[ 61.460847][ T30] audit: type=1800 audit(1559715557.509:26): pid=10441 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0
[ 61.494614][ T30] audit: type=1800 audit(1559715557.539:27): pid=10441 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[ 61.608674][ T30] audit: type=1800 audit(1559715557.659:28): pid=10441 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[ 62.964513][ T30] audit: type=1800 audit(1559715559.019:29): pid=10441 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.1.5' (ECDSA) to the list of known hosts.
2019/06/05 06:24:32 parsed 1 programs
2019/06/05 06:24:39 executed programs: 0
syzkaller login: [ 383.157867][T10607] IPVS: ftp: loaded support on port[0] = 21
[ 383.225149][T10607] chnl_net:caif_netlink_parms(): no params data found
[ 383.260527][T10607] bridge0: port 1(bridge_slave_0) entered blocking state
[ 383.269220][T10607] bridge0: port 1(bridge_slave_0) entered disabled state
[ 383.277487][T10607] device bridge_slave_0 entered promiscuous mode
[ 383.285517][T10607] bridge0: port 2(bridge_slave_1) entered blocking state
[ 383.293072][T10607] bridge0: port 2(bridge_slave_1) entered disabled state
[ 383.300973][T10607] device bridge_slave_1 entered promiscuous mode
[ 383.319218][T10607] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 383.329312][T10607] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 383.348793][T10607] team0: Port device team_slave_0 added
[ 383.356179][T10607] team0: Port device team_slave_1 added
[ 383.414709][T10607] device hsr_slave_0 entered promiscuous mode
[ 383.462444][T10607] device hsr_slave_1 entered promiscuous mode
[ 383.510351][T10607] bridge0: port 2(bridge_slave_1) entered blocking state
[ 383.517568][T10607] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 383.525150][T10607] bridge0: port 1(bridge_slave_0) entered blocking state
[ 383.532393][T10607] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 383.570019][T10607] 8021q: adding VLAN 0 to HW filter on device bond0
[ 383.582489][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 383.591739][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 383.600620][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 383.609430][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 383.622661][T10607] 8021q: adding VLAN 0 to HW filter on device team0
[ 383.634537][ T4942] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 383.643227][ T4942] bridge0: port 1(bridge_slave_0) entered blocking state
[ 383.650319][ T4942] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 383.673226][ T4942] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 383.681777][ T4942] bridge0: port 2(bridge_slave_1) entered blocking state
[ 383.689041][ T4942] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 383.700134][ T4942] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 383.709273][ T4942] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 383.718446][ T4942] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 383.734294][T10607] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 383.745120][T10607] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 383.758134][T10610] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 383.767094][T10610] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 383.776412][T10610] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 383.793849][T10607] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 383.853659][ C1] ==================================================================
[ 383.861930][ C1] BUG: KMSAN: uninit-value in gre_parse_header+0x1395/0x1690
[ 383.869313][ C1] CPU: 1 PID: 10615 Comm: syz-executor.0 Not tainted 5.1.0+ #1
[ 383.876855][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 383.886895][ C1] Call Trace:
[ 383.890169][ C1]
[ 383.893103][ C1] dump_stack+0x191/0x1f0
[ 383.897481][ C1] kmsan_report+0x130/0x2a0
[ 383.901972][ C1] __msan_warning+0x75/0xe0
[ 383.906464][ C1] gre_parse_header+0x1395/0x1690
[ 383.911516][ C1] gre_rcv+0x1ee/0x18b0
[ 383.915672][ C1] ? __msan_metadata_ptr_for_load_8+0x10/0x20
[ 383.921777][ C1] ? raw_local_deliver+0xdd/0x1940
[ 383.926929][ C1] ? nf_confirm+0x5c0/0x720
[ 383.931473][ C1] ? erspan_xmit+0x35a0/0x35a0
[ 383.936223][ C1] ? erspan_xmit+0x35a0/0x35a0
[ 383.940969][ C1] gre_rcv+0x2dd/0x3c0
[ 383.945036][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 383.950914][ C1] ? gre_parse_header+0x1690/0x1690
[ 383.956147][ C1] ip_protocol_deliver_rcu+0x504/0xad0
[ 383.961609][ C1] ip_local_deliver+0x628/0x7b0
[ 383.966463][ C1] ? ip_local_deliver+0x7b0/0x7b0
[ 383.971478][ C1] ? ip_protocol_deliver_rcu+0xad0/0xad0
[ 383.977090][ C1] ip_rcv+0x6c5/0x740
[ 383.981057][ C1] ? ip_rcv_core+0x11d0/0x11d0
[ 383.985868][ C1] process_backlog+0x6da/0x1070
[ 383.990708][ C1] ? ip_local_deliver_finish+0x320/0x320
[ 383.996340][ C1] ? rps_trigger_softirq+0x2e0/0x2e0
[ 384.001604][ C1] net_rx_action+0x738/0x1940
[ 384.006272][ C1] ? net_tx_action+0xb70/0xb70
[ 384.011075][ C1] __do_softirq+0x4ad/0x858
[ 384.015573][ C1] do_softirq_own_stack+0x49/0x80
[ 384.020573][ C1]
[ 384.023560][ C1] __local_bh_enable_ip+0x199/0x1e0
[ 384.028753][ C1] local_bh_enable+0x36/0x40
[ 384.033332][ C1] ip_finish_output2+0x1721/0x1930
[ 384.038436][ C1] ip_finish_output+0xd2a/0xfd0
[ 384.043276][ C1] ip_output+0x541/0x610
[ 384.047524][ C1] ? ip_mc_finish_output+0x3b0/0x3b0
[ 384.052793][ C1] ? ip_finish_output+0xfd0/0xfd0
[ 384.057799][ C1] raw_sendmsg+0x41dc/0x4670
[ 384.062391][ C1] ? __msan_metadata_ptr_for_load_8+0x10/0x20
[ 384.068504][ C1] ? aa_sk_perm+0x730/0xaf0
[ 384.073024][ C1] ? raw_getfrag+0x640/0x640
[ 384.077607][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.083486][ C1] ? compat_raw_ioctl+0x100/0x100
[ 384.088507][ C1] inet_sendmsg+0x546/0x720
[ 384.093019][ C1] ? inet_getname+0x490/0x490
[ 384.097692][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.103571][ C1] ? inet_getname+0x490/0x490
[ 384.108286][ C1] __sys_sendto+0x8cf/0xad0
[ 384.112785][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.118666][ C1] ? __msan_metadata_ptr_for_store_4+0x13/0x20
[ 384.124844][ C1] ? prepare_exit_to_usermode+0x114/0x420
[ 384.130554][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.136431][ C1] __se_sys_sendto+0x107/0x130
[ 384.141183][ C1] __x64_sys_sendto+0x6e/0x90
[ 384.145848][ C1] do_syscall_64+0xbc/0xf0
[ 384.150262][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xe7
[ 384.156222][ C1] RIP: 0033:0x459279
[ 384.160096][ C1] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 384.179696][ C1] RSP: 002b:00007ffeb5502558 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 384.188101][ C1] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459279
[ 384.196053][ C1] RDX: 00000000000005aa RSI: 00000000200000c0 RDI: 0000000000000003
[ 384.204019][ C1] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000120
[ 384.211984][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000188e914
[ 384.219941][ C1] R13: 00000000004c6dc9 R14: 00000000004dbcc8 R15: 00000000ffffffff
[ 384.227906][ C1]
[ 384.230213][ C1] Uninit was stored to memory at:
[ 384.235224][ C1] kmsan_internal_chain_origin+0x133/0x230
[ 384.241018][ C1] kmsan_memcpy_memmove_metadata+0x969/0xd40
[ 384.246987][ C1] kmsan_memcpy_metadata+0xb/0x10
[ 384.251999][ C1] __msan_memcpy+0x56/0x70
[ 384.256432][ C1] pskb_expand_head+0x3aa/0x1a30
[ 384.261351][ C1] ip_tunnel_xmit+0x2bd5/0x3290
[ 384.266184][ C1] erspan_xmit+0x1efe/0x35a0
[ 384.271949][ C1] dev_hard_start_xmit+0x594/0xb20
[ 384.278685][ C1] sch_direct_xmit+0x571/0x870
[ 384.283443][ C1] __qdisc_run+0x158b/0x3380
[ 384.288011][ C1] __dev_queue_xmit+0x21a0/0x3b60
[ 384.293014][ C1] dev_queue_xmit+0x4b/0x60
[ 384.297493][ C1] neigh_resolve_output+0xab7/0xb50
[ 384.302677][ C1] ip_finish_output2+0x1709/0x1930
[ 384.307766][ C1] ip_finish_output+0xd2a/0xfd0
[ 384.312590][ C1] ip_output+0x541/0x610
[ 384.316810][ C1] raw_sendmsg+0x41dc/0x4670
[ 384.321385][ C1] inet_sendmsg+0x546/0x720
[ 384.325868][ C1] __sys_sendto+0x8cf/0xad0
[ 384.330368][ C1] __se_sys_sendto+0x107/0x130
[ 384.335123][ C1] __x64_sys_sendto+0x6e/0x90
[ 384.339787][ C1] do_syscall_64+0xbc/0xf0
[ 384.344182][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xe7
[ 384.350232][ C1]
[ 384.352535][ C1] Uninit was created at:
[ 384.356758][ C1] kmsan_internal_poison_shadow+0x92/0x150
[ 384.362541][ C1] kmsan_kmalloc+0xa4/0x130
[ 384.367019][ C1] kmsan_slab_alloc+0xe/0x10
[ 384.371584][ C1] __kmalloc_node_track_caller+0xcba/0xf30
[ 384.377397][ C1] __alloc_skb+0x306/0xa10
[ 384.381797][ C1] alloc_skb_with_frags+0x18c/0xa80
[ 384.386973][ C1] sock_alloc_send_pskb+0xafd/0x10a0
[ 384.392237][ C1] sock_alloc_send_skb+0xca/0xe0
[ 384.397151][ C1] raw_sendmsg+0x238f/0x4670
[ 384.401729][ C1] inet_sendmsg+0x546/0x720
[ 384.406207][ C1] __sys_sendto+0x8cf/0xad0
[ 384.410686][ C1] __se_sys_sendto+0x107/0x130
[ 384.415429][ C1] __x64_sys_sendto+0x6e/0x90
[ 384.420090][ C1] do_syscall_64+0xbc/0xf0
[ 384.424502][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xe7
[ 384.430378][ C1] ==================================================================
[ 384.438414][ C1] Disabling lock debugging due to kernel taint
[ 384.444541][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 384.451107][ C1] CPU: 1 PID: 10615 Comm: syz-executor.0 Tainted: G B 5.1.0+ #1
[ 384.460013][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 384.470047][ C1] Call Trace:
[ 384.473324][ C1]
[ 384.476164][ C1] dump_stack+0x191/0x1f0
[ 384.480490][ C1] panic+0x3ca/0xafe
[ 384.484389][ C1] kmsan_report+0x298/0x2a0
[ 384.488875][ C1] __msan_warning+0x75/0xe0
[ 384.493366][ C1] gre_parse_header+0x1395/0x1690
[ 384.498400][ C1] gre_rcv+0x1ee/0x18b0
[ 384.502566][ C1] ? __msan_metadata_ptr_for_load_8+0x10/0x20
[ 384.508612][ C1] ? raw_local_deliver+0xdd/0x1940
[ 384.513714][ C1] ? nf_confirm+0x5c0/0x720
[ 384.518205][ C1] ? erspan_xmit+0x35a0/0x35a0
[ 384.522974][ C1] ? erspan_xmit+0x35a0/0x35a0
[ 384.527728][ C1] gre_rcv+0x2dd/0x3c0
[ 384.531779][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.537657][ C1] ? gre_parse_header+0x1690/0x1690
[ 384.542838][ C1] ip_protocol_deliver_rcu+0x504/0xad0
[ 384.548280][ C1] ip_local_deliver+0x628/0x7b0
[ 384.553125][ C1] ? ip_local_deliver+0x7b0/0x7b0
[ 384.558131][ C1] ? ip_protocol_deliver_rcu+0xad0/0xad0
[ 384.563741][ C1] ip_rcv+0x6c5/0x740
[ 384.567707][ C1] ? ip_rcv_core+0x11d0/0x11d0
[ 384.572472][ C1] process_backlog+0x6da/0x1070
[ 384.577311][ C1] ? ip_local_deliver_finish+0x320/0x320
[ 384.582928][ C1] ? rps_trigger_softirq+0x2e0/0x2e0
[ 384.588198][ C1] net_rx_action+0x738/0x1940
[ 384.592869][ C1] ? net_tx_action+0xb70/0xb70
[ 384.597614][ C1] __do_softirq+0x4ad/0x858
[ 384.602105][ C1] do_softirq_own_stack+0x49/0x80
[ 384.607104][ C1]
[ 384.610026][ C1] __local_bh_enable_ip+0x199/0x1e0
[ 384.615206][ C1] local_bh_enable+0x36/0x40
[ 384.619777][ C1] ip_finish_output2+0x1721/0x1930
[ 384.624896][ C1] ip_finish_output+0xd2a/0xfd0
[ 384.629746][ C1] ip_output+0x541/0x610
[ 384.633977][ C1] ? ip_mc_finish_output+0x3b0/0x3b0
[ 384.639240][ C1] ? ip_finish_output+0xfd0/0xfd0
[ 384.644243][ C1] raw_sendmsg+0x41dc/0x4670
[ 384.648839][ C1] ? __msan_metadata_ptr_for_load_8+0x10/0x20
[ 384.654882][ C1] ? aa_sk_perm+0x730/0xaf0
[ 384.659369][ C1] ? raw_getfrag+0x640/0x640
[ 384.663939][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.669813][ C1] ? compat_raw_ioctl+0x100/0x100
[ 384.674814][ C1] inet_sendmsg+0x546/0x720
[ 384.679295][ C1] ? inet_getname+0x490/0x490
[ 384.683961][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.689848][ C1] ? inet_getname+0x490/0x490
[ 384.694515][ C1] __sys_sendto+0x8cf/0xad0
[ 384.699011][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.704907][ C1] ? __msan_metadata_ptr_for_store_4+0x13/0x20
[ 384.711037][ C1] ? prepare_exit_to_usermode+0x114/0x420
[ 384.716746][ C1] ? kmsan_get_shadow_origin_ptr+0x71/0x470
[ 384.722632][ C1] __se_sys_sendto+0x107/0x130
[ 384.727386][ C1] __x64_sys_sendto+0x6e/0x90
[ 384.732043][ C1] do_syscall_64+0xbc/0xf0
[ 384.736442][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xe7
[ 384.742315][ C1] RIP: 0033:0x459279
[ 384.746188][ C1] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 384.765773][ C1] RSP: 002b:00007ffeb5502558 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 384.774177][ C1] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459279
[ 384.782137][ C1] RDX: 00000000000005aa RSI: 00000000200000c0 RDI: 0000000000000003
[ 384.790088][ C1] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000120
[ 384.798040][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000188e914
[ 384.806178][ C1] R13: 00000000004c6dc9 R14: 00000000004dbcc8 R15: 00000000ffffffff
[ 384.815346][ C1] Kernel Offset: disabled
[ 384.819672][ C1] Rebooting in 86400 seconds..