xf77/0x2d30 [ 107.440616] ? security_file_ioctl+0x92/0x200 [ 107.445143] __se_sys_ioctl+0x1da/0x270 [ 107.449152] __x64_sys_ioctl+0x4a/0x70 [ 107.453064] do_syscall_64+0xcf/0x110 [ 107.456886] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 107.462094] RIP: 0033:0x44b6e9 [ 107.465304] Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b ff fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 107.484221] RSP: 002b:00007f096b292ce8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [ 107.491954] RAX: ffffffffffffffda RBX: 00000000006e3c48 RCX: 000000000044b6e9 [ 107.499237] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 107.506517] RBP: 00000000006e3c40 R08: 0000000000000000 R09: 0000000000000000 [ 107.513813] R10: 0000000000000000 R11: 0000000000000206 R12: 00000000006e3c4c [ 107.521099] R13: 00007ffd978aeb2f R14: 00007f096b2939c0 R15: 00000000006e3d4c [ 107.528396] [ 107.530029] Uninit was created at: [ 107.533598] kmsan_internal_poison_shadow+0xc8/0x1e0 [ 107.538718] kmsan_kmalloc+0x98/0x110 [ 107.542531] __kmalloc+0x14c/0x4d0 [ 107.546092] enter_vmx_operation+0x980/0x1a90 [ 107.550607] vmx_set_nested_state+0xc3a/0x1530 [ 107.555207] kvm_arch_vcpu_ioctl+0x4fc9/0x73a0 [ 107.559805] kvm_vcpu_ioctl+0xca3/0x1f90 [ 107.563886] do_vfs_ioctl+0xf77/0x2d30 [ 107.567790] __se_sys_ioctl+0x1da/0x270 [ 107.571780] __x64_sys_ioctl+0x4a/0x70 [ 107.575680] do_syscall_64+0xcf/0x110 [ 107.579498] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 107.584688] [ 107.586333] Bytes 1000-4095 of 4096 are uninitialized [ 107.591531] Memory access of size 4096 starts at ffff8801b5157000 [ 107.597780] ================================================================== [ 107.605169] Disabling lock debugging due to kernel taint [ 107.610635] Kernel panic - not syncing: panic_on_warn set ... [ 107.610635] [ 107.618025] CPU: 0 PID: 7918 Comm: syz-executor542 Tainted: G B 4.19.0+ #77 [ 107.626435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 107.635796] Call Trace: [ 107.638409] dump_stack+0x32d/0x480 [ 107.642076] panic+0x57e/0xb28 [ 107.645348] kmsan_report+0x2d3/0x2e0 [ 107.649184] kmsan_internal_check_memory+0x34c/0x430 [ 107.654311] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 107.659798] kmsan_copy_to_user+0x85/0xe0 [ 107.663977] kvm_vcpu_write_guest_page+0x39a/0x510 [ 107.668950] handle_vmptrld+0x2384/0x26b0 [ 107.673142] ? handle_vmlaunch+0x60/0x60 [ 107.677226] vmx_handle_exit+0x1e81/0xbac0 [ 107.681481] ? vmalloc_to_page+0x585/0x6c0 [ 107.685751] ? kmsan_get_shadow_origin_ptr+0x142/0x410 [ 107.691059] ? vmx_flush_tlb_gva+0x4b0/0x4b0 [ 107.695489] kvm_arch_vcpu_ioctl_run+0xac32/0x11d80 [ 107.700678] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 107.706094] ? __list_del_entry_valid+0x123/0x480 [ 107.710967] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 107.716442] ? wait_for_common+0x7a7/0x980 [ 107.720717] ? arch_local_irq_disable+0x10/0x10 [ 107.725418] ? kmsan_set_origin+0x83/0x130 [ 107.729681] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 107.735290] ? __msan_get_context_state+0x9/0x30 [ 107.740063] ? INIT_BOOL+0x17/0x30 [ 107.743620] ? put_pid+0x319/0x410 [ 107.747193] kvm_vcpu_ioctl+0xfb1/0x1f90 [ 107.751290] ? do_vfs_ioctl+0x187/0x2d30 [ 107.755380] ? kvm_vm_release+0x90/0x90 [ 107.759371] do_vfs_ioctl+0xf77/0x2d30 [ 107.763308] ? security_file_ioctl+0x92/0x200 [ 107.767840] __se_sys_ioctl+0x1da/0x270 [ 107.771853] __x64_sys_ioctl+0x4a/0x70 [ 107.775760] do_syscall_64+0xcf/0x110 [ 107.779595] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 107.784799] RIP: 0033:0x44b6e9 [ 107.788014] Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b ff fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 107.806936] RSP: 002b:00007f096b292ce8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [ 107.814667] RAX: ffffffffffffffda RBX: 00000000006e3c48 RCX: 000000000044b6e9 [ 107.821954] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 107.829232] RBP: 00000000006e3c40 R08: 0000000000000000 R09: 0000000000000000 [ 107.836514] R10: 0000000000000000 R11: 0000000000000206 R12: 00000000006e3c4c [ 107.843808] R13: 00007ffd978aeb2f R14: 00007f096b2939c0 R15: 00000000006e3d4c [ 107.852099] Kernel Offset: disabled [ 107.855737] Rebooting in 86400 seconds..