[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 29.060201] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 31.858443] random: sshd: uninitialized urandom read (32 bytes read) [ 32.252548] random: sshd: uninitialized urandom read (32 bytes read) [ 33.349619] random: sshd: uninitialized urandom read (32 bytes read) [ 33.557335] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.44' (ECDSA) to the list of known hosts. [ 39.047528] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 39.167482] ================================================================== [ 39.174895] BUG: KMSAN: uninit-value in xfrm_state_find+0x2b15/0x4f40 [ 39.181459] CPU: 1 PID: 4510 Comm: syz-executor591 Not tainted 4.17.0-rc3+ #94 [ 39.188794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.198126] Call Trace: [ 39.200695] dump_stack+0x185/0x1d0 [ 39.204300] ? xfrm_state_find+0x2b15/0x4f40 [ 39.208689] kmsan_report+0x142/0x240 [ 39.212481] __msan_warning_32+0x6c/0xb0 [ 39.216520] xfrm_state_find+0x2b15/0x4f40 [ 39.220742] xfrm_resolve_and_create_bundle+0xc31/0x5270 [ 39.226176] ? __msan_poison_alloca+0x15c/0x1d0 [ 39.230824] ? xfrm_expand_policies+0x9a/0xb60 [ 39.235386] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 39.240730] xfrm_lookup+0x606/0x39d0 [ 39.244514] xfrm_lookup_route+0xfa/0x360 [ 39.248644] ip_route_output_flow+0x35b/0x3b0 [ 39.253128] udp_sendmsg+0x2289/0x33f0 [ 39.256996] ? kmsan_set_origin_inline+0x6b/0x120 [ 39.261828] ? ip_copy_metadata+0xee0/0xee0 [ 39.266136] udpv6_sendmsg+0x1291/0x3f40 [ 39.270195] ? __local_bh_enable_ip+0x3b/0x140 [ 39.274755] ? _raw_spin_unlock_bh+0x57/0x70 [ 39.279142] ? udp_lib_get_port+0x28e1/0x2d70 [ 39.283618] ? kmsan_set_origin_inline+0x6b/0x120 [ 39.288441] ? _raw_spin_unlock_bh+0x57/0x70 [ 39.292828] ? _raw_spin_unlock_bh+0x57/0x70 [ 39.297215] ? __local_bh_enable_ip+0x3b/0x140 [ 39.301780] ? udpv6_queue_rcv_skb+0x1c60/0x1c60 [ 39.306514] inet_sendmsg+0x48d/0x740 [ 39.310295] ? inet_getname+0x4a0/0x4a0 [ 39.314249] ___sys_sendmsg+0xec0/0x1310 [ 39.318291] ? __fdget+0x4e/0x60 [ 39.321641] __sys_sendmmsg+0x490/0x850 [ 39.325594] ? syscall_return_slowpath+0xe9/0x700 [ 39.330419] ? prepare_exit_to_usermode+0x4a/0x3a0 [ 39.335324] ? syscall_return_slowpath+0xe9/0x700 [ 39.340150] __x64_sys_sendmmsg+0x11c/0x170 [ 39.344456] do_syscall_64+0x154/0x220 [ 39.348326] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 39.353493] RIP: 0033:0x43ffd9 [ 39.356661] RSP: 002b:00007fff84e86698 EFLAGS: 00000217 ORIG_RAX: 0000000000000133 [ 39.364346] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffd9 [ 39.371597] RDX: 0000000000000001 RSI: 0000000020002000 RDI: 0000000000000003 [ 39.378848] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 39.386099] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401900 [ 39.393349] R13: 0000000000401990 R14: 0000000000000000 R15: 0000000000000000 [ 39.400598] [ 39.402201] Local variable description: ----fl4_stack@udp_sendmsg [ 39.408405] Variable was created at: [ 39.412110] udp_sendmsg+0xe5/0x33f0 [ 39.415828] udpv6_sendmsg+0x1291/0x3f40 [ 39.419860] ================================================================== [ 39.427195] Disabling lock debugging due to kernel taint [ 39.432622] Kernel panic - not syncing: panic_on_warn set ... [ 39.432622] [ 39.439963] CPU: 1 PID: 4510 Comm: syz-executor591 Tainted: G B 4.17.0-rc3+ #94 [ 39.448687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.458024] Call Trace: [ 39.460604] dump_stack+0x185/0x1d0 [ 39.464220] panic+0x39d/0x940 [ 39.467410] ? xfrm_state_find+0x2b15/0x4f40 [ 39.471799] kmsan_report+0x238/0x240 [ 39.475580] __msan_warning_32+0x6c/0xb0 [ 39.479620] xfrm_state_find+0x2b15/0x4f40 [ 39.483841] xfrm_resolve_and_create_bundle+0xc31/0x5270 [ 39.489273] ? __msan_poison_alloca+0x15c/0x1d0 [ 39.493926] ? xfrm_expand_policies+0x9a/0xb60 [ 39.498489] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 39.503836] xfrm_lookup+0x606/0x39d0 [ 39.507620] xfrm_lookup_route+0xfa/0x360 [ 39.511749] ip_route_output_flow+0x35b/0x3b0 [ 39.516224] udp_sendmsg+0x2289/0x33f0 [ 39.520092] ? kmsan_set_origin_inline+0x6b/0x120 [ 39.524921] ? ip_copy_metadata+0xee0/0xee0 [ 39.529229] udpv6_sendmsg+0x1291/0x3f40 [ 39.533270] ? __local_bh_enable_ip+0x3b/0x140 [ 39.537831] ? _raw_spin_unlock_bh+0x57/0x70 [ 39.542220] ? udp_lib_get_port+0x28e1/0x2d70 [ 39.546705] ? kmsan_set_origin_inline+0x6b/0x120 [ 39.551529] ? _raw_spin_unlock_bh+0x57/0x70 [ 39.555917] ? _raw_spin_unlock_bh+0x57/0x70 [ 39.560320] ? __local_bh_enable_ip+0x3b/0x140 [ 39.564882] ? udpv6_queue_rcv_skb+0x1c60/0x1c60 [ 39.569618] inet_sendmsg+0x48d/0x740 [ 39.573398] ? inet_getname+0x4a0/0x4a0 [ 39.577373] ___sys_sendmsg+0xec0/0x1310 [ 39.581415] ? __fdget+0x4e/0x60 [ 39.584766] __sys_sendmmsg+0x490/0x850 [ 39.588730] ? syscall_return_slowpath+0xe9/0x700 [ 39.593552] ? prepare_exit_to_usermode+0x4a/0x3a0 [ 39.598458] ? syscall_return_slowpath+0xe9/0x700 [ 39.603293] __x64_sys_sendmmsg+0x11c/0x170 [ 39.607606] do_syscall_64+0x154/0x220 [ 39.611476] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 39.616643] RIP: 0033:0x43ffd9 [ 39.619811] RSP: 002b:00007fff84e86698 EFLAGS: 00000217 ORIG_RAX: 0000000000000133 [ 39.627516] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffd9 [ 39.634765] RDX: 0000000000000001 RSI: 0000000020002000 RDI: 0000000000000003 [ 39.642016] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 39.649265] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401900 [ 39.656512] R13: 0000000000401990 R14: 0000000000000000 R15: 0000000000000000 [ 39.664215] Dumping ftrace buffer: [ 39.667740] (ftrace buffer empty) [ 39.671426] Kernel Offset: disabled [ 39.675037] Rebooting in 86400 seconds..