[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 96.101140] audit: type=1800 audit(1552378609.140:25): pid=10844 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 96.120367] audit: type=1800 audit(1552378609.140:26): pid=10844 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 96.140026] audit: type=1800 audit(1552378609.170:27): pid=10844 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.178' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 107.859340] ================================================================== [ 107.866764] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 [ 107.873257] CPU: 1 PID: 10996 Comm: syz-executor362 Not tainted 5.0.0+ #11 [ 107.880263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 107.889613] Call Trace: [ 107.892212] dump_stack+0x173/0x1d0 [ 107.895876] kmsan_report+0x12e/0x2a0 [ 107.899693] kmsan_internal_check_memory+0x9f4/0xb10 [ 107.904839] kmsan_copy_to_user+0xab/0xc0 [ 107.909000] _copy_to_user+0x16b/0x1f0 [ 107.912912] move_addr_to_user+0x311/0x570 [ 107.917186] ___sys_recvmsg+0xb65/0x1310 [ 107.921294] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 107.926490] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 107.931886] ? __fget_light+0x6e1/0x750 [ 107.935885] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 107.941089] do_recvmmsg+0x646/0x10c0 [ 107.944927] ? __x64_sys_recvmmsg+0x62/0x80 [ 107.949265] __se_sys_recvmmsg+0x1d1/0x350 [ 107.953535] __x64_sys_recvmmsg+0x62/0x80 [ 107.957692] do_syscall_64+0xbc/0xf0 [ 107.961437] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 107.966628] RIP: 0033:0x445819 [ 107.969814] Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 107.988736] RSP: 002b:00007f64453eddb8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 107.996450] RAX: ffffffffffffffda RBX: 00000000006dac28 RCX: 0000000000445819 [ 108.005122] RDX: 0000000000000005 RSI: 0000000020002f80 RDI: 0000000000000003 [ 108.012389] RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000 [ 108.019654] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c [ 108.026924] R13: 00007ffeba8f87af R14: 00007f64453ee9c0 R15: 20c49ba5e353f7cf [ 108.034204] [ 108.035822] Local variable description: ----addr@___sys_recvmsg [ 108.041867] Variable was created at: [ 108.045582] ___sys_recvmsg+0xf6/0x1310 [ 108.049553] do_recvmmsg+0x646/0x10c0 [ 108.053340] [ 108.054965] Bytes 0-31 of 32 are uninitialized [ 108.059557] Memory access of size 32 starts at ffff8880ae62fbb0 [ 108.065608] Data copied to user address 0000000020000000 [ 108.071041] ================================================================== [ 108.078402] Disabling lock debugging due to kernel taint [ 108.083847] Kernel panic - not syncing: panic_on_warn set ... [ 108.089737] CPU: 1 PID: 10996 Comm: syz-executor362 Tainted: G B 5.0.0+ #11 [ 108.098155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 108.107510] Call Trace: [ 108.110102] dump_stack+0x173/0x1d0 [ 108.113746] panic+0x3d1/0xb01 [ 108.116968] kmsan_report+0x293/0x2a0 [ 108.120772] kmsan_internal_check_memory+0x9f4/0xb10 [ 108.125938] kmsan_copy_to_user+0xab/0xc0 [ 108.130082] _copy_to_user+0x16b/0x1f0 [ 108.133972] move_addr_to_user+0x311/0x570 [ 108.138244] ___sys_recvmsg+0xb65/0x1310 [ 108.142341] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 108.147548] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 108.152906] ? __fget_light+0x6e1/0x750 [ 108.156896] ? kmsan_get_shadow_origin_ptr+0x60/0x440 [ 108.162088] do_recvmmsg+0x646/0x10c0 [ 108.165912] ? __x64_sys_recvmmsg+0x62/0x80 [ 108.170228] __se_sys_recvmmsg+0x1d1/0x350 [ 108.174493] __x64_sys_recvmmsg+0x62/0x80 [ 108.178642] do_syscall_64+0xbc/0xf0 [ 108.182369] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 108.187551] RIP: 0033:0x445819 [ 108.190734] Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 108.209647] RSP: 002b:00007f64453eddb8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 108.217457] RAX: ffffffffffffffda RBX: 00000000006dac28 RCX: 0000000000445819 [ 108.224824] RDX: 0000000000000005 RSI: 0000000020002f80 RDI: 0000000000000003 [ 108.232089] RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000 [ 108.239386] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c [ 108.246657] R13: 00007ffeba8f87af R14: 00007f64453ee9c0 R15: 20c49ba5e353f7cf [ 108.254751] Kernel Offset: disabled [ 108.258390] Rebooting in 86400 seconds..