[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 86.940447][ T31] audit: type=1800 audit(1571841999.982:25): pid=12048 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 86.964206][ T31] audit: type=1800 audit(1571842000.012:26): pid=12048 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 86.999682][ T31] audit: type=1800 audit(1571842000.032:27): pid=12048 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.209' (ECDSA) to the list of known hosts. syzkaller login: [ 100.139028][T12200] IPVS: ftp: loaded support on port[0] = 21 [ 100.214068][T12200] chnl_net:caif_netlink_parms(): no params data found [ 100.251071][T12200] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.258546][T12200] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.267194][T12200] device bridge_slave_0 entered promiscuous mode [ 100.275666][T12200] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.282979][T12200] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.291423][T12200] device bridge_slave_1 entered promiscuous mode [ 100.315297][T12200] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.326984][T12200] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.351519][T12200] team0: Port device team_slave_0 added [ 100.361294][T12200] team0: Port device team_slave_1 added [ 100.425622][T12200] device hsr_slave_0 entered promiscuous mode [ 100.473020][T12200] device hsr_slave_1 entered promiscuous mode [ 100.525745][T12200] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.533122][T12200] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.540620][T12200] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.547876][T12200] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.601741][T12200] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.618548][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.629225][ T30] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.638435][ T30] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.647693][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 100.663004][T12200] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.676243][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 100.685122][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.692815][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.706157][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 100.715932][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.723201][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.747183][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 100.757792][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 100.774072][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 100.794223][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 100.803788][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 100.817675][T12200] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready executing program [ 100.843856][T12200] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.937732][T12200] ===================================================== [ 100.944832][T12200] BUG: KMSAN: uninit-value in aes_encrypt+0x12d5/0x1bd0 [ 100.951767][T12200] CPU: 0 PID: 12200 Comm: syz-executor134 Not tainted 5.4.0-rc3+ #0 [ 100.959717][T12200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 100.969754][T12200] Call Trace: [ 100.973050][T12200] dump_stack+0x191/0x1f0 [ 100.977366][T12200] kmsan_report+0x14a/0x2f0 [ 100.981855][T12200] __msan_warning+0x73/0xf0 [ 100.986344][T12200] aes_encrypt+0x12d5/0x1bd0 [ 100.990951][T12200] aesti_encrypt+0xe8/0x130 [ 100.995971][T12200] ? aesti_set_key+0xb0/0xb0 [ 101.000540][T12200] crypto_cbcmac_digest_update+0x3cf/0x550 [ 101.006336][T12200] ? crypto_cbcmac_digest_init+0x140/0x140 [ 101.012124][T12200] shash_ahash_finup+0x659/0xb20 [ 101.017158][T12200] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 101.023035][T12200] shash_async_finup+0xbb/0x110 [ 101.027866][T12200] crypto_ahash_op+0x1cd/0x6e0 [ 101.032697][T12200] ? shash_async_final+0x420/0x420 [ 101.037785][T12200] ? shash_async_final+0x420/0x420 [ 101.043004][T12200] ? shash_async_final+0x420/0x420 [ 101.048192][T12200] crypto_ahash_finup+0x8c/0xb0 [ 101.053081][T12200] crypto_ccm_auth+0x14b2/0x1570 [ 101.058028][T12200] ? sg_next+0x83/0x130 [ 101.062199][T12200] crypto_ccm_encrypt+0x283/0x840 [ 101.067341][T12200] ? crypto_ccm_setauthsize+0xc0/0xc0 [ 101.072825][T12200] crypto_aead_encrypt+0xf2/0x180 [ 101.078456][T12200] tls_push_record+0x341e/0x4e50 [ 101.083410][T12200] ? kmsan_internal_set_origin+0x6a/0xb0 [ 101.089182][T12200] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 101.095099][T12200] bpf_exec_tx_verdict+0x1454/0x1c80 [ 101.100447][T12200] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 101.106523][T12200] ? get_user_pages_fast+0x69b/0x6e0 [ 101.111799][T12200] ? kmsan_get_metadata+0x39/0x350 [ 101.117038][T12200] tls_sw_sendmsg+0x158d/0x2710 [ 101.121893][T12200] ? udpv6_rcv+0x70/0x70 [ 101.126153][T12200] ? tls_tx_records+0xb40/0xb40 [ 101.130986][T12200] inet6_sendmsg+0x2d8/0x2e0 [ 101.135577][T12200] ? inet6_ioctl+0x340/0x340 [ 101.140149][T12200] __sys_sendto+0x8fc/0xc70 [ 101.144657][T12200] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 101.150548][T12200] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 101.156613][T12200] ? prepare_exit_to_usermode+0x19a/0x4d0 [ 101.162338][T12200] __se_sys_sendto+0x107/0x130 [ 101.167093][T12200] __x64_sys_sendto+0x6e/0x90 [ 101.171796][T12200] do_syscall_64+0xb6/0x160 [ 101.176306][T12200] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 101.182192][T12200] RIP: 0033:0x441cf9 [ 101.186068][T12200] Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 101.205841][T12200] RSP: 002b:00000000007eff08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 101.214248][T12200] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441cf9 [ 101.222205][T12200] RDX: fffffffffffffee0 RSI: 00000000200005c0 RDI: 0000000000000003 [ 101.230177][T12200] RBP: 00000000007eff30 R08: 0000000000000000 R09: 00000000000000b6 [ 101.238154][T12200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403490 [ 101.246160][T12200] R13: 0000000000403520 R14: 0000000000000000 R15: 0000000000000000 [ 101.254135][T12200] [ 101.256460][T12200] Uninit was stored to memory at: [ 101.261558][T12200] kmsan_internal_chain_origin+0xbd/0x170 [ 101.267475][T12200] __msan_chain_origin+0x6b/0xe0 [ 101.272432][T12200] __crypto_xor+0x1e8/0x1470 [ 101.277036][T12200] crypto_cbcmac_digest_update+0x2ba/0x550 [ 101.282832][T12200] shash_ahash_finup+0x659/0xb20 [ 101.287755][T12200] shash_async_finup+0xbb/0x110 [ 101.292593][T12200] crypto_ahash_op+0x1cd/0x6e0 [ 101.297332][T12200] crypto_ahash_finup+0x8c/0xb0 [ 101.302163][T12200] crypto_ccm_auth+0x14b2/0x1570 [ 101.307081][T12200] crypto_ccm_encrypt+0x283/0x840 [ 101.312085][T12200] crypto_aead_encrypt+0xf2/0x180 [ 101.317093][T12200] tls_push_record+0x341e/0x4e50 [ 101.322010][T12200] bpf_exec_tx_verdict+0x1454/0x1c80 [ 101.327464][T12200] tls_sw_sendmsg+0x158d/0x2710 [ 101.332349][T12200] inet6_sendmsg+0x2d8/0x2e0 [ 101.336922][T12200] __sys_sendto+0x8fc/0xc70 [ 101.341405][T12200] __se_sys_sendto+0x107/0x130 [ 101.346153][T12200] __x64_sys_sendto+0x6e/0x90 [ 101.350813][T12200] do_syscall_64+0xb6/0x160 [ 101.355319][T12200] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 101.361204][T12200] [ 101.363523][T12200] Uninit was created at: [ 101.367828][T12200] kmsan_save_stack_with_flags+0x3f/0x90 [ 101.373453][T12200] kmsan_alloc_page+0x153/0x370 [ 101.378282][T12200] __alloc_pages_nodemask+0x149d/0x60c0 [ 101.383821][T12200] alloc_pages_current+0x68d/0x9a0 [ 101.388931][T12200] skb_page_frag_refill+0x2b0/0x580 [ 101.394125][T12200] sk_page_frag_refill+0xa4/0x330 [ 101.399222][T12200] sk_msg_alloc+0x203/0x1050 [ 101.403826][T12200] tls_sw_sendmsg+0xb56/0x2710 [ 101.408952][T12200] inet6_sendmsg+0x2d8/0x2e0 [ 101.413540][T12200] __sys_sendto+0x8fc/0xc70 [ 101.418024][T12200] __se_sys_sendto+0x107/0x130 [ 101.422781][T12200] __x64_sys_sendto+0x6e/0x90 [ 101.427437][T12200] do_syscall_64+0xb6/0x160 [ 101.431946][T12200] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 101.437823][T12200] ===================================================== [ 101.444731][T12200] Disabling lock debugging due to kernel taint [ 101.450858][T12200] Kernel panic - not syncing: panic_on_warn set ... [ 101.457440][T12200] CPU: 0 PID: 12200 Comm: syz-executor134 Tainted: G B 5.4.0-rc3+ #0 [ 101.466783][T12200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 101.476835][T12200] Call Trace: [ 101.480147][T12200] dump_stack+0x191/0x1f0 [ 101.484482][T12200] panic+0x3c9/0xc1e [ 101.488404][T12200] kmsan_report+0x2e8/0x2f0 [ 101.492895][T12200] __msan_warning+0x73/0xf0 [ 101.497383][T12200] aes_encrypt+0x12d5/0x1bd0 [ 101.501998][T12200] aesti_encrypt+0xe8/0x130 [ 101.506493][T12200] ? aesti_set_key+0xb0/0xb0 [ 101.511190][T12200] crypto_cbcmac_digest_update+0x3cf/0x550 [ 101.516985][T12200] ? crypto_cbcmac_digest_init+0x140/0x140 [ 101.522772][T12200] shash_ahash_finup+0x659/0xb20 [ 101.527704][T12200] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 101.533579][T12200] shash_async_finup+0xbb/0x110 [ 101.538410][T12200] crypto_ahash_op+0x1cd/0x6e0 [ 101.543157][T12200] ? shash_async_final+0x420/0x420 [ 101.548263][T12200] ? shash_async_final+0x420/0x420 [ 101.553352][T12200] ? shash_async_final+0x420/0x420 [ 101.558452][T12200] crypto_ahash_finup+0x8c/0xb0 [ 101.563291][T12200] crypto_ccm_auth+0x14b2/0x1570 [ 101.568234][T12200] ? sg_next+0x83/0x130 [ 101.572370][T12200] crypto_ccm_encrypt+0x283/0x840 [ 101.577380][T12200] ? crypto_ccm_setauthsize+0xc0/0xc0 [ 101.582736][T12200] crypto_aead_encrypt+0xf2/0x180 [ 101.587843][T12200] tls_push_record+0x341e/0x4e50 [ 101.592772][T12200] ? kmsan_internal_set_origin+0x6a/0xb0 [ 101.598413][T12200] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 101.604298][T12200] bpf_exec_tx_verdict+0x1454/0x1c80 [ 101.609567][T12200] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 101.615613][T12200] ? get_user_pages_fast+0x69b/0x6e0 [ 101.620886][T12200] ? kmsan_get_metadata+0x39/0x350 [ 101.626022][T12200] tls_sw_sendmsg+0x158d/0x2710 [ 101.630912][T12200] ? udpv6_rcv+0x70/0x70 [ 101.635218][T12200] ? tls_tx_records+0xb40/0xb40 [ 101.640048][T12200] inet6_sendmsg+0x2d8/0x2e0 [ 101.644619][T12200] ? inet6_ioctl+0x340/0x340 [ 101.649210][T12200] __sys_sendto+0x8fc/0xc70 [ 101.653716][T12200] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 101.659604][T12200] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 101.665648][T12200] ? prepare_exit_to_usermode+0x19a/0x4d0 [ 101.671350][T12200] __se_sys_sendto+0x107/0x130 [ 101.676097][T12200] __x64_sys_sendto+0x6e/0x90 [ 101.680838][T12200] do_syscall_64+0xb6/0x160 [ 101.685323][T12200] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 101.691191][T12200] RIP: 0033:0x441cf9 [ 101.695075][T12200] Code: 43 02 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 101.715177][T12200] RSP: 002b:00000000007eff08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 101.723564][T12200] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441cf9 [ 101.731512][T12200] RDX: fffffffffffffee0 RSI: 00000000200005c0 RDI: 0000000000000003 [ 101.739545][T12200] RBP: 00000000007eff30 R08: 0000000000000000 R09: 00000000000000b6 [ 101.747499][T12200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403490 [ 101.755448][T12200] R13: 0000000000403520 R14: 0000000000000000 R15: 0000000000000000 [ 101.765109][T12200] Kernel Offset: disabled [ 101.769432][T12200] Rebooting in 86400 seconds..