./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1063794875 <...> syzkaller login: [ 95.133549][ T27] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.113' (ECDSA) to the list of known hosts. execve("./syz-executor1063794875", ["./syz-executor1063794875"], 0x7ffcb2c608c0 /* 10 vars */) = 0 brk(NULL) = 0x55555739a000 brk(0x55555739ac40) = 0x55555739ac40 arch_prctl(ARCH_SET_FS, 0x55555739a300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1063794875", 4096) = 28 brk(0x5555573bbc40) = 0x5555573bbc40 brk(0x5555573bc000) = 0x5555573bc000 mprotect(0x7fb4e4245000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555739a5d0) = 3475 ./strace-static-x86_64: Process 3475 attached [pid 3475] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3475] setpgid(0, 0) = 0 [pid 3475] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3475] write(3, "1000", 4) = 4 [pid 3475] close(3) = 0 [pid 3475] socket(AF_INET6, SOCK_STREAM, IPPROTO_SCTP) = 3 [pid 3475] setsockopt(3, SOL_SCTP, SCTP_PEER_ADDR_PARAMS, "\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 156) = 0 [pid 3475] bind(3, {sa_family=AF_INET6, sin6_port=htons(20003), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0 [pid 3475] sendto(3, "\x58\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 212992, 0, {sa_family=AF_INET6, sin6_port=htons(20003), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 212992 [pid 3475] write(-1, "\x7f\x45\x4c\x46\xff\x06\x00\xf9\x01\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00\x1f\x00\x00\x00\x06\x02\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\xeb\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x38\x00\x02\x00\xef\x8a\x01\x80\x04\x00\x01\x00\x00\x00\x0d\x04\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x04\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xd9\x06\x00\x00"..., 1659) = -1 EBADF (Bad file descriptor) [pid 3475] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 3475] socket(AF_PACKET, SOCK_RAW, htons(0 /* ETH_P_??? */)) = 5 [pid 3475] bind(5, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("lo"), sll_hatype=ARPHRD_NETROM, sll_pkttype=0x8 /* PACKET_??? */, sll_halen=0}, 128) = 0 [pid 3475] getsockname(5, {sa_family=AF_PACKET, sa_data="\x00\x00\x01\x00\x00\x00\x04\x03\x00\x06\x00\x00\x00\x00\x00\x00"}, [20 => 18]) = 0 [pid 3475] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x40\x01\x00\x00\x24\x00\x0b\x0f\x00\x00\x00\x00\x00\x00\xf1\xe0\x41\x68\x18\x46\x01\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x0a\x00\x01\x00\x6e\x65\x74\x65\x6d\x00\x00\x00\x10\x01\x02\x00\xca\x00\x00\x00\xb0\x0e\x00\x00\x00\x00\x00\x00\x7f\x45\x4c\x46\xff\x06\x00\xf9\x01\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00\x1f\x00\x00\x00\x06\x02\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00"..., iov_len=320}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 320 [pid 3475] exit_group(0) = ? [ 98.310307][ T3475] netlink: 244 bytes leftover after parsing attributes in process `syz-executor106'. [pid 3475] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3475, si_uid=0, si_status=0, si_utime=0, si_stime=10} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555739a5d0) = 3476 ./strace-static-x86_64: Process 3476 attached [pid 3476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3476] setpgid(0, 0) = 0 [pid 3476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3476] write(3, "1000", 4) = 4 [pid 3476] close(3) = 0 [pid 3476] socket(AF_INET6, SOCK_STREAM, IPPROTO_SCTP) = 3 [pid 3476] setsockopt(3, SOL_SCTP, SCTP_PEER_ADDR_PARAMS, "\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 156) = 0 [pid 3476] bind(3, {sa_family=AF_INET6, sin6_port=htons(20003), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0 [ 98.428373][ T3476] ===================================================== [ 98.435410][ T3476] BUG: KMSAN: uninit-value in sctp_inq_pop+0x15c8/0x18f0 [ 98.442469][ T3476] sctp_inq_pop+0x15c8/0x18f0 [ 98.447195][ T3476] sctp_assoc_bh_rcv+0x201/0xdd0 [ 98.452169][ T3476] sctp_inq_push+0x31c/0x440 [ 98.456784][ T3476] sctp_backlog_rcv+0x38e/0x10c0 [ 98.461745][ T3476] __release_sock+0x256/0x640 [ 98.466452][ T3476] release_sock+0x98/0x2e0 [ 98.470915][ T3476] sctp_wait_for_connect+0x52a/0x9e0 [ 98.476213][ T3476] sctp_sendmsg_to_asoc+0x1c32/0x1f50 [ 98.481622][ T3476] sctp_sendmsg+0x3eac/0x5460 [ 98.486311][ T3476] inet_sendmsg+0x15b/0x1d0 [ 98.490830][ T3476] __sys_sendto+0x9ef/0xc70 [ 98.495352][ T3476] __x64_sys_sendto+0x19c/0x210 [ 98.500247][ T3476] do_syscall_64+0x51/0xa0 [ 98.504702][ T3476] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 98.510615][ T3476] [ 98.512939][ T3476] Uninit was stored to memory at: [ 98.518013][ T3476] sctp_inq_pop+0x155c/0x18f0 [ 98.522712][ T3476] sctp_assoc_bh_rcv+0x201/0xdd0 [ 98.527684][ T3476] sctp_inq_push+0x31c/0x440 [ 98.532297][ T3476] sctp_backlog_rcv+0x38e/0x10c0 [ 98.537284][ T3476] __release_sock+0x256/0x640 [ 98.541981][ T3476] release_sock+0x98/0x2e0 [ 98.546444][ T3476] sctp_wait_for_connect+0x52a/0x9e0 [ 98.551765][ T3476] sctp_sendmsg_to_asoc+0x1c32/0x1f50 [ 98.557180][ T3476] sctp_sendmsg+0x3eac/0x5460 [ 98.561870][ T3476] inet_sendmsg+0x15b/0x1d0 [ 98.566412][ T3476] __sys_sendto+0x9ef/0xc70 [ 98.570936][ T3476] __x64_sys_sendto+0x19c/0x210 [ 98.575817][ T3476] do_syscall_64+0x51/0xa0 [ 98.580270][ T3476] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 98.586180][ T3476] [ 98.588493][ T3476] Uninit was created at: [ 98.592788][ T3476] __kmalloc_node_track_caller+0xde3/0x14f0 [ 98.598723][ T3476] __alloc_skb+0x545/0xf90 [ 98.603177][ T3476] sctp_packet_transmit+0x1956/0x45b0 [ 98.608585][ T3476] sctp_outq_flush+0x1a36/0x6030 [ 98.613567][ T3476] sctp_outq_uncork+0x105/0x120 [ 98.618446][ T3476] sctp_do_sm+0x946f/0x9b50 [ 98.622983][ T3476] sctp_assoc_bh_rcv+0xa13/0xdd0 [ 98.627961][ T3476] sctp_inq_push+0x31c/0x440 [ 98.632599][ T3476] sctp_backlog_rcv+0x38e/0x10c0 [ 98.637584][ T3476] __release_sock+0x256/0x640 [ 98.642276][ T3476] release_sock+0x98/0x2e0 [ 98.646736][ T3476] sctp_wait_for_connect+0x52a/0x9e0 [ 98.652043][ T3476] sctp_sendmsg_to_asoc+0x1c32/0x1f50 [ 98.657462][ T3476] sctp_sendmsg+0x3eac/0x5460 [ 98.662172][ T3476] inet_sendmsg+0x15b/0x1d0 [ 98.666691][ T3476] __sys_sendto+0x9ef/0xc70 [ 98.671220][ T3476] __x64_sys_sendto+0x19c/0x210 [ 98.676132][ T3476] do_syscall_64+0x51/0xa0 [ 98.680567][ T3476] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 98.686483][ T3476] [ 98.688814][ T3476] CPU: 0 PID: 3476 Comm: syz-executor106 Not tainted 5.18.0-rc4-syzkaller #0 [ 98.697605][ T3476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.707661][ T3476] ===================================================== [ 98.714585][ T3476] Disabling lock debugging due to kernel taint [ 98.720999][ T3476] Kernel panic - not syncing: kmsan.panic set ... [ 98.727421][ T3476] CPU: 0 PID: 3476 Comm: syz-executor106 Tainted: G B 5.18.0-rc4-syzkaller #0 [ 98.737585][ T3476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.747659][ T3476] Call Trace: [ 98.750946][ T3476] [ 98.753875][ T3476] dump_stack_lvl+0x1ff/0x28e [ 98.758608][ T3476] dump_stack+0x25/0x28 [ 98.762836][ T3476] panic+0x4fe/0xc73 [ 98.766783][ T3476] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 98.772992][ T3476] ? add_taint+0x181/0x210 [ 98.777443][ T3476] ? console_unlock+0x1c00/0x2130 [ 98.782520][ T3476] ? _raw_spin_unlock_irqrestore+0x78/0xb0 [ 98.788373][ T3476] kmsan_report+0x2e6/0x2f0 [ 98.792929][ T3476] ? kmsan_internal_chain_origin+0x103/0x120 [ 98.798972][ T3476] ? __msan_warning+0x94/0x110 [ 98.803786][ T3476] ? sctp_inq_pop+0x15c8/0x18f0 [ 98.808665][ T3476] ? sctp_assoc_bh_rcv+0x201/0xdd0 [ 98.813814][ T3476] ? sctp_inq_push+0x31c/0x440 [ 98.818605][ T3476] ? sctp_backlog_rcv+0x38e/0x10c0 [ 98.823762][ T3476] ? __release_sock+0x256/0x640 [ 98.828628][ T3476] ? release_sock+0x98/0x2e0 [ 98.833265][ T3476] ? sctp_wait_for_connect+0x52a/0x9e0 [ 98.838745][ T3476] ? sctp_sendmsg_to_asoc+0x1c32/0x1f50 [ 98.844319][ T3476] ? sctp_sendmsg+0x3eac/0x5460 [ 98.849209][ T3476] ? inet_sendmsg+0x15b/0x1d0 [ 98.853906][ T3476] ? __sys_sendto+0x9ef/0xc70 [ 98.858622][ T3476] ? __x64_sys_sendto+0x19c/0x210 [ 98.863671][ T3476] ? do_syscall_64+0x51/0xa0 [ 98.868299][ T3476] ? entry_SYSCALL_64_after_hwframe+0x44/0xae [ 98.874389][ T3476] ? entry_SYSCALL_64_after_hwframe+0x44/0xae [ 98.880504][ T3476] ? kmsan_get_metadata+0x33/0x220 [ 98.885652][ T3476] ? kmsan_internal_set_shadow_origin+0x62/0xe0 [ 98.891929][ T3476] ? kmsan_internal_unpoison_memory+0x10/0x20 [ 98.898054][ T3476] ? kmsan_get_metadata+0x33/0x220 [ 98.903197][ T3476] ? kmsan_get_shadow_origin_ptr+0x9b/0xf0 [ 98.909021][ T3476] ? skb_pull+0x26f/0x290 [ 98.913374][ T3476] ? kmsan_get_metadata+0x33/0x220 [ 98.918513][ T3476] ? kmsan_get_shadow_origin_ptr+0x9b/0xf0 [ 98.924375][ T3476] __msan_warning+0x94/0x110 [ 98.929018][ T3476] sctp_inq_pop+0x15c8/0x18f0 [ 98.933741][ T3476] sctp_assoc_bh_rcv+0x201/0xdd0 [ 98.938729][ T3476] ? kmsan_get_shadow_origin_ptr+0x9b/0xf0 [ 98.944551][ T3476] ? sctp_assoc_lookup_asconf_ack+0x2d0/0x2d0 [ 98.950642][ T3476] sctp_inq_push+0x31c/0x440 [ 98.955268][ T3476] sctp_backlog_rcv+0x38e/0x10c0 [ 98.960270][ T3476] ? sctp_add_backlog+0xb10/0xb10 [ 98.965322][ T3476] __release_sock+0x256/0x640 [ 98.970046][ T3476] release_sock+0x98/0x2e0 [ 98.974497][ T3476] sctp_wait_for_connect+0x52a/0x9e0 [ 98.979834][ T3476] ? wake_bit_function+0x510/0x510 [ 98.984972][ T3476] sctp_sendmsg_to_asoc+0x1c32/0x1f50 [ 98.990420][ T3476] sctp_sendmsg+0x3eac/0x5460 [ 98.995164][ T3476] ? kmsan_get_shadow_origin_ptr+0x9b/0xf0 [ 99.000996][ T3476] ? sctp_getsockopt+0x2170/0x2170 [ 99.006137][ T3476] inet_sendmsg+0x15b/0x1d0 [ 99.010688][ T3476] ? inet_send_prepare+0x6c0/0x6c0 [ 99.015821][ T3476] __sys_sendto+0x9ef/0xc70 [ 99.020395][ T3476] ? kmsan_get_metadata+0x33/0x220 [ 99.025544][ T3476] ? kmsan_get_shadow_origin_ptr+0x9b/0xf0 [ 99.031392][ T3476] __x64_sys_sendto+0x19c/0x210 [ 99.036295][ T3476] do_syscall_64+0x51/0xa0 [ 99.040735][ T3476] ? exc_page_fault+0x76/0x150 [ 99.045532][ T3476] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 99.051472][ T3476] RIP: 0033:0x7fb4e41d8009 [ 99.055892][ T3476] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 99.075516][ T3476] RSP: 002b:00007fffdd587c48 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 99.083946][ T3476] RAX: ffffffffffffffda RBX: 0100000000000000 RCX: 00007fb4e41d8009 [ 99.091931][ T3476] RDX: 0000000000034000 RSI: 0000000020847fff RDI: 0000000000000003 [ 99.099913][ T3476] RBP: 0000000000000000 R08: 000000002005ffe4 R09: 000000000000001c [ 99.107896][ T3476] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffdd587c6c [ 99.115892][ T3476] R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 [ 99.123884][ T3476] [ 99.127068][ T3476] Kernel Offset: disabled [ 99.131398][ T3476] Rebooting in 86400 seconds..