[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 30.319758] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 33.402626] random: sshd: uninitialized urandom read (32 bytes read) [ 33.713405] random: sshd: uninitialized urandom read (32 bytes read) [ 34.840241] random: sshd: uninitialized urandom read (32 bytes read) [ 95.756433] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.11' (ECDSA) to the list of known hosts. [ 101.242563] random: sshd: uninitialized urandom read (32 bytes read) 2018/05/22 06:52:00 parsed 1 programs 2018/05/22 06:52:00 executed programs: 0 [ 101.831518] IPVS: ftp: loaded support on port[0] = 21 [ 101.949417] ip (4550) used greatest stack depth: 54328 bytes left [ 102.028478] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.034973] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.042606] device bridge_slave_0 entered promiscuous mode [ 102.065845] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.072501] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.080528] device bridge_slave_1 entered promiscuous mode [ 102.102546] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 102.125533] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 102.190332] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 102.218251] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 102.318430] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 102.325885] team0: Port device team_slave_0 added [ 102.351435] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 102.358776] team0: Port device team_slave_1 added [ 102.383138] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 102.408659] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 102.434130] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 102.460201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 102.675827] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.682371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.689264] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.696153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.442823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.509124] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.579118] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 103.585397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 103.593895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.656464] 8021q: adding VLAN 0 to HW filter on device team0 2018/05/22 06:52:05 executed programs: 156 2018/05/22 06:52:10 executed programs: 433 2018/05/22 06:52:15 executed programs: 714 2018/05/22 06:52:20 executed programs: 1003 2018/05/22 06:52:25 executed programs: 1288 2018/05/22 06:52:30 executed programs: 1562 2018/05/22 06:52:35 executed programs: 1840 2018/05/22 06:52:40 executed programs: 2114 2018/05/22 06:52:45 executed programs: 2378 2018/05/22 06:52:50 executed programs: 2647 2018/05/22 06:52:55 executed programs: 2926 2018/05/22 06:53:00 executed programs: 3201 2018/05/22 06:53:05 executed programs: 3475 [ 171.744067] ================================================================== [ 171.751521] BUG: KMSAN: uninit-value in __mod_timer+0x430/0x2c40 [ 171.757680] CPU: 1 PID: 26095 Comm: syz-executor0 Not tainted 4.17.0-rc5+ #101 [ 171.765202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 171.774545] Call Trace: [ 171.777113] [ 171.779268] dump_stack+0x185/0x1d0 [ 171.782879] ? __mod_timer+0x430/0x2c40 [ 171.786839] kmsan_report+0x149/0x260 [ 171.795576] __msan_warning_32+0x6e/0xc0 [ 171.799626] __mod_timer+0x430/0x2c40 [ 171.803411] ? kmsan_set_origin_inline+0x6b/0x120 [ 171.808252] mod_timer+0x70/0x80 [ 171.813031] can_stat_update+0x173d/0x1870 [ 171.817269] call_timer_fn+0x26a/0x5a0 [ 171.821248] ? can_sock_destruct+0x50/0x50 [ 171.825468] __run_timers+0xda7/0x11c0 [ 171.829350] ? can_sock_destruct+0x50/0x50 [ 171.833573] ? irq_exit+0x202/0x240 [ 171.837193] ? run_timer_softirq+0x14/0x70 [ 171.841426] ? timers_dead_cpu+0x1010/0x1010 [ 171.845906] run_timer_softirq+0x43/0x70 [ 171.849956] __do_softirq+0x56d/0x93d [ 171.853744] irq_exit+0x202/0x240 [ 171.857191] exiting_irq+0xe/0x10 [ 171.860633] smp_apic_timer_interrupt+0x64/0x90 [ 171.865302] apic_timer_interrupt+0xf/0x20 [ 171.870219] [ 171.872465] RIP: 0010:kmsan_alloc_page+0x9f/0xe0 [ 171.877230] RSP: 0000:ffff8801c3fcf840 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 171.884933] RAX: 0000000000000246 RBX: ffff8801b8d0d7c0 RCX: 0000000000000001 [ 171.892202] RDX: 0000000000000001 RSI: ffffea000aa81ca0 RDI: ffffea000aa81ca0 [ 171.899454] RBP: ffff8801c3fcf880 R08: 0000000000000000 R09: 00000000ffffffff [ 171.906706] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 171.913959] R13: 0000000000000000 R14: 00000000015080c0 R15: ffffea0009dc1b80 [ 171.921226] __alloc_pages_nodemask+0xf8e/0x5dd0 [ 171.925969] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 171.931320] ? vma_wants_writenotify+0x48c/0x6a0 [ 171.936075] ? mmap_region+0x3308/0x3730 [ 171.940142] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 171.945588] ? mmap_region+0x3310/0x3730 [ 171.949639] alloc_pages_current+0x6b5/0x970 [ 171.954047] __pmd_alloc+0xad/0x410 [ 171.957678] handle_mm_fault+0x1416/0x7e50 [ 171.961911] ? kmsan_set_origin_inline+0x6b/0x120 [ 171.966744] __do_page_fault+0xec4/0x1a10 [ 171.970879] ? page_fault+0x1e/0x30 [ 171.974500] do_page_fault+0xd3/0x260 [ 171.978286] ? page_fault+0x8/0x30 [ 171.981818] page_fault+0x1e/0x30 [ 171.985259] RIP: 0033:0x40d73f [ 171.988429] RSP: 002b:0000000000a3e7b0 EFLAGS: 00010206 [ 171.993775] RAX: 00007f1abf54c000 RBX: 0000000000020000 RCX: 0000000000455a5a [ 172.001742] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 172.009005] RBP: 0000000000a3e890 R08: ffffffffffffffff R09: 0000000000000000 [ 172.016273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000a3e8a0 [ 172.023527] R13: 00007f1abf56c700 R14: 000000000072becc R15: 0000000000000000 [ 172.030786] [ 172.032394] Uninit was stored to memory at: [ 172.036721] kmsan_internal_chain_origin+0x12b/0x210 [ 172.041809] __msan_chain_origin+0x69/0xc0 [ 172.046038] __mod_timer+0x21a6/0x2c40 [ 172.049928] mod_timer+0x70/0x80 [ 172.053281] can_stat_update+0x173d/0x1870 [ 172.058147] call_timer_fn+0x26a/0x5a0 [ 172.062025] __run_timers+0xda7/0x11c0 [ 172.065906] run_timer_softirq+0x43/0x70 [ 172.069951] __do_softirq+0x56d/0x93d [ 172.073729] Local variable description: ----timer@schedule_timeout [ 172.080026] Variable was created at: [ 172.083732] schedule_timeout+0x67/0x570 [ 172.087784] rcu_gp_kthread+0x21e1/0x38d0 [ 172.091907] ================================================================== [ 172.099246] Disabling lock debugging due to kernel taint [ 172.104676] Kernel panic - not syncing: panic_on_warn set ... [ 172.104676] [ 172.112034] CPU: 1 PID: 26095 Comm: syz-executor0 Tainted: G B 4.17.0-rc5+ #101 [ 172.120774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 172.130121] Call Trace: [ 172.132684] [ 172.134822] dump_stack+0x185/0x1d0 [ 172.138448] panic+0x39d/0x940 [ 172.141641] ? __mod_timer+0x430/0x2c40 [ 172.145610] kmsan_report+0x260/0x260 [ 172.149394] __msan_warning_32+0x6e/0xc0 [ 172.153439] __mod_timer+0x430/0x2c40 [ 172.157223] ? kmsan_set_origin_inline+0x6b/0x120 [ 172.162067] mod_timer+0x70/0x80 [ 172.165438] can_stat_update+0x173d/0x1870 [ 172.169662] call_timer_fn+0x26a/0x5a0 [ 172.173549] ? can_sock_destruct+0x50/0x50 [ 172.177771] __run_timers+0xda7/0x11c0 [ 172.181640] ? can_sock_destruct+0x50/0x50 [ 172.185856] ? irq_exit+0x202/0x240 [ 172.189486] ? run_timer_softirq+0x14/0x70 [ 172.193704] ? timers_dead_cpu+0x1010/0x1010 [ 172.198096] run_timer_softirq+0x43/0x70 [ 172.202143] __do_softirq+0x56d/0x93d [ 172.205938] irq_exit+0x202/0x240 [ 172.209374] exiting_irq+0xe/0x10 [ 172.212810] smp_apic_timer_interrupt+0x64/0x90 [ 172.217463] apic_timer_interrupt+0xf/0x20 [ 172.221677] [ 172.223902] RIP: 0010:kmsan_alloc_page+0x9f/0xe0 [ 172.228637] RSP: 0000:ffff8801c3fcf840 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 172.236329] RAX: 0000000000000246 RBX: ffff8801b8d0d7c0 RCX: 0000000000000001 [ 172.243590] RDX: 0000000000000001 RSI: ffffea000aa81ca0 RDI: ffffea000aa81ca0 [ 172.250843] RBP: ffff8801c3fcf880 R08: 0000000000000000 R09: 00000000ffffffff [ 172.258098] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 172.265358] R13: 0000000000000000 R14: 00000000015080c0 R15: ffffea0009dc1b80 [ 172.272623] __alloc_pages_nodemask+0xf8e/0x5dd0 [ 172.277381] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 172.282739] ? vma_wants_writenotify+0x48c/0x6a0 [ 172.287478] ? mmap_region+0x3308/0x3730 [ 172.291521] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 172.296961] ? mmap_region+0x3310/0x3730 [ 172.301019] alloc_pages_current+0x6b5/0x970 [ 172.305422] __pmd_alloc+0xad/0x410 [ 172.309382] handle_mm_fault+0x1416/0x7e50 [ 172.313602] ? kmsan_set_origin_inline+0x6b/0x120 [ 172.318431] __do_page_fault+0xec4/0x1a10 [ 172.322568] ? page_fault+0x1e/0x30 [ 172.326185] do_page_fault+0xd3/0x260 [ 172.329980] ? page_fault+0x8/0x30 [ 172.333502] page_fault+0x1e/0x30 [ 172.336951] RIP: 0033:0x40d73f [ 172.340140] RSP: 002b:0000000000a3e7b0 EFLAGS: 00010206 [ 172.345485] RAX: 00007f1abf54c000 RBX: 0000000000020000 RCX: 0000000000455a5a [ 172.352737] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 172.359989] RBP: 0000000000a3e890 R08: ffffffffffffffff R09: 0000000000000000 [ 172.367248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000a3e8a0 [ 172.374500] R13: 00007f1abf56c700 R14: 000000000072becc R15: 0000000000000000 [ 172.382327] Dumping ftrace buffer: [ 172.385864] (ftrace buffer empty) [ 172.389576] Kernel Offset: disabled [ 172.393209] Rebooting in 86400 seconds..