[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 31.817414] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 36.420183] random: sshd: uninitialized urandom read (32 bytes read) [ 36.882556] random: sshd: uninitialized urandom read (32 bytes read) [ 38.666180] random: sshd: uninitialized urandom read (32 bytes read) [ 38.894962] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.23' (ECDSA) to the list of known hosts. [ 44.428824] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 44.541644] ================================================================== [ 44.549229] BUG: KMSAN: uninit-value in ip6_parse_tlv+0x8d5/0xcd0 [ 44.555446] CPU: 1 PID: 4535 Comm: syz-executor786 Not tainted 4.17.0-rc3+ #88 [ 44.562784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.572115] Call Trace: [ 44.574679] [ 44.576813] dump_stack+0x185/0x1d0 [ 44.580418] ? ip6_parse_tlv+0x8d5/0xcd0 [ 44.584461] kmsan_report+0x142/0x240 [ 44.588245] __msan_warning_32+0x6c/0xb0 [ 44.592301] ip6_parse_tlv+0x8d5/0xcd0 [ 44.596187] ipv6_destopt_rcv+0x50d/0xd90 [ 44.600318] ? ipv6_rthdr_rcv+0x5b00/0x5b00 [ 44.604633] ip6_input_finish+0xaac/0x2250 [ 44.608862] ? nf_hook_slow+0x36f/0x3d0 [ 44.612814] ip6_mc_input+0xa67/0x1080 [ 44.616679] ? ip6_input+0x320/0x320 [ 44.620381] ? ip6_input_finish+0x2250/0x2250 [ 44.624853] ip6_rcv_finish+0x46e/0x6e0 [ 44.628809] ipv6_rcv+0x1e16/0x2340 [ 44.632413] ? local_bh_enable+0x40/0x40 [ 44.636458] __netif_receive_skb_core+0x47df/0x4a90 [ 44.641455] ? ip6_rcv_finish+0x6e0/0x6e0 [ 44.645588] process_backlog+0x62d/0xe20 [ 44.649632] ? rps_trigger_softirq+0x2f0/0x2f0 [ 44.654194] net_rx_action+0x7c1/0x1a70 [ 44.658155] ? net_tx_action+0xab0/0xab0 [ 44.662209] __do_softirq+0x56d/0x93d [ 44.666007] do_softirq_own_stack+0x2a/0x40 [ 44.670313] [ 44.672529] do_softirq+0xb6/0xf0 [ 44.675965] dev_loopback_xmit+0x8b0/0x900 [ 44.680185] ip6_finish_output2+0x1e24/0x2110 [ 44.684661] ? validate_xmit_skb+0x1320/0x1320 [ 44.689228] ip6_finish_output+0xae9/0xba0 [ 44.693444] ip6_output+0x597/0x6c0 [ 44.697057] ? ip6_output+0x6c0/0x6c0 [ 44.700843] ? ac6_seq_show+0x200/0x200 [ 44.704795] ip6_local_out+0x15e/0x1d0 [ 44.708669] ip6_push_pending_frames+0x218/0x4d0 [ 44.713412] rawv6_sendmsg+0x4235/0x4fb0 [ 44.718031] ? do_ipv6_setsockopt+0x5f22/0x67d0 [ 44.722693] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 44.728125] ? pagevec_lru_move_fn+0x490/0x4e0 [ 44.732692] ? pgtable_trans_huge_deposit+0x439/0x5d0 [ 44.737864] ? compat_rawv6_ioctl+0x100/0x100 [ 44.742339] inet_sendmsg+0x48d/0x740 [ 44.746122] ? security_socket_sendmsg+0x91/0x1f0 [ 44.750943] ? inet_getname+0x4a0/0x4a0 [ 44.754959] __sys_sendto+0x6c0/0x7e0 [ 44.758740] ? prepare_exit_to_usermode+0x4a/0x3a0 [ 44.763647] ? syscall_return_slowpath+0xe9/0x700 [ 44.768471] __x64_sys_sendto+0x1a1/0x210 [ 44.772600] do_syscall_64+0x154/0x220 [ 44.776468] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 44.781633] RIP: 0033:0x43fe79 [ 44.784799] RSP: 002b:00007ffc475970d8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 44.792482] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fe79 [ 44.799732] RDX: 0000000000000000 RSI: 0000000020001ffe RDI: 0000000000000003 [ 44.806979] RBP: 00000000006ca018 R08: 0000000020003000 R09: 000000000000001c [ 44.814226] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004017a0 [ 44.821481] R13: 0000000000401830 R14: 0000000000000000 R15: 0000000000000000 [ 44.828733] [ 44.830345] Uninit was created at: [ 44.833871] kmsan_internal_poison_shadow+0xb8/0x1b0 [ 44.838951] kmsan_kmalloc+0x94/0x100 [ 44.842728] kmsan_slab_alloc+0x10/0x20 [ 44.846678] __kmalloc_node_track_caller+0xb32/0x11b0 [ 44.851859] __alloc_skb+0x2cf/0x9f0 [ 44.855548] alloc_skb_with_frags+0x1e6/0xb80 [ 44.860032] sock_alloc_send_pskb+0xb56/0x1190 [ 44.864600] sock_alloc_send_skb+0xca/0xe0 [ 44.868809] __ip6_append_data+0x33a2/0x4e40 [ 44.873192] ip6_append_data+0x40e/0x6b0 [ 44.877233] rawv6_sendmsg+0x2740/0x4fb0 [ 44.881271] inet_sendmsg+0x48d/0x740 [ 44.885055] __sys_sendto+0x6c0/0x7e0 [ 44.888847] __x64_sys_sendto+0x1a1/0x210 [ 44.892975] do_syscall_64+0x154/0x220 [ 44.896842] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 44.902010] ================================================================== [ 44.909351] Disabling lock debugging due to kernel taint [ 44.914784] Kernel panic - not syncing: panic_on_warn set ... [ 44.914784] [ 44.922131] CPU: 1 PID: 4535 Comm: syz-executor786 Tainted: G B 4.17.0-rc3+ #88 [ 44.930854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.940186] Call Trace: [ 44.942749] [ 44.944884] dump_stack+0x185/0x1d0 [ 44.948508] panic+0x39d/0x940 [ 44.951707] ? ip6_parse_tlv+0x8d5/0xcd0 [ 44.955764] kmsan_report+0x238/0x240 [ 44.959546] __msan_warning_32+0x6c/0xb0 [ 44.963589] ip6_parse_tlv+0x8d5/0xcd0 [ 44.967459] ipv6_destopt_rcv+0x50d/0xd90 [ 44.971590] ? ipv6_rthdr_rcv+0x5b00/0x5b00 [ 44.975888] ip6_input_finish+0xaac/0x2250 [ 44.980105] ? nf_hook_slow+0x36f/0x3d0 [ 44.984075] ip6_mc_input+0xa67/0x1080 [ 44.987960] ? ip6_input+0x320/0x320 [ 44.991656] ? ip6_input_finish+0x2250/0x2250 [ 44.996129] ip6_rcv_finish+0x46e/0x6e0 [ 45.000090] ipv6_rcv+0x1e16/0x2340 [ 45.003696] ? local_bh_enable+0x40/0x40 [ 45.007742] __netif_receive_skb_core+0x47df/0x4a90 [ 45.012747] ? ip6_rcv_finish+0x6e0/0x6e0 [ 45.016879] process_backlog+0x62d/0xe20 [ 45.020922] ? rps_trigger_softirq+0x2f0/0x2f0 [ 45.025481] net_rx_action+0x7c1/0x1a70 [ 45.029436] ? net_tx_action+0xab0/0xab0 [ 45.033480] __do_softirq+0x56d/0x93d [ 45.037265] do_softirq_own_stack+0x2a/0x40 [ 45.041562] [ 45.043779] do_softirq+0xb6/0xf0 [ 45.047229] dev_loopback_xmit+0x8b0/0x900 [ 45.051448] ip6_finish_output2+0x1e24/0x2110 [ 45.055934] ? validate_xmit_skb+0x1320/0x1320 [ 45.060497] ip6_finish_output+0xae9/0xba0 [ 45.064710] ip6_output+0x597/0x6c0 [ 45.068314] ? ip6_output+0x6c0/0x6c0 [ 45.072093] ? ac6_seq_show+0x200/0x200 [ 45.076057] ip6_local_out+0x15e/0x1d0 [ 45.079931] ip6_push_pending_frames+0x218/0x4d0 [ 45.084676] rawv6_sendmsg+0x4235/0x4fb0 [ 45.088717] ? do_ipv6_setsockopt+0x5f22/0x67d0 [ 45.093365] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 45.098794] ? pagevec_lru_move_fn+0x490/0x4e0 [ 45.103361] ? pgtable_trans_huge_deposit+0x439/0x5d0 [ 45.108533] ? compat_rawv6_ioctl+0x100/0x100 [ 45.113012] inet_sendmsg+0x48d/0x740 [ 45.116802] ? security_socket_sendmsg+0x91/0x1f0 [ 45.121623] ? inet_getname+0x4a0/0x4a0 [ 45.125578] __sys_sendto+0x6c0/0x7e0 [ 45.129361] ? prepare_exit_to_usermode+0x4a/0x3a0 [ 45.134269] ? syscall_return_slowpath+0xe9/0x700 [ 45.139112] __x64_sys_sendto+0x1a1/0x210 [ 45.143247] do_syscall_64+0x154/0x220 [ 45.147121] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 45.152305] RIP: 0033:0x43fe79 [ 45.155483] RSP: 002b:00007ffc475970d8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 45.163173] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fe79 [ 45.170427] RDX: 0000000000000000 RSI: 0000000020001ffe RDI: 0000000000000003 [ 45.177675] RBP: 00000000006ca018 R08: 0000000020003000 R09: 000000000000001c [ 45.184928] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004017a0 [ 45.192178] R13: 0000000000401830 R14: 0000000000000000 R15: 0000000000000000 [ 45.199890] Dumping ftrace buffer: [ 45.203420] (ftrace buffer empty) [ 45.207112] Kernel Offset: disabled [ 45.210716] Rebooting in 86400 seconds..