[ OK ] Found device /dev/ttyS0. [ OK ] Started Permit User Sessions. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Started System Logging Service. [ *** ] A start job is running for OpenBSD …Shell server (1min 21s / 2min 40s)[ *** ] A start job is running for OpenBSD …Shell server (1min 21s / 2min 40s)[*** ] A start job is running for OpenBSD …Shell server (1min 22s / 2min 40s)[** ] A start job is running for OpenBSD …Shell server (1min 22s / 2min 40s)[* ] A start job is running for OpenBSD …Shell server (1min 24s / 2min 53s)[ OK ] Started OpenBSD Secure Shell server. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.40' (ECDSA) to the list of known hosts. syzkaller login: [ 133.526654][ T8221] IPVS: ftp: loaded support on port[0] = 21 [ 133.689225][ T8221] chnl_net:caif_netlink_parms(): no params data found [ 133.781854][ T8221] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.789746][ T8221] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.799276][ T8221] device bridge_slave_0 entered promiscuous mode [ 133.810235][ T8221] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.817969][ T8221] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.827834][ T8221] device bridge_slave_1 entered promiscuous mode [ 133.860154][ T8221] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 133.873177][ T8221] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 133.905989][ T8221] team0: Port device team_slave_0 added [ 133.916614][ T8221] team0: Port device team_slave_1 added [ 133.945534][ T8221] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 133.952557][ T8221] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 133.978826][ T8221] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 133.992138][ T8221] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 133.999416][ T8221] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 134.026647][ T8221] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 134.069686][ T8221] device hsr_slave_0 entered promiscuous mode [ 134.077391][ T8221] device hsr_slave_1 entered promiscuous mode [ 134.298685][ T8221] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 134.347129][ T8221] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 134.376778][ T8221] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 134.402518][ T8221] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 134.481852][ T8221] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.489196][ T8221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.497130][ T8221] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.504631][ T8221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.584893][ T8221] 8021q: adding VLAN 0 to HW filter on device bond0 [ 134.608835][ T2013] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 134.620027][ T2013] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.630523][ T2013] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.641462][ T2013] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 134.660840][ T8221] 8021q: adding VLAN 0 to HW filter on device team0 [ 134.675859][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 134.685909][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 134.695801][ T18] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.703124][ T18] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.718104][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 134.728278][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 134.738003][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.745618][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.763550][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 134.779131][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 134.804340][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 134.815606][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 134.825164][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 134.836905][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 134.847285][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 134.861223][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 134.871076][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 134.889886][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 134.899241][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 134.916390][ T8221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 134.947723][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 134.955912][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 134.975444][ T8221] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.008334][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 135.019426][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 135.055100][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 135.064827][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 135.079150][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 135.088202][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 135.102473][ T8221] device veth0_vlan entered promiscuous mode [ 135.120953][ T8221] device veth1_vlan entered promiscuous mode [ 135.160158][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 135.169293][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 135.179435][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 135.189745][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 135.205632][ T8221] device veth0_macvtap entered promiscuous mode [ 135.220279][ T8221] device veth1_macvtap entered promiscuous mode [ 135.250329][ T8221] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 135.258987][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 135.268588][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 135.277780][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 135.287643][ T2092] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 135.304909][ T8221] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 135.312355][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 135.322293][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 135.339525][ T8221] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.348474][ T8221] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.357573][ T8221] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.367304][ T8221] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 executing program [ 135.492509][ C0] ===================================================== [ 135.499495][ C0] BUG: KMSAN: uninit-value in ip_rcv_core+0xf4c/0x1480 [ 135.506387][ C0] CPU: 0 PID: 8432 Comm: syz-executor629 Not tainted 5.11.0-rc7-syzkaller #0 [ 135.515186][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 135.525254][ C0] Call Trace: [ 135.528715][ C0] [ 135.531566][ C0] dump_stack+0x21c/0x280 [ 135.536017][ C0] kmsan_report+0xfb/0x1e0 [ 135.540466][ C0] __msan_warning+0x5f/0xa0 [ 135.545085][ C0] ip_rcv_core+0xf4c/0x1480 [ 135.549617][ C0] ip_rcv+0xc7/0x820 [ 135.553534][ C0] ? kmsan_get_metadata+0x116/0x180 [ 135.558780][ C0] __netif_receive_skb+0x1ec/0x640 [ 135.563938][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 135.569611][ C0] ? ip_local_deliver_finish+0x370/0x370 [ 135.575281][ C0] process_backlog+0x517/0xbd0 [ 135.580073][ C0] ? native_apic_mem_write+0x45/0x90 [ 135.585390][ C0] ? rps_trigger_softirq+0x2e0/0x2e0 [ 135.590702][ C0] napi_poll+0x428/0x15c0 [ 135.595062][ C0] net_rx_action+0x34c/0xd30 [ 135.599682][ C0] ? net_tx_action+0xd30/0xd30 [ 135.604468][ C0] __do_softirq+0x1b9/0x715 [ 135.608995][ C0] asm_call_irq_on_stack+0xf/0x20 [ 135.614040][ C0] [ 135.616974][ C0] do_softirq_own_stack+0x6e/0x90 [ 135.622020][ C0] __local_bh_enable_ip+0x184/0x1d0 [ 135.627238][ C0] local_bh_enable+0x36/0x40 [ 135.631820][ C0] __dev_queue_xmit+0x3b3e/0x45c0 [ 135.636838][ C0] dev_queue_xmit+0x4b/0x60 [ 135.641333][ C0] ? netdev_core_pick_tx+0x5a0/0x5a0 [ 135.646612][ C0] packet_sendmsg+0x8778/0x9a60 [ 135.651477][ C0] ? kmsan_get_metadata+0x116/0x180 [ 135.656685][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 135.662323][ C0] ? kmsan_get_metadata+0x116/0x180 [ 135.667527][ C0] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 135.673371][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 135.679466][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 135.684586][ C0] ? packet_getsockopt+0x1120/0x1120 [ 135.689964][ C0] __sys_sendmsg+0x714/0x830 [ 135.694562][ C0] ? kmsan_get_metadata+0x117/0x180 [ 135.699756][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 135.705398][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 135.714343][ C0] ? kmsan_get_metadata+0x116/0x180 [ 135.719558][ C0] __se_sys_sendmsg+0x97/0xb0 [ 135.724226][ C0] __x64_sys_sendmsg+0x4a/0x70 [ 135.728996][ C0] do_syscall_64+0x9f/0x140 [ 135.733507][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 135.739405][ C0] RIP: 0033:0x443df9 [ 135.743294][ C0] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 135.762935][ C0] RSP: 002b:00007ffe8075df28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 135.771351][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443df9 [ 135.779317][ C0] RDX: 0000000000000000 RSI: 00000000200027c0 RDI: 0000000000000003 [ 135.787301][ C0] RBP: 0000000000000000 R08: 0000000000f0b5ff R09: 0000000000f0b5ff [ 135.795263][ C0] R10: 00007ffe8075d9a0 R11: 0000000000000246 R12: 00007ffe8075df60 [ 135.803244][ C0] R13: 00007ffe8075df50 R14: 00007ffe8075df40 R15: 0000000000000003 [ 135.811276][ C0] [ 135.813591][ C0] Uninit was stored to memory at: [ 135.818608][ C0] kmsan_internal_chain_origin+0xad/0x130 [ 135.824325][ C0] __msan_chain_origin+0x57/0xa0 [ 135.829254][ C0] iptunnel_xmit+0xbd6/0xf20 [ 135.833885][ C0] udp_tunnel_xmit_skb+0x526/0x640 [ 135.838987][ C0] geneve_xmit+0x209e/0x3c20 [ 135.843570][ C0] xmit_one+0x2b6/0x760 [ 135.847740][ C0] __dev_queue_xmit+0x3426/0x45c0 [ 135.852789][ C0] dev_queue_xmit+0x4b/0x60 [ 135.857322][ C0] packet_sendmsg+0x8778/0x9a60 [ 135.862184][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 135.867064][ C0] __sys_sendmsg+0x714/0x830 [ 135.871644][ C0] __se_sys_sendmsg+0x97/0xb0 [ 135.876309][ C0] __x64_sys_sendmsg+0x4a/0x70 [ 135.881060][ C0] do_syscall_64+0x9f/0x140 [ 135.885559][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 135.891476][ C0] [ 135.893809][ C0] Uninit was created at: [ 135.898129][ C0] kmsan_internal_poison_shadow+0x5c/0xf0 [ 135.903841][ C0] kmsan_slab_alloc+0x8d/0xe0 [ 135.908508][ C0] __kmalloc_node_track_caller+0xa37/0x1430 [ 135.914406][ C0] __alloc_skb+0x2f8/0xb30 [ 135.918812][ C0] alloc_skb_with_frags+0x1f3/0xc10 [ 135.924028][ C0] sock_alloc_send_pskb+0xdc1/0xf90 [ 135.929243][ C0] packet_sendmsg+0x6aab/0x9a60 [ 135.934116][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 135.938966][ C0] __sys_sendmsg+0x714/0x830 [ 135.943539][ C0] __se_sys_sendmsg+0x97/0xb0 [ 135.948199][ C0] __x64_sys_sendmsg+0x4a/0x70 [ 135.952946][ C0] do_syscall_64+0x9f/0x140 [ 135.957437][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 135.963329][ C0] ===================================================== [ 135.970241][ C0] Disabling lock debugging due to kernel taint [ 135.976408][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 135.983007][ C0] CPU: 0 PID: 8432 Comm: syz-executor629 Tainted: G B 5.11.0-rc7-syzkaller #0 [ 135.994184][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 136.004597][ C0] Call Trace: [ 136.007887][ C0] [ 136.011009][ C0] dump_stack+0x21c/0x280 [ 136.015420][ C0] panic+0x4c6/0xea7 [ 136.019311][ C0] ? add_taint+0x17c/0x210 [ 136.023721][ C0] kmsan_report+0x1de/0x1e0 [ 136.028230][ C0] __msan_warning+0x5f/0xa0 [ 136.032725][ C0] ip_rcv_core+0xf4c/0x1480 [ 136.037250][ C0] ip_rcv+0xc7/0x820 [ 136.041201][ C0] ? kmsan_get_metadata+0x116/0x180 [ 136.046397][ C0] __netif_receive_skb+0x1ec/0x640 [ 136.051592][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 136.057246][ C0] ? ip_local_deliver_finish+0x370/0x370 [ 136.062899][ C0] process_backlog+0x517/0xbd0 [ 136.067685][ C0] ? native_apic_mem_write+0x45/0x90 [ 136.072997][ C0] ? rps_trigger_softirq+0x2e0/0x2e0 [ 136.078317][ C0] napi_poll+0x428/0x15c0 [ 136.082653][ C0] net_rx_action+0x34c/0xd30 [ 136.087259][ C0] ? net_tx_action+0xd30/0xd30 [ 136.092042][ C0] __do_softirq+0x1b9/0x715 [ 136.096539][ C0] asm_call_irq_on_stack+0xf/0x20 [ 136.101565][ C0] [ 136.104502][ C0] do_softirq_own_stack+0x6e/0x90 [ 136.109537][ C0] __local_bh_enable_ip+0x184/0x1d0 [ 136.114734][ C0] local_bh_enable+0x36/0x40 [ 136.119320][ C0] __dev_queue_xmit+0x3b3e/0x45c0 [ 136.124635][ C0] dev_queue_xmit+0x4b/0x60 [ 136.129143][ C0] ? netdev_core_pick_tx+0x5a0/0x5a0 [ 136.134452][ C0] packet_sendmsg+0x8778/0x9a60 [ 136.139317][ C0] ? kmsan_get_metadata+0x116/0x180 [ 136.144572][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 136.150214][ C0] ? kmsan_get_metadata+0x116/0x180 [ 136.155425][ C0] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 136.161227][ C0] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 136.167328][ C0] ____sys_sendmsg+0xcfc/0x12f0 [ 136.172207][ C0] ? packet_getsockopt+0x1120/0x1120 [ 136.177500][ C0] __sys_sendmsg+0x714/0x830 [ 136.182091][ C0] ? kmsan_get_metadata+0x117/0x180 [ 136.187286][ C0] ? kmsan_internal_set_origin+0x85/0xc0 [ 136.192934][ C0] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 136.199029][ C0] ? kmsan_get_metadata+0x116/0x180 [ 136.204226][ C0] __se_sys_sendmsg+0x97/0xb0 [ 136.210158][ C0] __x64_sys_sendmsg+0x4a/0x70 [ 136.214914][ C0] do_syscall_64+0x9f/0x140 [ 136.219413][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 136.225299][ C0] RIP: 0033:0x443df9 [ 136.229185][ C0] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 136.248796][ C0] RSP: 002b:00007ffe8075df28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 136.257232][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443df9 [ 136.265220][ C0] RDX: 0000000000000000 RSI: 00000000200027c0 RDI: 0000000000000003 [ 136.275725][ C0] RBP: 0000000000000000 R08: 0000000000f0b5ff R09: 0000000000f0b5ff [ 136.283736][ C0] R10: 00007ffe8075d9a0 R11: 0000000000000246 R12: 00007ffe8075df60 [ 136.291715][ C0] R13: 00007ffe8075df50 R14: 00007ffe8075df40 R15: 0000000000000003 [ 136.300298][ C0] Kernel Offset: disabled [ 136.304633][ C0] Rebooting in 86400 seconds..