[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 91.357930][ T30] audit: type=1800 audit(1559791096.409:25): pid=12842 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 91.382277][ T30] audit: type=1800 audit(1559791096.439:26): pid=12842 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 91.418378][ T30] audit: type=1800 audit(1559791096.459:27): pid=12842 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.5' (ECDSA) to the list of known hosts. 2019/06/06 03:18:32 fuzzer started syzkaller login: [ 111.575699][T13000] as (13000) used greatest stack depth: 53696 bytes left 2019/06/06 03:18:38 dialing manager at 10.128.0.26:44085 2019/06/06 03:18:38 syscalls: 2300 2019/06/06 03:18:38 code coverage: enabled 2019/06/06 03:18:38 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/06/06 03:18:38 extra coverage: enabled 2019/06/06 03:18:38 setuid sandbox: enabled 2019/06/06 03:18:38 namespace sandbox: enabled 2019/06/06 03:18:38 Android sandbox: /sys/fs/selinux/policy does not exist 2019/06/06 03:18:38 fault injection: enabled 2019/06/06 03:18:38 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/06/06 03:18:38 net packet injection: enabled 2019/06/06 03:18:38 net device setup: enabled 03:20:57 executing program 0: mknod(&(0x7f0000000080)='./bus\x00', 0x80008005, 0x2d94) r0 = open(&(0x7f0000000000)='./bus\x00', 0x1, 0x0) pwritev(r0, &(0x7f00000002c0)=[{&(0x7f0000000180), 0xfffffe91}], 0x1, 0x0) [ 252.947058][T13008] IPVS: ftp: loaded support on port[0] = 21 [ 253.087915][T13008] chnl_net:caif_netlink_parms(): no params data found [ 253.159036][T13008] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.166451][T13008] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.175671][T13008] device bridge_slave_0 entered promiscuous mode [ 253.185790][T13008] bridge0: port 2(bridge_slave_1) entered blocking state [ 253.193104][T13008] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.202056][T13008] device bridge_slave_1 entered promiscuous mode [ 253.234714][T13008] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 253.246951][T13008] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 253.278412][T13008] team0: Port device team_slave_0 added [ 253.287654][T13008] team0: Port device team_slave_1 added [ 253.357068][T13008] device hsr_slave_0 entered promiscuous mode [ 253.482870][T13008] device hsr_slave_1 entered promiscuous mode [ 253.763169][T13008] bridge0: port 2(bridge_slave_1) entered blocking state [ 253.770523][T13008] bridge0: port 2(bridge_slave_1) entered forwarding state [ 253.778325][T13008] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.785691][T13008] bridge0: port 1(bridge_slave_0) entered forwarding state [ 253.867129][T13008] 8021q: adding VLAN 0 to HW filter on device bond0 [ 253.887739][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 253.899071][ T3361] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.909362][ T3361] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.920806][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 253.940623][T13008] 8021q: adding VLAN 0 to HW filter on device team0 [ 253.958208][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 253.967564][ T3361] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.974902][ T3361] bridge0: port 1(bridge_slave_0) entered forwarding state [ 254.029100][T13008] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 254.039567][T13008] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 254.058822][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 254.068039][ T3361] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.075361][ T3361] bridge0: port 2(bridge_slave_1) entered forwarding state [ 254.086926][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 254.096933][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 254.106429][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 254.115710][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 254.149477][T13008] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 254.171873][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 254.180765][ T3361] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 03:20:59 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpgid(0x0) fcntl$setown(r0, 0x6, r1) 03:21:00 executing program 0: mknod(&(0x7f0000000000)='./bus\x00', 0x80008000, 0x801) open(&(0x7f00009b7000)='./bus\x00', 0x0, 0x0) 03:21:00 executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={0x12, 0x1, 0x0, 0x8f, 0x6d, 0x51, 0x40, 0x13b1, 0xd, 0xa543, 0x0, 0x0, 0x0, 0x2, [{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{0x9, 0x4, 0x74, 0x0, 0x0, 0xf3, 0xb6, 0x70}]}]}, 0x0) [ 255.422566][ T3361] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 255.802539][ T3361] usb 1-1: config 0 has an invalid interface number: 116 but max is 0 [ 255.810828][ T3361] usb 1-1: config 0 has no interface number 0 [ 255.892150][ T3361] usb 1-1: config 0 has an invalid interface number: 116 but max is 0 [ 255.900435][ T3361] usb 1-1: config 0 has no interface number 0 [ 255.906753][ T3361] usb 1-1: New USB device found, idVendor=13b1, idProduct=000d, bcdDevice=a5.43 [ 255.915932][ T3361] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.927147][ T3361] usb 1-1: config 0 descriptor?? [ 256.122061][ T3361] usb 1-1: reset high-speed USB device number 2 using dummy_hcd 03:21:01 executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001b00)={0x12, 0x1, 0x0, 0xe5, 0xf5, 0xff, 0x8, 0xbda, 0x2838, 0x2562, 0x0, 0x0, 0x0, 0x1, [{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{0x9, 0x4, 0x0, 0x0, 0x0, 0xdc, 0xa3, 0x5f}]}]}, 0x0) syz_usb_control_io(r0, &(0x7f0000000c40)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000bc0)={0x11, &(0x7f0000002dc0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000002a80)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000002d40)={0x54, &(0x7f0000002ac0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000001600)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000018c0)={0x54, &(0x7f0000001640), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) [ 256.910427][T13028] IPVS: ftp: loaded support on port[0] = 21 [ 257.060663][T13028] chnl_net:caif_netlink_parms(): no params data found [ 257.112795][ T3361] usb 1-1: device descriptor read/64, error -71 [ 257.140732][T13028] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.148611][T13028] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.157595][T13028] device bridge_slave_0 entered promiscuous mode [ 257.168213][T13028] bridge0: port 2(bridge_slave_1) entered blocking state [ 257.175618][T13028] bridge0: port 2(bridge_slave_1) entered disabled state [ 257.184424][T13028] device bridge_slave_1 entered promiscuous mode [ 257.217195][T13028] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 257.229814][T13028] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 257.264543][T13028] team0: Port device team_slave_0 added [ 257.273803][T13028] team0: Port device team_slave_1 added [ 257.386871][T13028] device hsr_slave_0 entered promiscuous mode [ 257.422570][T13028] device hsr_slave_1 entered promiscuous mode [ 257.674583][T13028] bridge0: port 2(bridge_slave_1) entered blocking state [ 257.682018][T13028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 257.689688][T13028] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.697057][T13028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 257.773016][T13028] 8021q: adding VLAN 0 to HW filter on device bond0 [ 257.793435][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 257.804191][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.815270][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 257.827014][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 257.866221][T13028] 8021q: adding VLAN 0 to HW filter on device team0 03:21:02 executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={0x12, 0x1, 0x0, 0x8f, 0x6d, 0x51, 0x40, 0x13b1, 0xd, 0xa543, 0x0, 0x0, 0x0, 0x2, [{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{0x9, 0x4, 0x74, 0x0, 0x0, 0xf3, 0xb6, 0x70}]}]}, 0x0) [ 257.896787][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 257.907061][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.914418][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 257.992118][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 258.001129][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.008468][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 258.018714][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 258.028514][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 258.053351][T13028] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 258.064073][T13028] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 258.103554][T13028] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 258.117704][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 258.126679][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 258.136216][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 258.165663][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 258.562667][ T5] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 258.802580][ T5] usb 2-1: Using ep0 maxpacket: 8 [ 258.922845][ T5] usb 2-1: New USB device found, idVendor=0bda, idProduct=2838, bcdDevice=25.62 [ 258.932315][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.945239][ T5] usb 2-1: config 0 descriptor?? [ 259.172084][ T5] usb 2-1: dvb_usb_v2: found a 'Realtek RTL2832U reference design' in warm state [ 259.662164][ T3361] ieee80211 phy3: rt2x00usb_vendor_request: Error - Vendor Request 0x09 failed for offset 0x0000 with error -71 [ 259.773117][ T3361] ieee80211 phy3: rt2x00usb_vendor_request: Error - Vendor Request 0x07 failed for offset 0x04d0 with error -71 [ 259.785942][ T3361] ================================================================== [ 259.794159][ T3361] BUG: KMSAN: uninit-value in rt2500usb_bbp_read+0x174/0x640 [ 259.801547][ T3361] CPU: 0 PID: 3361 Comm: kworker/0:2 Not tainted 5.1.0+ #1 [ 259.808740][ T3361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 259.818928][ T3361] Workqueue: usb_hub_wq hub_event [ 259.823974][ T3361] Call Trace: [ 259.827369][ T3361] dump_stack+0x191/0x1f0 [ 259.831802][ T3361] kmsan_report+0x130/0x2a0 [ 259.836342][ T3361] __msan_warning+0x75/0xe0 [ 259.840872][ T3361] rt2500usb_bbp_read+0x174/0x640 [ 259.845959][ T3361] rt2500usb_probe_hw+0x3b1/0x2230 [ 259.851115][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 259.857031][ T3361] ? rt2500usb_queue_init+0x1e0/0x1e0 [ 259.862417][ T3361] ? rt2500usb_queue_init+0x1e0/0x1e0 [ 259.867866][ T3361] rt2x00lib_probe_dev+0xb81/0x3090 [ 259.873098][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 259.879027][ T3361] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 259.885215][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 259.891145][ T3361] rt2x00usb_probe+0x7c7/0xf70 [ 259.895961][ T3361] rt2500usb_probe+0x50/0x60 [ 259.900574][ T3361] ? rt2800_brightness_set+0xf20/0xf20 [ 259.906076][ T3361] usb_probe_interface+0xd66/0x1320 [ 259.911317][ T3361] ? usb_register_driver+0x7d0/0x7d0 [ 259.916706][ T3361] really_probe+0xdae/0x1d80 [ 259.921343][ T3361] driver_probe_device+0x1b3/0x4f0 [ 259.926500][ T3361] __device_attach_driver+0x5b8/0x790 [ 259.931916][ T3361] bus_for_each_drv+0x28e/0x3b0 [ 259.936807][ T3361] ? deferred_probe_work_func+0x400/0x400 [ 259.942551][ T3361] __device_attach+0x454/0x730 [ 259.947342][ T3361] device_initial_probe+0x4a/0x60 [ 259.952392][ T3361] bus_probe_device+0x137/0x390 [ 259.957332][ T3361] device_add+0x288d/0x30e0 [ 259.961917][ T3361] usb_set_configuration+0x30dc/0x3750 [ 259.967510][ T3361] generic_probe+0xe7/0x280 [ 259.972043][ T3361] ? usb_choose_configuration+0xae0/0xae0 [ 259.977802][ T3361] usb_probe_device+0x14c/0x200 [ 259.982681][ T3361] ? usb_register_device_driver+0x470/0x470 [ 259.988605][ T3361] really_probe+0xdae/0x1d80 [ 259.993237][ T3361] driver_probe_device+0x1b3/0x4f0 [ 259.998380][ T3361] __device_attach_driver+0x5b8/0x790 [ 260.003791][ T3361] bus_for_each_drv+0x28e/0x3b0 [ 260.008658][ T3361] ? deferred_probe_work_func+0x400/0x400 [ 260.014411][ T3361] __device_attach+0x454/0x730 [ 260.019206][ T3361] device_initial_probe+0x4a/0x60 [ 260.024247][ T3361] bus_probe_device+0x137/0x390 [ 260.029132][ T3361] device_add+0x288d/0x30e0 [ 260.033694][ T3361] usb_new_device+0x23e5/0x2ff0 [ 260.038606][ T3361] hub_event+0x48d1/0x7290 [ 260.043139][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 260.049048][ T3361] ? led_work+0x720/0x720 [ 260.053396][ T3361] ? led_work+0x720/0x720 [ 260.057811][ T3361] process_one_work+0x1572/0x1f00 [ 260.062905][ T3361] worker_thread+0x111b/0x2460 [ 260.067759][ T3361] kthread+0x4b5/0x4f0 [ 260.071846][ T3361] ? process_one_work+0x1f00/0x1f00 [ 260.077073][ T3361] ? kthread_blkcg+0xf0/0xf0 [ 260.081717][ T3361] ret_from_fork+0x35/0x40 [ 260.086165][ T3361] [ 260.088508][ T3361] Local variable description: ----reg.i.i@rt2500usb_bbp_read [ 260.095877][ T3361] Variable was created at: [ 260.100319][ T3361] rt2500usb_bbp_read+0xa4/0x640 [ 260.105269][ T3361] rt2500usb_probe_hw+0x3b1/0x2230 [ 260.110379][ T3361] ================================================================== [ 260.118449][ T3361] Disabling lock debugging due to kernel taint [ 260.124611][ T3361] Kernel panic - not syncing: panic_on_warn set ... [ 260.131214][ T3361] CPU: 0 PID: 3361 Comm: kworker/0:2 Tainted: G B 5.1.0+ #1 [ 260.139810][ T3361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 260.149903][ T3361] Workqueue: usb_hub_wq hub_event [ 260.154946][ T3361] Call Trace: [ 260.158267][ T3361] dump_stack+0x191/0x1f0 [ 260.162710][ T3361] panic+0x3ca/0xafe [ 260.166676][ T3361] kmsan_report+0x298/0x2a0 [ 260.171211][ T3361] __msan_warning+0x75/0xe0 [ 260.175744][ T3361] rt2500usb_bbp_read+0x174/0x640 [ 260.180812][ T3361] rt2500usb_probe_hw+0x3b1/0x2230 [ 260.185967][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 260.191878][ T3361] ? rt2500usb_queue_init+0x1e0/0x1e0 [ 260.197273][ T3361] ? rt2500usb_queue_init+0x1e0/0x1e0 [ 260.202665][ T3361] rt2x00lib_probe_dev+0xb81/0x3090 [ 260.207884][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 260.213812][ T3361] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 260.219992][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 260.225926][ T3361] rt2x00usb_probe+0x7c7/0xf70 [ 260.230743][ T3361] rt2500usb_probe+0x50/0x60 [ 260.235350][ T3361] ? rt2800_brightness_set+0xf20/0xf20 [ 260.240830][ T3361] usb_probe_interface+0xd66/0x1320 [ 260.246071][ T3361] ? usb_register_driver+0x7d0/0x7d0 [ 260.251373][ T3361] really_probe+0xdae/0x1d80 [ 260.256002][ T3361] driver_probe_device+0x1b3/0x4f0 [ 260.261144][ T3361] __device_attach_driver+0x5b8/0x790 [ 260.266556][ T3361] bus_for_each_drv+0x28e/0x3b0 [ 260.271421][ T3361] ? deferred_probe_work_func+0x400/0x400 [ 260.277176][ T3361] __device_attach+0x454/0x730 [ 260.281983][ T3361] device_initial_probe+0x4a/0x60 [ 260.287037][ T3361] bus_probe_device+0x137/0x390 [ 260.291943][ T3361] device_add+0x288d/0x30e0 [ 260.296523][ T3361] usb_set_configuration+0x30dc/0x3750 [ 260.302087][ T3361] generic_probe+0xe7/0x280 [ 260.306631][ T3361] ? usb_choose_configuration+0xae0/0xae0 [ 260.312380][ T3361] usb_probe_device+0x14c/0x200 [ 260.317261][ T3361] ? usb_register_device_driver+0x470/0x470 [ 260.323180][ T3361] really_probe+0xdae/0x1d80 [ 260.327812][ T3361] driver_probe_device+0x1b3/0x4f0 [ 260.332963][ T3361] __device_attach_driver+0x5b8/0x790 [ 260.338380][ T3361] bus_for_each_drv+0x28e/0x3b0 [ 260.343254][ T3361] ? deferred_probe_work_func+0x400/0x400 [ 260.349003][ T3361] __device_attach+0x454/0x730 [ 260.353802][ T3361] device_initial_probe+0x4a/0x60 [ 260.358847][ T3361] bus_probe_device+0x137/0x390 [ 260.363740][ T3361] device_add+0x288d/0x30e0 [ 260.368310][ T3361] usb_new_device+0x23e5/0x2ff0 [ 260.373222][ T3361] hub_event+0x48d1/0x7290 [ 260.377774][ T3361] ? kmsan_get_shadow_origin_ptr+0x71/0x470 [ 260.383683][ T3361] ? led_work+0x720/0x720 [ 260.388028][ T3361] ? led_work+0x720/0x720 [ 260.392382][ T3361] process_one_work+0x1572/0x1f00 [ 260.397479][ T3361] worker_thread+0x111b/0x2460 [ 260.402308][ T3361] kthread+0x4b5/0x4f0 [ 260.406392][ T3361] ? process_one_work+0x1f00/0x1f00 [ 260.411621][ T3361] ? kthread_blkcg+0xf0/0xf0 [ 260.416235][ T3361] ret_from_fork+0x35/0x40 [ 260.421684][ T3361] Kernel Offset: disabled [ 260.426168][ T3361] Rebooting in 86400 seconds..