./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2146437024 <...> forked to background, child pid 3062 no interfaces have a carrier [ 74.517840][ T3063] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.541326][ T3063] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller syzkaller login: [ 100.252975][ T123] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.243' (ECDSA) to the list of known hosts. execve("./syz-executor2146437024", ["./syz-executor2146437024"], 0x7ffeebef2a00 /* 10 vars */) = 0 brk(NULL) = 0x555556f82000 brk(0x555556f82c40) = 0x555556f82c40 arch_prctl(ARCH_SET_FS, 0x555556f82300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2146437024", 4096) = 28 brk(0x555556fa3c40) = 0x555556fa3c40 brk(0x555556fa4000) = 0x555556fa4000 mprotect(0x7f7d02ee6000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556f825d0) = 3497 ./strace-static-x86_64: Process 3497 attached [pid 3497] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3497] setpgid(0, 0) = 0 [pid 3497] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3497] write(3, "1000", 4) = 4 [pid 3497] close(3) = 0 [pid 3497] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 3497] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 3497] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 3497] recvfrom(4, [{nlmsg_len=548, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=3497}, "\x01\x02\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00\x06\x00\x01\x00\x31\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x0a\x00\x00\x00\xe4\x01\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x03\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 548 [pid 3497] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3497}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 3497] close(4) = 0 [ 104.447421][ T3497] netlink: 4 bytes leftover after parsing attributes in process `syz-executor214'. [ 104.447497][ T3497] ===================================================== [ 104.447572][ T3497] BUG: KMSAN: uninit-value in strstr+0xb4/0x2e0 [ 104.447619][ T3497] strstr+0xb4/0x2e0 [ 104.447661][ T3497] tipc_nl_node_reset_link_stats+0x41e/0xba0 [ 104.447707][ T3497] genl_rcv_msg+0x103f/0x1260 [ 104.447747][ T3497] netlink_rcv_skb+0x3a5/0x6c0 [ 104.447801][ T3497] genl_rcv+0x3c/0x50 [ 104.447838][ T3497] netlink_unicast+0xf3b/0x1270 [ 104.447968][ T3497] netlink_sendmsg+0x1288/0x1440 [ 104.448007][ T3497] ____sys_sendmsg+0xabc/0xe90 [ 104.448046][ T3497] ___sys_sendmsg+0x2a5/0x350 [ 104.448084][ T3497] __x64_sys_sendmsg+0x367/0x540 [ 104.448122][ T3497] do_syscall_64+0x3d/0xb0 [ 104.448178][ T3497] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 104.448233][ T3497] [ 104.448240][ T3497] Uninit was created at: [ 104.448302][ T3497] __kmalloc_node_track_caller+0x86c/0x1230 [ 104.448363][ T3497] __alloc_skb+0x34a/0xd70 [ 104.448413][ T3497] netlink_sendmsg+0xb71/0x1440 [ 104.448450][ T3497] ____sys_sendmsg+0xabc/0xe90 [ 104.448486][ T3497] ___sys_sendmsg+0x2a5/0x350 [ 104.448522][ T3497] __x64_sys_sendmsg+0x367/0x540 [ 104.448558][ T3497] do_syscall_64+0x3d/0xb0 [ 104.448611][ T3497] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 104.448668][ T3497] [ 104.448676][ T3497] CPU: 0 PID: 3497 Comm: syz-executor214 Not tainted 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0 [ 104.448720][ T3497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 104.448741][ T3497] ===================================================== [ 104.448752][ T3497] Disabling lock debugging due to kernel taint [ 104.448764][ T3497] Kernel panic - not syncing: kmsan.panic set ... [ 104.617981][ T3497] CPU: 0 PID: 3497 Comm: syz-executor214 Tainted: G B 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0 [ 104.629901][ T3497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 104.639978][ T3497] Call Trace: [ 104.643277][ T3497] [ 104.646235][ T3497] dump_stack_lvl+0x1c8/0x256 [ 104.650980][ T3497] dump_stack+0x1a/0x1c [ 104.655200][ T3497] panic+0x4d3/0xc7d [ 104.659155][ T3497] ? print_tainted+0x1d1/0x1e0 [ 104.663977][ T3497] ? add_taint+0x104/0x1a0 [ 104.668441][ T3497] ? printk_sprint+0x29b/0x4d0 [ 104.673276][ T3497] kmsan_report+0x2cc/0x2d0 [ 104.677845][ T3497] ? __msan_warning+0x92/0x110 [ 104.682652][ T3497] ? strstr+0xb4/0x2e0 [ 104.686782][ T3497] ? tipc_nl_node_reset_link_stats+0x41e/0xba0 [ 104.693002][ T3497] ? genl_rcv_msg+0x103f/0x1260 [ 104.697902][ T3497] ? netlink_rcv_skb+0x3a5/0x6c0 [ 104.702887][ T3497] ? genl_rcv+0x3c/0x50 [ 104.707091][ T3497] ? netlink_unicast+0xf3b/0x1270 [ 104.712191][ T3497] ? netlink_sendmsg+0x1288/0x1440 [ 104.717345][ T3497] ? ____sys_sendmsg+0xabc/0xe90 [ 104.722332][ T3497] ? ___sys_sendmsg+0x2a5/0x350 [ 104.727216][ T3497] ? __x64_sys_sendmsg+0x367/0x540 [ 104.732378][ T3497] ? do_syscall_64+0x3d/0xb0 [ 104.737028][ T3497] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 104.743172][ T3497] ? kmsan_get_metadata+0x33/0x220 [ 104.748348][ T3497] ? kmsan_get_shadow_origin_ptr+0x9a/0xf0 [ 104.754198][ T3497] ? __nla_validate_parse+0x371f/0x4240 [ 104.759815][ T3497] ? preempt_count_sub+0x20/0x280 [ 104.764904][ T3497] ? kmsan_get_metadata+0x33/0x220 [ 104.770079][ T3497] ? kmsan_get_shadow_origin_ptr+0x9a/0xf0 [ 104.775938][ T3497] __msan_warning+0x92/0x110 [ 104.780588][ T3497] strstr+0xb4/0x2e0 [ 104.784522][ T3497] ? strcmp+0x5f/0x120 [ 104.788627][ T3497] tipc_nl_node_reset_link_stats+0x41e/0xba0 [ 104.794654][ T3497] ? tipc_nl_node_get_link+0x9b0/0x9b0 [ 104.800164][ T3497] genl_rcv_msg+0x103f/0x1260 [ 104.804923][ T3497] ? tipc_nl_node_get_link+0x9b0/0x9b0 [ 104.810435][ T3497] ? kmsan_get_metadata+0x33/0x220 [ 104.815610][ T3497] netlink_rcv_skb+0x3a5/0x6c0 [ 104.820429][ T3497] ? genl_bind+0x490/0x490 [ 104.824914][ T3497] ? genl_pernet_exit+0x60/0x60 [ 104.829817][ T3497] genl_rcv+0x3c/0x50 [ 104.833837][ T3497] netlink_unicast+0xf3b/0x1270 [ 104.838785][ T3497] netlink_sendmsg+0x1288/0x1440 [ 104.843790][ T3497] ? netlink_getsockopt+0xf20/0xf20 [ 104.849039][ T3497] ____sys_sendmsg+0xabc/0xe90 [ 104.853873][ T3497] ___sys_sendmsg+0x2a5/0x350 [ 104.858590][ T3497] ? __x64_sys_sendmsg+0xa5/0x540 [ 104.863670][ T3497] ? kmsan_get_metadata+0x33/0x220 [ 104.868923][ T3497] ? kmsan_get_shadow_origin_ptr+0x9a/0xf0 [ 104.874806][ T3497] ? kmsan_get_metadata+0x33/0x220 [ 104.880066][ T3497] ? kmsan_get_shadow_origin_ptr+0x9a/0xf0 [ 104.885917][ T3497] __x64_sys_sendmsg+0x367/0x540 [ 104.890953][ T3497] do_syscall_64+0x3d/0xb0 [ 104.895459][ T3497] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 104.901427][ T3497] RIP: 0033:0x7f7d02e79759 [ 104.905881][ T3497] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 104.925539][ T3497] RSP: 002b:00007ffce9ed1e18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 104.933997][ T3497] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7d02e79759 [ 104.941993][ T3497] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 104.950045][ T3497] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffce9ed1fb8 [ 104.958041][ T3497] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d02e3ca60 [ 104.966037][ T3497] R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 [ 104.974040][ T3497] [ 104.977263][ T3497] Kernel Offset: disabled [ 104.981609][ T3497] Rebooting in 86400 seconds..