INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts. 2018/04/20 20:39:09 fuzzer started 2018/04/20 20:39:10 dialing manager at 10.128.0.26:40315 2018/04/20 20:39:16 kcov=true, comps=false 2018/04/20 20:39:19 executing program 0: 2018/04/20 20:39:19 executing program 2: 2018/04/20 20:39:19 executing program 7: 2018/04/20 20:39:19 executing program 1: 2018/04/20 20:39:19 executing program 3: 2018/04/20 20:39:19 executing program 5: 2018/04/20 20:39:19 executing program 4: 2018/04/20 20:39:19 executing program 6: syzkaller login: [ 46.453451] ip (3721) used greatest stack depth: 54672 bytes left [ 47.306756] ip (3806) used greatest stack depth: 54560 bytes left [ 47.323768] ip (3805) used greatest stack depth: 54200 bytes left [ 47.783214] ip (3847) used greatest stack depth: 53656 bytes left [ 47.902455] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.909080] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.953122] device bridge_slave_0 entered promiscuous mode [ 47.966781] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.973306] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.983467] device bridge_slave_0 entered promiscuous mode [ 48.026474] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.033099] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.065206] device bridge_slave_0 entered promiscuous mode [ 48.156729] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.163372] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.205874] device bridge_slave_1 entered promiscuous mode [ 48.231493] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.238129] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.248127] device bridge_slave_0 entered promiscuous mode [ 48.272727] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.279348] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.308552] device bridge_slave_0 entered promiscuous mode [ 48.325296] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.331796] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.352251] device bridge_slave_1 entered promiscuous mode [ 48.360602] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.367171] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.391892] device bridge_slave_1 entered promiscuous mode [ 48.419526] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.426087] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.447470] device bridge_slave_0 entered promiscuous mode [ 48.468891] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 48.476478] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.483081] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.501513] device bridge_slave_0 entered promiscuous mode [ 48.510383] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.516871] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.552239] device bridge_slave_1 entered promiscuous mode [ 48.562473] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.568962] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.603101] device bridge_slave_1 entered promiscuous mode [ 48.622315] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 48.632014] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 48.643835] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 48.652906] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.659450] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.713295] device bridge_slave_0 entered promiscuous mode [ 48.733555] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.740166] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.757061] device bridge_slave_1 entered promiscuous mode [ 48.777831] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 48.785645] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.792174] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.825210] device bridge_slave_1 entered promiscuous mode [ 48.850879] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 48.858567] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 48.868148] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 48.911312] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 48.956541] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.963112] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.011105] device bridge_slave_1 entered promiscuous mode [ 49.028772] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 49.050401] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 49.068473] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 49.121634] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 49.228163] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 49.358899] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 49.428510] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 49.658394] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 49.830812] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 49.861518] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 49.892148] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 50.036118] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 50.093484] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 50.104192] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 50.117807] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 50.157098] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 50.270193] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 50.305690] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 50.319338] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 50.406186] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 50.421358] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 50.548600] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 50.645979] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 50.824700] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.054988] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 51.076460] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.222899] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.288930] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 51.296507] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.310857] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.346905] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 51.357337] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.371843] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.401764] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.457638] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 51.530978] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 51.538506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.554639] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.574808] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 51.591928] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 51.599764] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.621180] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.645369] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 51.655629] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.663737] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 51.712972] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 51.720292] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.733066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.777289] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 51.793556] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 51.800792] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.817184] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.846260] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 51.854768] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 51.861949] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.873519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.912320] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 51.925726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.942719] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.972454] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 51.983434] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.996274] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 52.021399] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 52.033927] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 52.044919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.073884] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 52.101341] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 52.110967] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.153006] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 52.178809] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 52.190118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.211860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 52.234119] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 52.242274] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 52.250199] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.292795] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 52.308754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.317159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 52.329927] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 52.346404] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 52.361921] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.381806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 52.404355] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.428396] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 52.519813] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 52.527169] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.541253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.092888] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.099746] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.106644] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.113138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.178961] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.186502] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 54.451022] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.457588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.464517] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.471001] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.531848] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.601576] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.608134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.615079] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.621545] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.651102] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.661191] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.667667] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.674624] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.681149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.708686] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.719574] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.726115] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.732962] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.739437] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.747418] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.762181] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.768662] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.776862] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.783328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.852109] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.867563] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.874121] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.881128] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.887622] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.937551] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 54.978311] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.984831] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.991721] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.998184] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.068496] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 55.200165] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.215724] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.255725] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.289818] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.308741] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.317153] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 55.326227] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 63.828840] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.096774] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.278315] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.376925] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.431536] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.618587] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.630995] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.680203] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 64.686541] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 64.697768] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 64.730290] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 64.915093] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 64.921466] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 64.938677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.148865] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 65.157093] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.168680] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.222086] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 65.228342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.243194] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.290383] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 65.296876] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.307626] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.395205] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 65.401535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.412936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.503546] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 65.510888] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.523444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.557237] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 65.570201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.597780] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/04/20 20:39:46 executing program 1: 2018/04/20 20:39:46 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast2=0xe0000002, @local={0xac, 0x14, 0x14, 0xaa}, @multicast2=0xe0000002}, 0xc) 2018/04/20 20:39:46 executing program 7: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x4a, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="0000000000000000000000000000ffff00fd061580000000ffffffffffff0007000002001919aca8074c0003c789b23dbe6b4be237c2e812171b3ab056f2181c65e70ab69b3c2a1c141ec3ca86e4298df1a452e81570ad8219d5953dddaddc763629a9beefe0f501c5fe347e6609f6ae7304e8df2fd8db5f0342562a1bbf20bec919e9ec5a18d954495c85373c9007aa2cfe48eb7344c4fee2ca15c552b8d5bc5b438e6a7103582e65c41d6b20b4929f9c8abf211a4dd4237c0126da81ef81b5bdd80c63b5babafb0c53d6b9098fa6d82a8fdc8698aabc353b6d810bd6ff34d4d501973ba89953d8fb8fb9df68be9b46da4b336aee14b67cb297e064776e3f5b88be00387f4760e96417a4"], 0x1) ioctl(r0, 0x10000000000227d, &(0x7f0000000000)) 2018/04/20 20:39:47 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f000000d000)={0xa, 0x4e20}, 0x1c) recvmsg(r0, &(0x7f0000000480)={&(0x7f0000000300)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000000380), 0x118, &(0x7f0000000400)=""/100, 0x64}, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001000)="8e86a4b9500a1139a0d93a78de7ed00ae239", 0x12}], 0x1, &(0x7f0000002000)}, 0x8000) write(r0, &(0x7f0000000100)="d9af35936a5b087252d870823d5a32916ebfa3eec43895c15924239e7a54df90b17d3f1fd8ab27e109ad81c5db282a9f2a7594", 0x33) [ 71.859707] ================================================================== [ 71.867145] BUG: KMSAN: uninit-value in csum_partial_copy_to_user+0x450/0x500 [ 71.874409] CPU: 1 PID: 5667 Comm: syz-executor1 Not tainted 4.16.0+ #84 [ 71.881225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.890561] Call Trace: [ 71.893145] dump_stack+0x185/0x1d0 [ 71.896755] ? csum_partial_copy_to_user+0x450/0x500 [ 71.901837] kmsan_report+0x142/0x240 [ 71.905618] __msan_warning_32+0x6c/0xb0 [ 71.909659] csum_partial_copy_to_user+0x450/0x500 [ 71.914572] csum_and_copy_to_iter+0x3dc/0x2140 [ 71.919220] ? kmsan_set_origin_inline+0x6b/0x120 [ 71.924050] ? __msan_poison_alloca+0x15c/0x1d0 [ 71.928706] skb_copy_and_csum_datagram+0x6d2/0x1080 [ 71.933801] skb_copy_and_csum_datagram_msg+0x557/0x960 [ 71.939148] udpv6_recvmsg+0xc65/0x29e0 [ 71.943105] ? udp6_lib_lookup_skb+0x240/0x240 [ 71.947664] inet_recvmsg+0x4c2/0x5f0 [ 71.951447] sock_recvmsg+0x1d0/0x230 [ 71.955226] ? inet_sendpage+0x8c0/0x8c0 [ 71.959268] ___sys_recvmsg+0x3fb/0x810 [ 71.963227] ? __fget_light+0x56/0x710 [ 71.967104] ? __fdget+0x4e/0x60 [ 71.970456] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 71.975796] ? __fget_light+0x6b9/0x710 [ 71.979754] SYSC_recvmsg+0x298/0x3c0 [ 71.983545] SyS_recvmsg+0x54/0x80 [ 71.987067] do_syscall_64+0x309/0x430 [ 71.990935] ? ___sys_recvmsg+0x810/0x810 [ 71.995071] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 72.000337] RIP: 0033:0x455379 [ 72.003505] RSP: 002b:00007fdc17fe2c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 72.011330] RAX: ffffffffffffffda RBX: 00007fdc17fe36d4 RCX: 0000000000455379 [ 72.018582] RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000013 [ 72.025828] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 72.033076] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 72.040326] R13: 000000000000049f R14: 00000000006f9f88 R15: 0000000000000000 [ 72.047579] [ 72.049183] Uninit was created at: [ 72.052709] kmsan_alloc_meta_for_pages+0x161/0x3a0 [ 72.057700] kmsan_alloc_page+0x82/0xe0 [ 72.061654] __alloc_pages_nodemask+0xf5b/0x5dc0 [ 72.066394] alloc_pages_current+0x6b5/0x970 [ 72.070789] skb_page_frag_refill+0x3ba/0x5e0 [ 72.075257] sk_page_frag_refill+0xa4/0x340 [ 72.079556] __ip6_append_data+0x1a20/0x4bb0 [ 72.083941] ip6_append_data+0x40e/0x6b0 [ 72.087985] udpv6_sendmsg+0xfd5/0x45b0 [ 72.091942] inet_sendmsg+0x48d/0x740 [ 72.095723] sock_write_iter+0x3b9/0x470 [ 72.099778] __vfs_write+0x719/0x910 [ 72.103475] vfs_write+0x463/0x8d0 [ 72.106997] SYSC_write+0x172/0x360 [ 72.110607] SyS_write+0x55/0x80 [ 72.113959] do_syscall_64+0x309/0x430 [ 72.117842] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 72.123016] ================================================================== [ 72.130356] Disabling lock debugging due to kernel taint [ 72.135794] Kernel panic - not syncing: panic_on_warn set ... [ 72.135794] [ 72.143157] CPU: 1 PID: 5667 Comm: syz-executor1 Tainted: G B 4.16.0+ #84 [ 72.151287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 72.160629] Call Trace: [ 72.163234] dump_stack+0x185/0x1d0 [ 72.166859] panic+0x39d/0x940 [ 72.170042] ? csum_partial_copy_to_user+0x450/0x500 [ 72.175134] kmsan_report+0x238/0x240 [ 72.178923] __msan_warning_32+0x6c/0xb0 [ 72.183057] csum_partial_copy_to_user+0x450/0x500 [ 72.187994] csum_and_copy_to_iter+0x3dc/0x2140 [ 72.192701] ? kmsan_set_origin_inline+0x6b/0x120 [ 72.197538] ? __msan_poison_alloca+0x15c/0x1d0 [ 72.202212] skb_copy_and_csum_datagram+0x6d2/0x1080 [ 72.207310] skb_copy_and_csum_datagram_msg+0x557/0x960 [ 72.212669] udpv6_recvmsg+0xc65/0x29e0 [ 72.216643] ? udp6_lib_lookup_skb+0x240/0x240 [ 72.221210] inet_recvmsg+0x4c2/0x5f0 [ 72.224996] sock_recvmsg+0x1d0/0x230 [ 72.228774] ? inet_sendpage+0x8c0/0x8c0 [ 72.232829] ___sys_recvmsg+0x3fb/0x810 [ 72.236793] ? __fget_light+0x56/0x710 [ 72.240672] ? __fdget+0x4e/0x60 [ 72.244055] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 72.249409] ? __fget_light+0x6b9/0x710 [ 72.253380] SYSC_recvmsg+0x298/0x3c0 [ 72.257163] SyS_recvmsg+0x54/0x80 [ 72.260690] do_syscall_64+0x309/0x430 [ 72.264567] ? ___sys_recvmsg+0x810/0x810 [ 72.268720] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 72.273899] RIP: 0033:0x455379 [ 72.277066] RSP: 002b:00007fdc17fe2c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 72.284754] RAX: ffffffffffffffda RBX: 00007fdc17fe36d4 RCX: 0000000000455379 [ 72.292016] RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000013 [ 72.299271] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 72.306529] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 72.313800] R13: 000000000000049f R14: 00000000006f9f88 R15: 0000000000000000 [ 72.321704] Dumping ftrace buffer: [ 72.325235] (ftrace buffer empty) [ 72.328921] Kernel Offset: disabled [ 72.332534] Rebooting in 86400 seconds..