INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.49' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 41.563379] device ifb0 entered promiscuous mode [ 41.571788] ================================================================== [ 41.579158] BUG: KMSAN: uninit-value in tun_get_user+0x2b93/0x7580 [ 41.585466] CPU: 1 PID: 3581 Comm: syzkaller636736 Not tainted 4.16.0+ #82 [ 41.592454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.601791] Call Trace: [ 41.604368] dump_stack+0x185/0x1d0 [ 41.607985] ? tun_get_user+0x2b93/0x7580 [ 41.612110] kmsan_report+0x142/0x240 [ 41.615895] __msan_warning_32+0x6c/0xb0 [ 41.619942] tun_get_user+0x2b93/0x7580 [ 41.623896] ? _cond_resched+0x3c/0xd0 [ 41.627764] ? find_lock_entry+0x157/0x720 [ 41.631984] ? page_mapping+0x300/0x480 [ 41.635954] tun_chr_write_iter+0x1d4/0x330 [ 41.640258] ? tun_chr_read_iter+0x460/0x460 [ 41.644648] __vfs_write+0x719/0x910 [ 41.648347] __kernel_write+0x201/0x5c0 [ 41.652312] write_pipe_buf+0x1d5/0x270 [ 41.656283] ? propagate_umount+0x3a30/0x3a30 [ 41.660758] __splice_from_pipe+0x49a/0xf30 [ 41.665058] ? default_file_splice_write+0x380/0x380 [ 41.670144] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 41.675487] default_file_splice_write+0x1d9/0x380 [ 41.680396] ? default_file_splice_read+0x1120/0x1120 [ 41.685562] direct_splice_actor+0x19b/0x200 [ 41.689945] splice_direct_to_actor+0x764/0x1040 [ 41.694680] ? do_splice_direct+0x540/0x540 [ 41.698982] ? security_file_permission+0x28f/0x4b0 [ 41.703975] ? rw_verify_area+0x35e/0x580 [ 41.708104] do_splice_direct+0x335/0x540 [ 41.712228] do_sendfile+0x1067/0x1e40 [ 41.716101] SYSC_sendfile64+0x1b3/0x300 [ 41.720141] SyS_sendfile64+0x64/0x90 [ 41.723919] do_syscall_64+0x309/0x430 [ 41.727781] ? SYSC_sendfile+0x320/0x320 [ 41.731832] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 41.736996] RIP: 0033:0x443e69 [ 41.740158] RSP: 002b:00007ffc5b45bb18 EFLAGS: 00000217 ORIG_RAX: 0000000000000028 [ 41.747840] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000443e69 [ 41.755085] RDX: 0000000020000080 RSI: 0000000000000005 RDI: 0000000000000004 [ 41.762336] RBP: 00000000006ce018 R08: 00000000004002e0 R09: 00000000004002e0 [ 41.769580] R10: 0000000001000fed R11: 0000000000000217 R12: 0000000000401b10 [ 41.776825] R13: 0000000000401ba0 R14: 0000000000000000 R15: 0000000000000000 [ 41.784070] [ 41.785667] Uninit was stored to memory at: [ 41.789963] kmsan_internal_chain_origin+0x12b/0x210 [ 41.795054] kmsan_memcpy_origins+0x11d/0x170 [ 41.799535] __msan_memcpy+0x19f/0x1f0 [ 41.803407] _copy_from_iter_full+0xdfc/0x1450 [ 41.807966] tun_get_user+0x600/0x7580 [ 41.811826] tun_chr_write_iter+0x1d4/0x330 [ 41.816122] __vfs_write+0x719/0x910 [ 41.819809] __kernel_write+0x201/0x5c0 [ 41.823764] write_pipe_buf+0x1d5/0x270 [ 41.827711] __splice_from_pipe+0x49a/0xf30 [ 41.832007] default_file_splice_write+0x1d9/0x380 [ 41.836914] direct_splice_actor+0x19b/0x200 [ 41.841298] splice_direct_to_actor+0x764/0x1040 [ 41.846025] do_splice_direct+0x335/0x540 [ 41.850148] do_sendfile+0x1067/0x1e40 [ 41.854012] SYSC_sendfile64+0x1b3/0x300 [ 41.858049] SyS_sendfile64+0x64/0x90 [ 41.861825] do_syscall_64+0x309/0x430 [ 41.865689] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 41.870855] Uninit was created at: [ 41.874372] kmsan_alloc_meta_for_pages+0x161/0x3a0 [ 41.879373] kmsan_alloc_page+0x82/0xe0 [ 41.883322] __alloc_pages_nodemask+0xf5b/0x5dc0 [ 41.888051] alloc_pages_vma+0xcc8/0x1800 [ 41.892173] shmem_alloc_and_acct_page+0x6d5/0x1000 [ 41.897163] shmem_getpage_gfp+0x35db/0x5770 [ 41.901548] shmem_fallocate+0xde2/0x1610 [ 41.905671] vfs_fallocate+0x9dc/0xde0 [ 41.909536] SYSC_fallocate+0x119/0x1d0 [ 41.913485] SyS_fallocate+0x64/0x90 [ 41.917175] do_syscall_64+0x309/0x430 [ 41.921040] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 41.926197] ================================================================== [ 41.933781] Disabling lock debugging due to kernel taint [ 41.939205] Kernel panic - not syncing: panic_on_warn set ... [ 41.939205] [ 41.946545] CPU: 1 PID: 3581 Comm: syzkaller636736 Tainted: G B 4.16.0+ #82 [ 41.954834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.964164] Call Trace: [ 41.966734] dump_stack+0x185/0x1d0 [ 41.970339] panic+0x39d/0x940 [ 41.973517] ? tun_get_user+0x2b93/0x7580 [ 41.977639] kmsan_report+0x238/0x240 [ 41.981419] __msan_warning_32+0x6c/0xb0 [ 41.985456] tun_get_user+0x2b93/0x7580 [ 41.989405] ? _cond_resched+0x3c/0xd0 [ 41.993266] ? find_lock_entry+0x157/0x720 [ 41.997480] ? page_mapping+0x300/0x480 [ 42.001436] tun_chr_write_iter+0x1d4/0x330 [ 42.005730] ? tun_chr_read_iter+0x460/0x460 [ 42.010115] __vfs_write+0x719/0x910 [ 42.013809] __kernel_write+0x201/0x5c0 [ 42.017761] write_pipe_buf+0x1d5/0x270 [ 42.021717] ? propagate_umount+0x3a30/0x3a30 [ 42.026197] __splice_from_pipe+0x49a/0xf30 [ 42.030495] ? default_file_splice_write+0x380/0x380 [ 42.035575] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 42.040917] default_file_splice_write+0x1d9/0x380 [ 42.045831] ? default_file_splice_read+0x1120/0x1120 [ 42.050996] direct_splice_actor+0x19b/0x200 [ 42.055388] splice_direct_to_actor+0x764/0x1040 [ 42.060120] ? do_splice_direct+0x540/0x540 [ 42.064417] ? security_file_permission+0x28f/0x4b0 [ 42.069412] ? rw_verify_area+0x35e/0x580 [ 42.073536] do_splice_direct+0x335/0x540 [ 42.077667] do_sendfile+0x1067/0x1e40 [ 42.081544] SYSC_sendfile64+0x1b3/0x300 [ 42.085589] SyS_sendfile64+0x64/0x90 [ 42.089365] do_syscall_64+0x309/0x430 [ 42.093234] ? SYSC_sendfile+0x320/0x320 [ 42.097273] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 42.102433] RIP: 0033:0x443e69 [ 42.105597] RSP: 002b:00007ffc5b45bb18 EFLAGS: 00000217 ORIG_RAX: 0000000000000028 [ 42.113278] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000443e69 [ 42.120523] RDX: 0000000020000080 RSI: 0000000000000005 RDI: 0000000000000004 [ 42.127767] RBP: 00000000006ce018 R08: 00000000004002e0 R09: 00000000004002e0 [ 42.135014] R10: 0000000001000fed R11: 0000000000000217 R12: 0000000000401b10 [ 42.142262] R13: 0000000000401ba0 R14: 0000000000000000 R15: 0000000000000000 [ 42.149901] Dumping ftrace buffer: [ 42.153419] (ftrace buffer empty) [ 42.157102] Kernel Offset: disabled [ 42.160706] Rebooting in 86400 seconds..