Warning: Permanently added '10.128.0.234' (ECDSA) to the list of known hosts. 2019/10/24 06:41:51 fuzzer started 2019/10/24 06:41:56 dialing manager at 10.128.0.26:44225 2019/10/24 06:41:56 syscalls: 2415 2019/10/24 06:41:56 code coverage: enabled 2019/10/24 06:41:56 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/10/24 06:41:56 extra coverage: enabled 2019/10/24 06:41:56 setuid sandbox: enabled 2019/10/24 06:41:56 namespace sandbox: enabled 2019/10/24 06:41:56 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/24 06:41:56 fault injection: enabled 2019/10/24 06:41:56 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/24 06:41:56 net packet injection: enabled 2019/10/24 06:41:56 net device setup: enabled 2019/10/24 06:41:56 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist syzkaller login: [ 119.310897][T11848] ===================================================== [ 119.317928][T11848] BUG: KMSAN: use-after-free in kmem_cache_free+0x3df/0x2b70 [ 119.325301][T11848] CPU: 0 PID: 11848 Comm: syz-fuzzer Not tainted 5.4.0-rc3+ #0 [ 119.332836][T11848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 119.342897][T11848] Call Trace: [ 119.346212][T11848] dump_stack+0x191/0x1f0 [ 119.350556][T11848] kmsan_report+0x128/0x220 [ 119.355081][T11848] __msan_warning+0x73/0xe0 [ 119.359597][T11848] kmem_cache_free+0x3df/0x2b70 [ 119.364427][T11848] ? kmsan_internal_set_origin+0x6a/0xb0 [ 119.370040][T11848] ? kfree_skb+0x473/0x4c0 [ 119.374449][T11848] ? kmsan_internal_unpoison_shadow+0x42/0x80 [ 119.380521][T11848] kfree_skb+0x473/0x4c0 [ 119.384744][T11848] ? packet_rcv_spkt+0x68d/0x7c0 [ 119.389660][T11848] packet_rcv_spkt+0x68d/0x7c0 [ 119.394412][T11848] ? packet_rcv+0x2110/0x2110 [ 119.399068][T11848] dev_queue_xmit_nit+0x1125/0x1200 [ 119.404273][T11848] dev_hard_start_xmit+0x21e/0xab0 [ 119.409373][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 119.415255][T11848] sch_direct_xmit+0x56c/0x18c0 [ 119.420101][T11848] __dev_queue_xmit+0x212d/0x4200 [ 119.425122][T11848] dev_queue_xmit+0x4b/0x60 [ 119.429607][T11848] ip_finish_output2+0x20d6/0x25d0 [ 119.434696][T11848] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 119.440763][T11848] ? nf_ct_deliver_cached_events+0x4d5/0x6e0 [ 119.446741][T11848] __ip_finish_output+0xaf8/0xda0 [ 119.451762][T11848] ip_finish_output+0x2db/0x420 [ 119.456635][T11848] ip_output+0x541/0x610 [ 119.460862][T11848] ? ip_mc_finish_output+0x6d0/0x6d0 [ 119.466163][T11848] ? ip_finish_output+0x420/0x420 [ 119.471165][T11848] __ip_queue_xmit+0x1caf/0x21f0 [ 119.476084][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 119.481955][T11848] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 119.488001][T11848] ? should_fail+0x1d2/0xa50 [ 119.492578][T11848] ip_queue_xmit+0xcc/0xf0 [ 119.497012][T11848] ? tcp_v4_inbound_md5_hash+0xd10/0xd10 [ 119.502667][T11848] __tcp_transmit_skb+0x40e3/0x5d90 [ 119.507864][T11848] __tcp_send_ack+0x701/0x840 [ 119.512522][T11848] tcp_send_ack+0x68/0x90 [ 119.516830][T11848] tcp_cleanup_rbuf+0x764/0x800 [ 119.522097][T11848] tcp_recvmsg+0x334d/0x4ff0 [ 119.526694][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 119.532566][T11848] ? tcp_mmap+0x150/0x150 [ 119.536870][T11848] ? tcp_mmap+0x150/0x150 [ 119.541174][T11848] inet_recvmsg+0x237/0x7d0 [ 119.545658][T11848] ? inet_sendpage+0x2c0/0x2c0 [ 119.550403][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 119.556274][T11848] ? inet_sendpage+0x2c0/0x2c0 [ 119.561016][T11848] ? inet_sendpage+0x2c0/0x2c0 [ 119.565758][T11848] sock_read_iter+0x5be/0x660 [ 119.570430][T11848] ? kernel_sock_ip_overhead+0x340/0x340 [ 119.576037][T11848] __vfs_read+0xa67/0xc90 [ 119.580365][T11848] vfs_read+0x359/0x6f0 [ 119.584505][T11848] ksys_read+0x265/0x430 [ 119.588738][T11848] __se_sys_read+0x92/0xb0 [ 119.593134][T11848] __x64_sys_read+0x4a/0x70 [ 119.597630][T11848] do_syscall_64+0xb6/0x160 [ 119.602115][T11848] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 119.608299][T11848] RIP: 0033:0x47fd44 [ 119.612173][T11848] Code: ff ff cc cc cc cc e8 9b 40 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 45 31 d2 45 31 c0 45 31 c9 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 119.631758][T11848] RSP: 002b:000000c4204c77a0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 119.640146][T11848] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fd44 [ 119.648094][T11848] RDX: 0000000000001000 RSI: 000000c4203e6000 RDI: 0000000000000003 [ 119.656040][T11848] RBP: 000000c4204c77f0 R08: 0000000000000000 R09: 0000000000000000 [ 119.664004][T11848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 119.671966][T11848] R13: 0000000000000008 R14: 0000000000000002 R15: ffffffffffffffff [ 119.679973][T11848] [ 119.682301][T11848] Uninit was stored to memory at: [ 119.687363][T11848] kmsan_internal_chain_origin+0xbd/0x180 [ 119.693062][T11848] __msan_chain_origin+0x6b/0xd0 [ 119.697987][T11848] ___slab_alloc+0x1dbc/0x1fb0 [ 119.702736][T11848] kmem_cache_alloc+0xade/0xd10 [ 119.707566][T11848] skb_clone+0x326/0x5d0 [ 119.712045][T11848] dev_queue_xmit_nit+0x539/0x1200 [ 119.717136][T11848] dev_hard_start_xmit+0x21e/0xab0 [ 119.722237][T11848] sch_direct_xmit+0x56c/0x18c0 [ 119.727088][T11848] __dev_queue_xmit+0x212d/0x4200 [ 119.732093][T11848] dev_queue_xmit+0x4b/0x60 [ 119.736578][T11848] ip_finish_output2+0x20d6/0x25d0 [ 119.741678][T11848] __ip_finish_output+0xaf8/0xda0 [ 119.746678][T11848] ip_finish_output+0x2db/0x420 [ 119.751504][T11848] ip_output+0x541/0x610 [ 119.755722][T11848] __ip_queue_xmit+0x1caf/0x21f0 [ 119.760679][T11848] ip_queue_xmit+0xcc/0xf0 [ 119.765353][T11848] __tcp_transmit_skb+0x40e3/0x5d90 [ 119.770705][T11848] __tcp_send_ack+0x701/0x840 [ 119.775374][T11848] tcp_send_ack+0x68/0x90 [ 119.779700][T11848] tcp_cleanup_rbuf+0x764/0x800 [ 119.784535][T11848] tcp_recvmsg+0x334d/0x4ff0 [ 119.789115][T11848] inet_recvmsg+0x237/0x7d0 [ 119.793595][T11848] sock_read_iter+0x5be/0x660 [ 119.798246][T11848] __vfs_read+0xa67/0xc90 [ 119.802549][T11848] vfs_read+0x359/0x6f0 [ 119.806680][T11848] ksys_read+0x265/0x430 [ 119.810908][T11848] __se_sys_read+0x92/0xb0 [ 119.815311][T11848] __x64_sys_read+0x4a/0x70 [ 119.819790][T11848] do_syscall_64+0xb6/0x160 [ 119.824275][T11848] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 119.830164][T11848] [ 119.832467][T11848] Uninit was created at: [ 119.836684][T11848] kmsan_internal_poison_shadow+0x60/0x120 [ 119.842465][T11848] kmsan_slab_free+0x8d/0xf0 [ 119.847029][T11848] kmem_cache_free_bulk+0x3ad9/0x3f10 [ 119.852374][T11848] __kfree_skb_flush+0xb0/0x100 [ 119.857212][T11848] net_rx_action+0x1a5e/0x1aa0 [ 119.861953][T11848] __do_softirq+0x4a1/0x83a [ 119.866447][T11848] irq_exit+0x230/0x280 [ 119.870579][T11848] do_IRQ+0x123/0x360 [ 119.874535][T11848] ret_from_intr+0x0/0x33 [ 119.878842][T11848] rw_verify_area+0x84/0x5e0 [ 119.883405][T11848] vfs_read+0x226/0x6f0 [ 119.887537][T11848] ksys_read+0x265/0x430 [ 119.891752][T11848] __se_sys_read+0x92/0xb0 [ 119.896142][T11848] __x64_sys_read+0x4a/0x70 [ 119.900633][T11848] do_syscall_64+0xb6/0x160 [ 119.905115][T11848] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 119.910975][T11848] ===================================================== [ 119.917878][T11848] Disabling lock debugging due to kernel taint [ 119.924002][T11848] Kernel panic - not syncing: panic_on_warn set ... [ 119.930568][T11848] CPU: 0 PID: 11848 Comm: syz-fuzzer Tainted: G B 5.4.0-rc3+ #0 [ 119.939468][T11848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 119.949497][T11848] Call Trace: [ 119.952766][T11848] dump_stack+0x191/0x1f0 [ 119.957082][T11848] panic+0x3c9/0xc1e [ 119.960984][T11848] kmsan_report+0x215/0x220 [ 119.965468][T11848] __msan_warning+0x73/0xe0 [ 119.969965][T11848] kmem_cache_free+0x3df/0x2b70 [ 119.974808][T11848] ? kmsan_internal_set_origin+0x6a/0xb0 [ 119.980419][T11848] ? kfree_skb+0x473/0x4c0 [ 119.984814][T11848] ? kmsan_internal_unpoison_shadow+0x42/0x80 [ 119.990879][T11848] kfree_skb+0x473/0x4c0 [ 119.995102][T11848] ? packet_rcv_spkt+0x68d/0x7c0 [ 120.000031][T11848] packet_rcv_spkt+0x68d/0x7c0 [ 120.004789][T11848] ? packet_rcv+0x2110/0x2110 [ 120.009572][T11848] dev_queue_xmit_nit+0x1125/0x1200 [ 120.014766][T11848] dev_hard_start_xmit+0x21e/0xab0 [ 120.019871][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 120.025753][T11848] sch_direct_xmit+0x56c/0x18c0 [ 120.030609][T11848] __dev_queue_xmit+0x212d/0x4200 [ 120.035649][T11848] dev_queue_xmit+0x4b/0x60 [ 120.040148][T11848] ip_finish_output2+0x20d6/0x25d0 [ 120.045239][T11848] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 120.051285][T11848] ? nf_ct_deliver_cached_events+0x4d5/0x6e0 [ 120.057255][T11848] __ip_finish_output+0xaf8/0xda0 [ 120.062266][T11848] ip_finish_output+0x2db/0x420 [ 120.067102][T11848] ip_output+0x541/0x610 [ 120.071356][T11848] ? ip_mc_finish_output+0x6d0/0x6d0 [ 120.076618][T11848] ? ip_finish_output+0x420/0x420 [ 120.081619][T11848] __ip_queue_xmit+0x1caf/0x21f0 [ 120.086552][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 120.092427][T11848] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 120.098473][T11848] ? should_fail+0x1d2/0xa50 [ 120.103664][T11848] ip_queue_xmit+0xcc/0xf0 [ 120.108078][T11848] ? tcp_v4_inbound_md5_hash+0xd10/0xd10 [ 120.113706][T11848] __tcp_transmit_skb+0x40e3/0x5d90 [ 120.118907][T11848] __tcp_send_ack+0x701/0x840 [ 120.123587][T11848] tcp_send_ack+0x68/0x90 [ 120.127988][T11848] tcp_cleanup_rbuf+0x764/0x800 [ 120.132835][T11848] tcp_recvmsg+0x334d/0x4ff0 [ 120.137459][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 120.143340][T11848] ? tcp_mmap+0x150/0x150 [ 120.147649][T11848] ? tcp_mmap+0x150/0x150 [ 120.151966][T11848] inet_recvmsg+0x237/0x7d0 [ 120.156453][T11848] ? inet_sendpage+0x2c0/0x2c0 [ 120.161574][T11848] ? kmsan_get_shadow_origin_ptr+0x91/0x4b0 [ 120.167446][T11848] ? inet_sendpage+0x2c0/0x2c0 [ 120.172198][T11848] ? inet_sendpage+0x2c0/0x2c0 [ 120.176941][T11848] sock_read_iter+0x5be/0x660 [ 120.181617][T11848] ? kernel_sock_ip_overhead+0x340/0x340 [ 120.187224][T11848] __vfs_read+0xa67/0xc90 [ 120.191543][T11848] vfs_read+0x359/0x6f0 [ 120.195682][T11848] ksys_read+0x265/0x430 [ 120.199906][T11848] __se_sys_read+0x92/0xb0 [ 120.204328][T11848] __x64_sys_read+0x4a/0x70 [ 120.208819][T11848] do_syscall_64+0xb6/0x160 [ 120.213302][T11848] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 120.219192][T11848] RIP: 0033:0x47fd44 [ 120.223067][T11848] Code: ff ff cc cc cc cc e8 9b 40 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 45 31 d2 45 31 c0 45 31 c9 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 120.242656][T11848] RSP: 002b:000000c4204c77a0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 120.251065][T11848] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fd44 [ 120.259031][T11848] RDX: 0000000000001000 RSI: 000000c4203e6000 RDI: 0000000000000003 [ 120.267004][T11848] RBP: 000000c4204c77f0 R08: 0000000000000000 R09: 0000000000000000 [ 120.274971][T11848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 120.282934][T11848] R13: 0000000000000008 R14: 0000000000000002 R15: ffffffffffffffff [ 120.292371][T11848] Kernel Offset: disabled [ 120.296697][T11848] Rebooting in 86400 seconds..