[ OK ] Started OpenBSD Secure Shell server. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.44' (ECDSA) to the list of known hosts. syzkaller login: [ 143.157335][ T8456] IPVS: ftp: loaded support on port[0] = 21 [ 143.321644][ T8456] chnl_net:caif_netlink_parms(): no params data found [ 143.494148][ T8456] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.501310][ T8456] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.510699][ T8456] device bridge_slave_0 entered promiscuous mode [ 143.522131][ T8456] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.529609][ T8456] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.539020][ T8456] device bridge_slave_1 entered promiscuous mode [ 143.580332][ T8456] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 143.593406][ T8456] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 143.631666][ T8456] team0: Port device team_slave_0 added [ 143.641453][ T8456] team0: Port device team_slave_1 added [ 143.680200][ T8456] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 143.687603][ T8456] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.713685][ T8456] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 143.727188][ T8456] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 143.734354][ T8456] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.760448][ T8456] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 143.839502][ T8456] device hsr_slave_0 entered promiscuous mode [ 143.893778][ T8456] device hsr_slave_1 entered promiscuous mode [ 144.127727][ T8456] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 144.169995][ T8456] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 144.227872][ T8456] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 144.287749][ T8456] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 144.435372][ T8456] 8021q: adding VLAN 0 to HW filter on device bond0 [ 144.459146][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 144.467877][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 144.484208][ T8456] 8021q: adding VLAN 0 to HW filter on device team0 [ 144.501282][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 144.511733][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 144.521802][ T3811] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.529113][ T3811] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.546117][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 144.554860][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 144.565731][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 144.577113][ T3811] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.584468][ T3811] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.604056][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 144.622381][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 144.655882][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 144.667159][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 144.677401][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 144.688541][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 144.700688][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 144.721816][ T8456] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 144.732266][ T8456] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 144.748031][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 144.757819][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 144.768171][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 144.777977][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 144.807431][ T3811] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 144.836065][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 144.844189][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 144.867226][ T8456] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 144.904469][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 144.915115][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 144.952033][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 144.961141][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 144.980798][ T8456] device veth0_vlan entered promiscuous mode [ 145.003911][ T8456] device veth1_vlan entered promiscuous mode [ 145.012196][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 145.022009][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 145.031165][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 145.077337][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 145.088044][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 145.098030][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 145.117464][ T8456] device veth0_macvtap entered promiscuous mode [ 145.134689][ T8456] device veth1_macvtap entered promiscuous mode [ 145.174894][ T8456] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 145.182530][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 145.192094][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 145.201733][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 145.211868][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 145.236042][ T8456] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 145.264810][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 145.275401][ T3086] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program [ 145.491345][ T8675] ===================================================== [ 145.498310][ T8675] BUG: KMSAN: uninit-value in nf_conntrack_invert_icmp_tuple+0xaa/0x2c0 [ 145.506670][ T8675] CPU: 0 PID: 8675 Comm: syz-executor064 Not tainted 5.8.0-rc5-syzkaller #0 [ 145.515325][ T8675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 145.525375][ T8675] Call Trace: [ 145.528673][ T8675] dump_stack+0x1df/0x240 [ 145.533001][ T8675] kmsan_report+0xf7/0x1e0 [ 145.537407][ T8675] __msan_warning+0x58/0xa0 [ 145.541913][ T8675] nf_conntrack_invert_icmp_tuple+0xaa/0x2c0 [ 145.547887][ T8675] nf_ct_invert_tuple+0x346/0x590 [ 145.553028][ T8675] init_conntrack+0x116/0x1ff0 [ 145.557821][ T8675] nf_conntrack_in+0x1341/0x26b1 [ 145.562805][ T8675] ipv6_conntrack_local+0x68/0x80 [ 145.567848][ T8675] ? ipv6_conntrack_in+0x80/0x80 [ 145.572796][ T8675] nf_hook_slow+0x16e/0x400 [ 145.577344][ T8675] __ip6_local_out+0x56d/0x750 [ 145.582135][ T8675] ? __ip6_local_out+0x750/0x750 [ 145.587061][ T8675] ip6_local_out+0xa4/0x1d0 [ 145.591661][ T8675] ip6_push_pending_frames+0x213/0x4f0 [ 145.597116][ T8675] rawv6_sendmsg+0x4233/0x5c30 [ 145.601877][ T8675] ? is_module_text_address+0x4d/0x2a0 [ 145.607344][ T8675] ? __kernel_text_address+0x171/0x2d0 [ 145.612831][ T8675] ? kmsan_get_metadata+0x11d/0x180 [ 145.618021][ T8675] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 145.623829][ T8675] ? udp_cmsg_send+0x5d0/0x5d0 [ 145.628579][ T8675] ? compat_rawv6_ioctl+0x100/0x100 [ 145.633777][ T8675] inet_sendmsg+0x2d8/0x2e0 [ 145.638294][ T8675] ? inet_send_prepare+0x600/0x600 [ 145.643416][ T8675] kernel_sendmsg+0x384/0x440 [ 145.648090][ T8675] sock_no_sendpage+0x235/0x300 [ 145.652942][ T8675] ? sock_no_mmap+0x30/0x30 [ 145.657446][ T8675] sock_sendpage+0x1e1/0x2c0 [ 145.662036][ T8675] pipe_to_sendpage+0x38c/0x4c0 [ 145.666873][ T8675] ? sock_fasync+0x250/0x250 [ 145.671475][ T8675] __splice_from_pipe+0x565/0xf00 [ 145.676485][ T8675] ? generic_splice_sendpage+0x2d0/0x2d0 [ 145.682120][ T8675] generic_splice_sendpage+0x1d5/0x2d0 [ 145.687575][ T8675] ? iter_file_splice_write+0x1800/0x1800 [ 145.693283][ T8675] direct_splice_actor+0x1fd/0x580 [ 145.698401][ T8675] ? kmsan_get_metadata+0x4f/0x180 [ 145.703528][ T8675] splice_direct_to_actor+0x6b2/0xf50 [ 145.708897][ T8675] ? do_splice_direct+0x580/0x580 [ 145.713945][ T8675] do_splice_direct+0x342/0x580 [ 145.718799][ T8675] do_sendfile+0x101b/0x1d40 [ 145.723403][ T8675] __se_sys_sendfile64+0x2bb/0x360 [ 145.728500][ T8675] ? kmsan_get_metadata+0x4f/0x180 [ 145.733624][ T8675] __x64_sys_sendfile64+0x56/0x70 [ 145.738641][ T8675] do_syscall_64+0xb0/0x150 [ 145.743151][ T8675] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 145.749027][ T8675] RIP: 0033:0x443d99 [ 145.752898][ T8675] Code: Bad RIP value. [ 145.756969][ T8675] RSP: 002b:00007ffd270ea478 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 145.765396][ T8675] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443d99 [ 145.773366][ T8675] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 145.781344][ T8675] RBP: 00007ffd270ea480 R08: 0000000000000012 R09: 0000000001bbbbbb [ 145.789317][ T8675] R10: 000000000000a808 R11: 0000000000000246 R12: 0000000000000000 [ 145.797272][ T8675] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 145.805271][ T8675] [ 145.807600][ T8675] Uninit was stored to memory at: [ 145.812629][ T8675] kmsan_internal_chain_origin+0xad/0x130 [ 145.818359][ T8675] __msan_chain_origin+0x50/0x90 [ 145.823299][ T8675] icmp_pkt_to_tuple+0x35a/0x400 [ 145.828235][ T8675] nf_ct_get_tuple+0xb9a/0x1530 [ 145.833096][ T8675] nf_conntrack_in+0x6e0/0x26b1 [ 145.837968][ T8675] ipv6_conntrack_local+0x68/0x80 [ 145.842993][ T8675] nf_hook_slow+0x16e/0x400 [ 145.847502][ T8675] __ip6_local_out+0x56d/0x750 [ 145.852269][ T8675] ip6_local_out+0xa4/0x1d0 [ 145.856787][ T8675] ip6_push_pending_frames+0x213/0x4f0 [ 145.862238][ T8675] rawv6_sendmsg+0x4233/0x5c30 [ 145.867025][ T8675] inet_sendmsg+0x2d8/0x2e0 [ 145.871525][ T8675] kernel_sendmsg+0x384/0x440 [ 145.876184][ T8675] sock_no_sendpage+0x235/0x300 [ 145.881027][ T8675] sock_sendpage+0x1e1/0x2c0 [ 145.885622][ T8675] pipe_to_sendpage+0x38c/0x4c0 [ 145.890473][ T8675] __splice_from_pipe+0x565/0xf00 [ 145.895496][ T8675] generic_splice_sendpage+0x1d5/0x2d0 [ 145.900937][ T8675] direct_splice_actor+0x1fd/0x580 [ 145.906029][ T8675] splice_direct_to_actor+0x6b2/0xf50 [ 145.911385][ T8675] do_splice_direct+0x342/0x580 [ 145.916219][ T8675] do_sendfile+0x101b/0x1d40 [ 145.920801][ T8675] __se_sys_sendfile64+0x2bb/0x360 [ 145.925938][ T8675] __x64_sys_sendfile64+0x56/0x70 [ 145.930951][ T8675] do_syscall_64+0xb0/0x150 [ 145.935890][ T8675] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 145.941786][ T8675] [ 145.944113][ T8675] Uninit was stored to memory at: [ 145.949144][ T8675] kmsan_internal_chain_origin+0xad/0x130 [ 145.954869][ T8675] kmsan_memcpy_memmove_metadata+0x272/0x2e0 [ 145.960846][ T8675] kmsan_memcpy_metadata+0xb/0x10 [ 145.965855][ T8675] __msan_memcpy+0x43/0x50 [ 145.970252][ T8675] csum_partial_copy+0xae/0x100 [ 145.975089][ T8675] csum_and_copy_from_iter_full+0xdca/0x1800 [ 145.981049][ T8675] ip_generic_getfrag+0x1fb/0x3c0 [ 145.986069][ T8675] raw6_getfrag+0x552/0x600 [ 145.990556][ T8675] __ip6_append_data+0x507b/0x6320 [ 145.995670][ T8675] ip6_append_data+0x3cb/0x660 [ 146.000441][ T8675] rawv6_sendmsg+0x32bb/0x5c30 [ 146.005406][ T8675] inet_sendmsg+0x2d8/0x2e0 [ 146.009932][ T8675] kernel_sendmsg+0x384/0x440 [ 146.014694][ T8675] sock_no_sendpage+0x235/0x300 [ 146.019544][ T8675] sock_sendpage+0x1e1/0x2c0 [ 146.024121][ T8675] pipe_to_sendpage+0x38c/0x4c0 [ 146.028953][ T8675] __splice_from_pipe+0x565/0xf00 [ 146.033970][ T8675] generic_splice_sendpage+0x1d5/0x2d0 [ 146.039426][ T8675] direct_splice_actor+0x1fd/0x580 [ 146.044520][ T8675] splice_direct_to_actor+0x6b2/0xf50 [ 146.049896][ T8675] do_splice_direct+0x342/0x580 [ 146.054739][ T8675] do_sendfile+0x101b/0x1d40 [ 146.059312][ T8675] __se_sys_sendfile64+0x2bb/0x360 [ 146.064416][ T8675] __x64_sys_sendfile64+0x56/0x70 [ 146.069463][ T8675] do_syscall_64+0xb0/0x150 [ 146.073957][ T8675] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 146.079826][ T8675] [ 146.082134][ T8675] Uninit was created at: [ 146.086402][ T8675] kmsan_save_stack_with_flags+0x3c/0x90 [ 146.092133][ T8675] kmsan_alloc_page+0xb9/0x180 [ 146.096892][ T8675] __alloc_pages_nodemask+0x56a2/0x5dc0 [ 146.102423][ T8675] alloc_pages_current+0x672/0x990 [ 146.107518][ T8675] push_pipe+0x605/0xb70 [ 146.111743][ T8675] iov_iter_get_pages_alloc+0x18a9/0x21c0 [ 146.117461][ T8675] do_splice_to+0x4fc/0x14f0 [ 146.122067][ T8675] splice_direct_to_actor+0x45c/0xf50 [ 146.127429][ T8675] do_splice_direct+0x342/0x580 [ 146.132277][ T8675] do_sendfile+0x101b/0x1d40 [ 146.136850][ T8675] __se_sys_sendfile64+0x2bb/0x360 [ 146.141959][ T8675] __x64_sys_sendfile64+0x56/0x70 [ 146.146993][ T8675] do_syscall_64+0xb0/0x150 [ 146.151536][ T8675] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 146.157423][ T8675] ===================================================== [ 146.164358][ T8675] Disabling lock debugging due to kernel taint [ 146.170513][ T8675] Kernel panic - not syncing: panic_on_warn set ... [ 146.177112][ T8675] CPU: 0 PID: 8675 Comm: syz-executor064 Tainted: G B 5.8.0-rc5-syzkaller #0 [ 146.187169][ T8675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 146.197211][ T8675] Call Trace: [ 146.200511][ T8675] dump_stack+0x1df/0x240 [ 146.204861][ T8675] panic+0x3d5/0xc3e [ 146.208797][ T8675] kmsan_report+0x1df/0x1e0 [ 146.213341][ T8675] __msan_warning+0x58/0xa0 [ 146.217854][ T8675] nf_conntrack_invert_icmp_tuple+0xaa/0x2c0 [ 146.223845][ T8675] nf_ct_invert_tuple+0x346/0x590 [ 146.228863][ T8675] init_conntrack+0x116/0x1ff0 [ 146.233640][ T8675] nf_conntrack_in+0x1341/0x26b1 [ 146.238594][ T8675] ipv6_conntrack_local+0x68/0x80 [ 146.243630][ T8675] ? ipv6_conntrack_in+0x80/0x80 [ 146.248567][ T8675] nf_hook_slow+0x16e/0x400 [ 146.253080][ T8675] __ip6_local_out+0x56d/0x750 [ 146.258581][ T8675] ? __ip6_local_out+0x750/0x750 [ 146.263529][ T8675] ip6_local_out+0xa4/0x1d0 [ 146.268046][ T8675] ip6_push_pending_frames+0x213/0x4f0 [ 146.273530][ T8675] rawv6_sendmsg+0x4233/0x5c30 [ 146.278314][ T8675] ? is_module_text_address+0x4d/0x2a0 [ 146.283870][ T8675] ? __kernel_text_address+0x171/0x2d0 [ 146.289360][ T8675] ? kmsan_get_metadata+0x11d/0x180 [ 146.294559][ T8675] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 146.300396][ T8675] ? udp_cmsg_send+0x5d0/0x5d0 [ 146.305164][ T8675] ? compat_rawv6_ioctl+0x100/0x100 [ 146.310363][ T8675] inet_sendmsg+0x2d8/0x2e0 [ 146.314861][ T8675] ? inet_send_prepare+0x600/0x600 [ 146.319982][ T8675] kernel_sendmsg+0x384/0x440 [ 146.324701][ T8675] sock_no_sendpage+0x235/0x300 [ 146.329605][ T8675] ? sock_no_mmap+0x30/0x30 [ 146.334120][ T8675] sock_sendpage+0x1e1/0x2c0 [ 146.338711][ T8675] pipe_to_sendpage+0x38c/0x4c0 [ 146.343721][ T8675] ? sock_fasync+0x250/0x250 [ 146.348329][ T8675] __splice_from_pipe+0x565/0xf00 [ 146.353359][ T8675] ? generic_splice_sendpage+0x2d0/0x2d0 [ 146.359006][ T8675] generic_splice_sendpage+0x1d5/0x2d0 [ 146.364478][ T8675] ? iter_file_splice_write+0x1800/0x1800 [ 146.370184][ T8675] direct_splice_actor+0x1fd/0x580 [ 146.375291][ T8675] ? kmsan_get_metadata+0x4f/0x180 [ 146.380411][ T8675] splice_direct_to_actor+0x6b2/0xf50 [ 146.385782][ T8675] ? do_splice_direct+0x580/0x580 [ 146.390825][ T8675] do_splice_direct+0x342/0x580 [ 146.395702][ T8675] do_sendfile+0x101b/0x1d40 [ 146.400346][ T8675] __se_sys_sendfile64+0x2bb/0x360 [ 146.405481][ T8675] ? kmsan_get_metadata+0x4f/0x180 [ 146.410614][ T8675] __x64_sys_sendfile64+0x56/0x70 [ 146.415633][ T8675] do_syscall_64+0xb0/0x150 [ 146.420129][ T8675] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 146.426008][ T8675] RIP: 0033:0x443d99 [ 146.429886][ T8675] Code: Bad RIP value. [ 146.433948][ T8675] RSP: 002b:00007ffd270ea478 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 146.442359][ T8675] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443d99 [ 146.450324][ T8675] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 146.458301][ T8675] RBP: 00007ffd270ea480 R08: 0000000000000012 R09: 0000000001bbbbbb [ 146.466441][ T8675] R10: 000000000000a808 R11: 0000000000000246 R12: 0000000000000000 [ 146.474415][ T8675] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 146.483594][ T8675] Kernel Offset: 0x20a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 146.495218][ T8675] Rebooting in 86400 seconds..