[ 75.705974] audit: type=1800 audit(1554165238.750:25): pid=9854 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 75.725102] audit: type=1800 audit(1554165238.750:26): pid=9854 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 75.744517] audit: type=1800 audit(1554165238.750:27): pid=9854 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 76.967006] sshd (9921) used greatest stack depth: 54128 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.14' (ECDSA) to the list of known hosts. 2019/04/02 00:35:04 parsed 1 programs 2019/04/02 00:35:22 executed programs: 0 syzkaller login: [ 159.774767] IPVS: ftp: loaded support on port[0] = 21 [ 159.793219] IPVS: ftp: loaded support on port[0] = 21 [ 159.819024] IPVS: ftp: loaded support on port[0] = 21 [ 159.852605] IPVS: ftp: loaded support on port[0] = 21 [ 159.856419] IPVS: ftp: loaded support on port[0] = 21 [ 159.883548] IPVS: ftp: loaded support on port[0] = 21 [ 160.119935] chnl_net:caif_netlink_parms(): no params data found [ 160.276122] chnl_net:caif_netlink_parms(): no params data found [ 160.349698] chnl_net:caif_netlink_parms(): no params data found [ 160.359382] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.366028] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.373958] device bridge_slave_0 entered promiscuous mode [ 160.384865] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.391338] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.399232] device bridge_slave_1 entered promiscuous mode [ 160.439700] chnl_net:caif_netlink_parms(): no params data found [ 160.450034] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.456670] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.464689] device bridge_slave_0 entered promiscuous mode [ 160.476780] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.483383] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.491225] device bridge_slave_1 entered promiscuous mode [ 160.509375] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 160.523212] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 160.624680] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 160.642616] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 160.685894] team0: Port device team_slave_0 added [ 160.700587] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.708425] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.716460] device bridge_slave_0 entered promiscuous mode [ 160.733535] team0: Port device team_slave_1 added [ 160.738907] chnl_net:caif_netlink_parms(): no params data found [ 160.769504] chnl_net:caif_netlink_parms(): no params data found [ 160.781325] team0: Port device team_slave_0 added [ 160.788420] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.795036] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.803254] device bridge_slave_1 entered promiscuous mode [ 160.844172] team0: Port device team_slave_1 added [ 160.933844] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.940366] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.948358] device bridge_slave_0 entered promiscuous mode [ 160.963872] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.970366] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.978352] device bridge_slave_1 entered promiscuous mode [ 161.055511] device hsr_slave_0 entered promiscuous mode [ 161.102186] device hsr_slave_1 entered promiscuous mode [ 161.146556] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.154625] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.161276] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.169021] device bridge_slave_0 entered promiscuous mode [ 161.176592] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.183304] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.191217] device bridge_slave_0 entered promiscuous mode [ 161.198772] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.205364] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.213518] device bridge_slave_1 entered promiscuous mode [ 161.262023] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.274578] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.281072] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.289098] device bridge_slave_1 entered promiscuous mode [ 161.298788] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.317627] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.327852] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.385262] device hsr_slave_0 entered promiscuous mode [ 161.432562] device hsr_slave_1 entered promiscuous mode [ 161.507901] team0: Port device team_slave_0 added [ 161.515986] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.526680] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.561050] team0: Port device team_slave_0 added [ 161.579743] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.589629] team0: Port device team_slave_0 added [ 161.597164] team0: Port device team_slave_1 added [ 161.604661] team0: Port device team_slave_1 added [ 161.623042] team0: Port device team_slave_1 added [ 161.639381] team0: Port device team_slave_0 added [ 161.647329] team0: Port device team_slave_1 added [ 161.745365] device hsr_slave_0 entered promiscuous mode [ 161.792448] device hsr_slave_1 entered promiscuous mode [ 161.894731] device hsr_slave_0 entered promiscuous mode [ 161.932462] device hsr_slave_1 entered promiscuous mode [ 162.034592] device hsr_slave_0 entered promiscuous mode [ 162.082509] device hsr_slave_1 entered promiscuous mode [ 162.204478] device hsr_slave_0 entered promiscuous mode [ 162.252396] device hsr_slave_1 entered promiscuous mode [ 162.411430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.483092] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.504395] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.511953] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.527514] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.539737] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.547266] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.554836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.584547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.614180] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.622842] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.631889] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.644537] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.652176] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.660291] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 162.668370] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.674828] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.682296] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.690469] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.698568] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.705030] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.722649] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 162.730207] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 162.752043] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.758580] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.766173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.783691] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.809753] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.817486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 162.826266] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 162.835198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.842555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.872403] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.880896] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.889666] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.896195] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.903850] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.912305] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 162.920229] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.926810] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.934352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 162.950211] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.957375] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 162.973945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.986373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.995419] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.003551] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.010025] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.035402] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 163.043884] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 163.051890] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.058361] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.065930] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.074534] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.082966] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 163.090339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 163.097774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.106297] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.118058] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.190228] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.205346] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 163.215219] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 163.228332] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 163.238191] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 163.262629] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 163.270272] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.278193] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.286937] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.296895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 163.305304] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 163.313474] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.319938] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.327586] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.336392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 163.344110] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 163.351575] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 163.360038] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.368124] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.374699] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.382431] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.391241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.399523] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.407938] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.416571] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.424968] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.433843] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.442366] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 163.450723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.458830] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.465369] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.473048] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.481993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.490548] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.499023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.507646] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.516075] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.524641] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.533055] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.541100] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.549592] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.557721] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.565866] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.574017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.582202] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.590898] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.599132] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.607150] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.615754] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.624127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.632245] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.640369] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.648569] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.660088] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 163.668033] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 163.675544] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.683389] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.691053] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.700163] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 163.743708] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.751577] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.760415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.768678] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.788070] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 163.820293] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.829076] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.837545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.846049] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.854424] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.862513] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.870552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 163.878867] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 163.886960] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.893524] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.902565] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.910471] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 163.962259] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.972970] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 163.981383] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.989540] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.996085] bridge0: port 2(bridge_slave_1) entered forwarding state [ 164.003887] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 164.035582] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.045325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 164.053623] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 164.061838] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 164.087711] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 164.097093] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 164.115472] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 164.123905] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 164.157374] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.168266] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 164.177275] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 164.198792] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 164.208681] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 164.220826] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 164.229463] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 164.238857] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 164.247173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 164.313476] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.360702] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 164.430960] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.452714] ================================================================== [ 164.460145] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 [ 164.466659] CPU: 0 PID: 10048 Comm: syz-executor.3 Not tainted 5.1.0-rc2+ #21 [ 164.473945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 164.483309] Call Trace: [ 164.485917] dump_stack+0x173/0x1d0 [ 164.489566] kmsan_report+0x131/0x2a0 [ 164.493395] kmsan_internal_check_memory+0xaa1/0xbb0 [ 164.498526] kmsan_copy_to_user+0xab/0xc0 [ 164.502689] _copy_to_user+0x16b/0x1f0 [ 164.506600] sctp_getsockopt+0xc982/0x185c0 [ 164.510931] ? __se_sys_futex+0x43d/0x7f0 [ 164.515120] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 164.520500] ? aa_sk_perm+0x741/0xb00 [ 164.524327] ? sctp_setsockopt+0x17830/0x17830 [ 164.528931] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 164.534142] ? sctp_setsockopt+0x17830/0x17830 [ 164.538742] sock_common_getsockopt+0x13f/0x180 [ 164.543436] ? sock_recv_errqueue+0x8f0/0x8f0 [ 164.547950] __sys_getsockopt+0x489/0x550 [ 164.552131] __se_sys_getsockopt+0xe1/0x100 [ 164.556482] __x64_sys_getsockopt+0x62/0x80 [ 164.560831] do_syscall_64+0xbc/0xf0 [ 164.564561] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 164.569756] RIP: 0033:0x458209 [ 164.572966] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 164.591887] RSP: 002b:00007f2e00856c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 164.599624] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458209 [ 164.606913] RDX: 000000000000006c RSI: 0000000000000084 RDI: 0000000000000004 [ 164.614218] RBP: 000000000073bf00 R08: 0000000020000040 R09: 0000000000000000 [ 164.621528] R10: 0000000020000000 R11: 0000000000000246 R12: 00007f2e008576d4 [ 164.628825] R13: 00000000004c9a88 R14: 00000000004d06e8 R15: 00000000ffffffff [ 164.636117] [ 164.637747] Uninit was stored to memory at: [ 164.642085] kmsan_internal_chain_origin+0x134/0x230 [ 164.647203] kmsan_memcpy_memmove_metadata+0xb5b/0xfe0 [ 164.652509] kmsan_memcpy_metadata+0xb/0x10 [ 164.656861] __msan_memcpy+0x58/0x70 [ 164.660588] sctp_getsockopt+0xc852/0x185c0 [ 164.664924] sock_common_getsockopt+0x13f/0x180 [ 164.669603] __sys_getsockopt+0x489/0x550 [ 164.673758] __se_sys_getsockopt+0xe1/0x100 [ 164.678085] __x64_sys_getsockopt+0x62/0x80 [ 164.682417] do_syscall_64+0xbc/0xf0 [ 164.686143] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 164.691331] [ 164.692960] Uninit was stored to memory at: [ 164.697293] kmsan_internal_chain_origin+0x134/0x230 [ 164.703954] kmsan_memcpy_memmove_metadata+0xb5b/0xfe0 [ 164.709236] kmsan_memcpy_metadata+0xb/0x10 [ 164.713568] __msan_memcpy+0x58/0x70 [ 164.717296] sctp_transport_new+0x16d/0x9a0 [ 164.721638] sctp_assoc_add_peer+0x5ba/0x2030 [ 164.726139] sctp_process_init+0x1a1b/0x3ed0 2019/04/02 00:35:27 executed programs: 6 [ 164.730555] sctp_do_sm+0x3cfc/0x9af0 [ 164.734366] sctp_assoc_bh_rcv+0x65a/0xd80 [ 164.738697] sctp_inq_push+0x300/0x420 [ 164.742595] sctp_backlog_rcv+0x20a/0xaf0 [ 164.746755] __release_sock+0x281/0x5f0 [ 164.750741] release_sock+0x99/0x2a0 [ 164.754476] sctp_wait_for_connect+0x3ee/0x860 [ 164.759075] sctp_sendmsg_to_asoc+0x2127/0x2160 [ 164.763750] sctp_sendmsg+0x3467/0x5ae0 [ 164.767733] inet_sendmsg+0x54a/0x720 [ 164.771542] ___sys_sendmsg+0xdb3/0x1220 [ 164.775612] __se_sys_sendmsg+0x305/0x460 [ 164.779770] __x64_sys_sendmsg+0x4a/0x70 [ 164.783852] do_syscall_64+0xbc/0xf0 [ 164.787580] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 164.792763] [ 164.794396] Local variable description: ----addr.i@sctp_process_init [ 164.800892] Variable was created at: [ 164.804623] sctp_process_init+0xb5/0x3ed0 [ 164.808877] sctp_do_sm+0x3cfc/0x9af0 [ 164.812671] [ 164.814295] Bytes 8-15 of 16 are uninitialized [ 164.818882] Memory access of size 16 starts at ffff88809d72fc28 [ 164.824969] Data copied to user address 0000000020000018 [ 164.830426] ================================================================== [ 164.837794] Disabling lock debugging due to kernel taint [ 164.843266] Kernel panic - not syncing: panic_on_warn set ... [ 164.849166] CPU: 0 PID: 10048 Comm: syz-executor.3 Tainted: G B 5.1.0-rc2+ #21 [ 164.857852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 164.867221] Call Trace: [ 164.871216] dump_stack+0x173/0x1d0 [ 164.874921] panic+0x3d1/0xb01 [ 164.878151] kmsan_report+0x29a/0x2a0 [ 164.881980] kmsan_internal_check_memory+0xaa1/0xbb0 [ 164.887112] kmsan_copy_to_user+0xab/0xc0 [ 164.891289] _copy_to_user+0x16b/0x1f0 [ 164.895207] sctp_getsockopt+0xc982/0x185c0 [ 164.899554] ? __se_sys_futex+0x43d/0x7f0 [ 164.903754] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 164.909139] ? aa_sk_perm+0x741/0xb00 [ 164.912967] ? sctp_setsockopt+0x17830/0x17830 [ 164.917570] ? kmsan_get_shadow_origin_ptr+0x73/0x490 [ 164.922778] ? sctp_setsockopt+0x17830/0x17830 [ 164.927394] sock_common_getsockopt+0x13f/0x180 [ 164.932086] ? sock_recv_errqueue+0x8f0/0x8f0 [ 164.936594] __sys_getsockopt+0x489/0x550 [ 164.940770] __se_sys_getsockopt+0xe1/0x100 [ 164.945202] __x64_sys_getsockopt+0x62/0x80 [ 164.949538] do_syscall_64+0xbc/0xf0 [ 164.953272] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 164.958489] RIP: 0033:0x458209 [ 164.961688] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 164.980702] RSP: 002b:00007f2e00856c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 164.988429] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458209 [ 164.995710] RDX: 000000000000006c RSI: 0000000000000084 RDI: 0000000000000004 [ 165.002995] RBP: 000000000073bf00 R08: 0000000020000040 R09: 0000000000000000 [ 165.010279] R10: 0000000020000000 R11: 0000000000000246 R12: 00007f2e008576d4 [ 165.017561] R13: 00000000004c9a88 R14: 00000000004d06e8 R15: 00000000ffffffff [ 165.025886] Kernel Offset: disabled [ 165.029526] Rebooting in 86400 seconds..