./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor149689819 <...> Warning: Permanently added '10.128.0.158' (ED25519) to the list of known hosts. execve("./syz-executor149689819", ["./syz-executor149689819"], 0x7ffdbabcb4d0 /* 10 vars */) = 0 brk(NULL) = 0x55555694d000 brk(0x55555694dd00) = 0x55555694dd00 arch_prctl(ARCH_SET_FS, 0x55555694d380) = 0 set_tid_address(0x55555694d650) = 4984 set_robust_list(0x55555694d660, 24) = 0 rseq(0x55555694dca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor149689819", 4096) = 27 getrandom("\xd8\xff\x98\x8c\x5e\x6d\x52\xec", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555694dd00 brk(0x55555696ed00) = 0x55555696ed00 brk(0x55555696f000) = 0x55555696f000 mprotect(0x7f110395b000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555694d650) = 4985 ./strace-static-x86_64: Process 4985 attached [pid 4985] set_robust_list(0x55555694d660, 24) = 0 [pid 4985] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4985] setpgid(0, 0) = 0 [pid 4985] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 4985] write(3, "1000", 4) = 4 [pid 4985] close(3) = 0 [pid 4985] openat(AT_FDCWD, "/dev/net/tun", O_WRONLY|O_CREAT|O_TRUNC|O_NOATIME, 000) = 3 [pid 4985] ioctl(3, TUNSETIFF, 0x20000200) = 0 [pid 4985] socket(AF_INET, SOCK_PACKET, IPPROTO_IGMP) = 4 [pid 4985] ioctl(4, SIOCSIFFLAGS, {ifr_name="syzkaller1", ifr_flags=IFF_UP|IFF_DYNAMIC}) = 0 syzkaller login: [ 164.403224][ T4985] syz-executor149 uses obsolete (PF_INET,SOCK_PACKET) [ 164.422936][ T4985] ===================================================== [ 164.430329][ T4985] BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 [ 164.438813][ T4985] __llc_lookup_established+0xe9d/0xf90 [ 164.444613][ T4985] llc_conn_handler+0x4bd/0x1360 [ 164.449899][ T4985] llc_rcv+0xfbb/0x14a0 [ 164.454231][ T4985] __netif_receive_skb+0x1a6/0x5a0 [ 164.459663][ T4985] netif_receive_skb+0x58/0x660 [ 164.464784][ T4985] tun_rx_batched+0x83b/0x920 [ 164.469764][ T4985] tun_get_user+0x54ca/0x6920 [ 164.474633][ T4985] tun_chr_write_iter+0x3af/0x5d0 [ 164.480037][ T4985] vfs_write+0x8ef/0x15c0 [ 164.484564][ T4985] ksys_write+0x20f/0x4c0 [ 164.489167][ T4985] __x64_sys_write+0x93/0xd0 [ 164.493932][ T4985] do_syscall_64+0x41/0xc0 [ 164.498657][ T4985] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 164.504792][ T4985] [ 164.507310][ T4985] Local variable daddr created at: [ 164.512528][ T4985] llc_conn_handler+0x53/0x1360 [ 164.517694][ T4985] llc_rcv+0xfbb/0x14a0 [ 164.522049][ T4985] [ 164.524467][ T4985] CPU: 1 PID: 4985 Comm: syz-executor149 Not tainted 6.5.0-rc3-syzkaller-00044-g0a8db05b571a #0 [ 164.535183][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 164.545568][ T4985] ===================================================== [ 164.552619][ T4985] Disabling lock debugging due to kernel taint [ 164.559004][ T4985] Kernel panic - not syncing: kmsan.panic set ... [ 164.565543][ T4985] CPU: 1 PID: 4985 Comm: syz-executor149 Tainted: G B 6.5.0-rc3-syzkaller-00044-g0a8db05b571a #0 [ 164.577616][ T4985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 164.587810][ T4985] Call Trace: [ 164.591222][ T4985] [ 164.594265][ T4985] dump_stack_lvl+0x1bf/0x240 [ 164.599180][ T4985] dump_stack+0x1e/0x20 [ 164.603562][ T4985] panic+0x4d5/0xc70 [ 164.607644][ T4985] ? add_taint+0x108/0x1a0 [ 164.612246][ T4985] kmsan_report+0x2d0/0x2d0 [ 164.616974][ T4985] ? kmsan_slab_free+0xd1/0x130 [ 164.622037][ T4985] ? stp_pdu_rcv+0x450/0x600 [ 164.626823][ T4985] ? llc_rcv+0xb4a/0x14a0 [ 164.631326][ T4985] ? __netif_receive_skb+0x1a6/0x5a0 [ 164.636808][ T4985] ? netif_receive_skb+0x58/0x660 [ 164.642021][ T4985] ? tun_rx_batched+0x83b/0x920 [ 164.647071][ T4985] ? __msan_warning+0x96/0x110 [ 164.652063][ T4985] ? __llc_lookup_established+0xe9d/0xf90 [ 164.658026][ T4985] ? llc_conn_handler+0x4bd/0x1360 [ 164.663371][ T4985] ? llc_rcv+0xfbb/0x14a0 [ 164.667890][ T4985] ? __netif_receive_skb+0x1a6/0x5a0 [ 164.673383][ T4985] ? netif_receive_skb+0x58/0x660 [ 164.678585][ T4985] ? tun_rx_batched+0x83b/0x920 [ 164.683642][ T4985] ? tun_get_user+0x54ca/0x6920 [ 164.688690][ T4985] ? tun_chr_write_iter+0x3af/0x5d0 [ 164.694093][ T4985] ? vfs_write+0x8ef/0x15c0 [ 164.698769][ T4985] ? ksys_write+0x20f/0x4c0 [ 164.703450][ T4985] ? __x64_sys_write+0x93/0xd0 [ 164.708390][ T4985] ? do_syscall_64+0x41/0xc0 [ 164.713200][ T4985] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 164.719504][ T4985] ? kmsan_internal_chain_origin+0xba/0xd0 [ 164.725556][ T4985] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 164.731838][ T4985] ? kmsan_internal_chain_origin+0x57/0xd0 [ 164.737920][ T4985] ? __msan_chain_origin+0xc1/0x140 [ 164.743351][ T4985] ? __skb_clone+0x588/0x650 [ 164.748153][ T4985] ? skb_clone+0x3aa/0x540 [ 164.752796][ T4985] ? llc_rcv+0xae5/0x14a0 [ 164.757317][ T4985] ? __netif_receive_skb+0x1a6/0x5a0 [ 164.762833][ T4985] ? netif_receive_skb+0x58/0x660 [ 164.768044][ T4985] ? tun_rx_batched+0x83b/0x920 [ 164.773100][ T4985] ? tun_get_user+0x54ca/0x6920 [ 164.778242][ T4985] ? tun_chr_write_iter+0x3af/0x5d0 [ 164.783653][ T4985] ? vfs_write+0x8ef/0x15c0 [ 164.788352][ T4985] ? ksys_write+0x20f/0x4c0 [ 164.793033][ T4985] ? __x64_sys_write+0x93/0xd0 [ 164.797981][ T4985] ? do_syscall_64+0x41/0xc0 [ 164.802796][ T4985] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 164.809106][ T4985] ? kmsan_internal_chain_origin+0x57/0xd0 [ 164.815165][ T4985] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 164.821226][ T4985] __msan_warning+0x96/0x110 [ 164.826045][ T4985] __llc_lookup_established+0xe9d/0xf90 [ 164.831845][ T4985] ? _raw_spin_unlock_irqrestore+0x3f/0x60 [ 164.837918][ T4985] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 164.844071][ T4985] llc_conn_handler+0x4bd/0x1360 [ 164.849268][ T4985] ? stp_pdu_rcv+0x4bd/0x600 [ 164.854063][ T4985] ? llc_sap_remove_socket+0x4e0/0x4e0 [ 164.859769][ T4985] llc_rcv+0xfbb/0x14a0 [ 164.864133][ T4985] ? stp_proto_register+0x2a0/0x2a0 [ 164.869543][ T4985] __netif_receive_skb+0x1a6/0x5a0 [ 164.874890][ T4985] ? llc_set_station_handler+0x70/0x70 [ 164.880554][ T4985] netif_receive_skb+0x58/0x660 [ 164.885584][ T4985] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 164.891666][ T4985] tun_rx_batched+0x83b/0x920 [ 164.896558][ T4985] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 164.902610][ T4985] tun_get_user+0x54ca/0x6920 [ 164.907498][ T4985] ? kmsan_internal_set_shadow_origin+0x66/0xe0 [ 164.914007][ T4985] ? do_dentry_open+0x1a0/0x1ef0 [ 164.919286][ T4985] tun_chr_write_iter+0x3af/0x5d0 [ 164.924532][ T4985] ? tun_chr_read_iter+0x670/0x670 [ 164.929845][ T4985] vfs_write+0x8ef/0x15c0 [ 164.934384][ T4985] ksys_write+0x20f/0x4c0 [ 164.938915][ T4985] __x64_sys_write+0x93/0xd0 [ 164.943703][ T4985] do_syscall_64+0x41/0xc0 [ 164.948411][ T4985] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 164.954539][ T4985] RIP: 0033:0x7f11038e7cf9 [ 164.959110][ T4985] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 164.979281][ T4985] RSP: 002b:00007fff692fbd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 164.987890][ T4985] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f11038e7cf9 [ 164.996023][ T4985] RDX: 0000000000000066 RSI: 0000000020002300 RDI: 0000000000000003 [ 165.004166][ T4985] RBP: 00007f110395b5f0 R08: 0000000000000006 R09: 0000000000000006 [ 165.012299][ T4985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.020437][ T4985] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 [ 165.028607][ T4985] [ 165.032083][ T4985] Kernel Offset: disabled [ 165.036506][ T4985] Rebooting in 86400 seconds..