[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 118.193045][ T33] audit: type=1800 audit(1582345571.254:25): pid=11746 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 118.234349][ T33] audit: type=1800 audit(1582345571.284:26): pid=11746 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 118.259351][ T33] audit: type=1800 audit(1582345571.294:27): pid=11746 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 121.749342][T11883] sshd (11883) used greatest stack depth: 3904 bytes left Warning: Permanently added '10.128.10.47' (ECDSA) to the list of known hosts. executing program [ 130.105522][T11897] ===================================================== [ 130.105527][T11897] BUG: KMSAN: uninit-value in number+0x9f8/0x2000 [ 130.105531][T11897] CPU: 1 PID: 11897 Comm: syz-executor136 Not tainted 5.6.0-rc2-syzkaller #0 [ 130.105536][T11897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 130.105538][T11897] Call Trace: [ 130.105541][T11897] dump_stack+0x1c9/0x220 [ 130.105544][T11897] kmsan_report+0xf7/0x1e0 [ 130.105546][T11897] __msan_warning+0x58/0xa0 [ 130.105549][T11897] number+0x9f8/0x2000 [ 130.105552][T11897] ? __msan_poison_alloca+0xf0/0x120 [ 130.105555][T11897] vsnprintf+0x1d85/0x31b0 [ 130.105558][T11897] ? sock_alloc_send_pskb+0xada/0xc60 [ 130.105560][T11897] vscnprintf+0xc2/0x180 [ 130.105563][T11897] vprintk_store+0xef/0x11d0 [ 130.105566][T11897] ? kmsan_get_metadata+0x11d/0x180 [ 130.105569][T11897] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 130.105572][T11897] ? kmsan_get_metadata+0x11d/0x180 [ 130.105575][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105577][T11897] vprintk_emit+0x2c0/0x860 [ 130.105580][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105583][T11897] vprintk_default+0x90/0xa0 [ 130.105586][T11897] vprintk_func+0x636/0x820 [ 130.105588][T11897] ? __msan_poison_alloca+0xf0/0x120 [ 130.105591][T11897] ? kmsan_get_metadata+0x4f/0x180 [ 130.105594][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105597][T11897] printk+0x18b/0x1d3 [ 130.105600][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105602][T11897] canfd_rcv+0x370/0x3a0 [ 130.105605][T11897] netif_receive_skb+0xe77/0xf20 [ 130.105608][T11897] ? __msan_poison_alloca+0xf0/0x120 [ 130.105611][T11897] ? can_proto_unregister+0x180/0x180 [ 130.105614][T11897] tun_get_user+0x6aef/0x6f60 [ 130.105617][T11897] ? kmsan_get_metadata+0x11d/0x180 [ 130.105619][T11897] tun_chr_write_iter+0x1f2/0x360 [ 130.105622][T11897] ? tun_chr_read_iter+0x460/0x460 [ 130.105625][T11897] __vfs_write+0xa5a/0xca0 [ 130.105627][T11897] vfs_write+0x44a/0x8f0 [ 130.105630][T11897] ksys_write+0x267/0x450 [ 130.105633][T11897] __se_sys_write+0x92/0xb0 [ 130.105635][T11897] __x64_sys_write+0x4a/0x70 [ 130.105638][T11897] do_syscall_64+0xb8/0x160 [ 130.105641][T11897] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.105643][T11897] RIP: 0033:0x440239 [ 130.105651][T11897] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 130.105654][T11897] RSP: 002b:00007ffd3d6d1f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.105661][T11897] RAX: ffffffffffffffda RBX: 0000000000003172 RCX: 0000000000440239 [ 130.105664][T11897] RDX: 0000000000000004 RSI: 0000000020000200 RDI: 0000000000000003 [ 130.105668][T11897] RBP: 656c6c616b7a7973 R08: 0000000000401ac0 R09: 0000000000401ac0 [ 130.105672][T11897] R10: 0000000000401ac0 R11: 0000000000000246 R12: 0000000000401ac0 [ 130.105676][T11897] R13: 0000000000401b50 R14: 0000000000000000 R15: 0000000000000000 [ 130.105678][T11897] [ 130.105680][T11897] Uninit was created at: [ 130.105683][T11897] kmsan_internal_poison_shadow+0x66/0xd0 [ 130.105686][T11897] kmsan_slab_alloc+0x8a/0xe0 [ 130.105689][T11897] __kmalloc_node_track_caller+0xb40/0x1200 [ 130.105692][T11897] __alloc_skb+0x2fd/0xac0 [ 130.105694][T11897] alloc_skb_with_frags+0x18c/0xa70 [ 130.105697][T11897] sock_alloc_send_pskb+0xada/0xc60 [ 130.105700][T11897] tun_get_user+0x10ae/0x6f60 [ 130.105703][T11897] tun_chr_write_iter+0x1f2/0x360 [ 130.105706][T11897] __vfs_write+0xa5a/0xca0 [ 130.105708][T11897] vfs_write+0x44a/0x8f0 [ 130.105711][T11897] ksys_write+0x267/0x450 [ 130.105713][T11897] __se_sys_write+0x92/0xb0 [ 130.105716][T11897] __x64_sys_write+0x4a/0x70 [ 130.105719][T11897] do_syscall_64+0xb8/0x160 [ 130.105722][T11897] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.105725][T11897] ===================================================== [ 130.105729][T11897] Disabling lock debugging due to kernel taint [ 130.105732][T11897] Kernel panic - not syncing: panic_on_warn set ... [ 130.105737][T11897] CPU: 1 PID: 11897 Comm: syz-executor136 Tainted: G B 5.6.0-rc2-syzkaller #0 [ 130.105741][T11897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 130.105743][T11897] Call Trace: [ 130.105746][T11897] dump_stack+0x1c9/0x220 [ 130.105748][T11897] panic+0x3d5/0xc3e [ 130.105751][T11897] kmsan_report+0x1df/0x1e0 [ 130.105754][T11897] __msan_warning+0x58/0xa0 [ 130.105756][T11897] number+0x9f8/0x2000 [ 130.105759][T11897] ? __msan_poison_alloca+0xf0/0x120 [ 130.105761][T11897] vsnprintf+0x1d85/0x31b0 [ 130.105764][T11897] ? sock_alloc_send_pskb+0xada/0xc60 [ 130.105767][T11897] vscnprintf+0xc2/0x180 [ 130.105769][T11897] vprintk_store+0xef/0x11d0 [ 130.105772][T11897] ? kmsan_get_metadata+0x11d/0x180 [ 130.105775][T11897] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 130.105778][T11897] ? kmsan_get_metadata+0x11d/0x180 [ 130.105781][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105784][T11897] vprintk_emit+0x2c0/0x860 [ 130.105787][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105790][T11897] vprintk_default+0x90/0xa0 [ 130.105792][T11897] vprintk_func+0x636/0x820 [ 130.105795][T11897] ? __msan_poison_alloca+0xf0/0x120 [ 130.105798][T11897] ? kmsan_get_metadata+0x4f/0x180 [ 130.105801][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105803][T11897] printk+0x18b/0x1d3 [ 130.105806][T11897] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 130.105809][T11897] canfd_rcv+0x370/0x3a0 [ 130.105812][T11897] netif_receive_skb+0xe77/0xf20 [ 130.105815][T11897] ? __msan_poison_alloca+0xf0/0x120 [ 130.105817][T11897] ? can_proto_unregister+0x180/0x180 [ 130.105820][T11897] tun_get_user+0x6aef/0x6f60 [ 130.105823][T11897] ? kmsan_get_metadata+0x11d/0x180 [ 130.105826][T11897] tun_chr_write_iter+0x1f2/0x360 [ 130.105829][T11897] ? tun_chr_read_iter+0x460/0x460 [ 130.105831][T11897] __vfs_write+0xa5a/0xca0 [ 130.105834][T11897] vfs_write+0x44a/0x8f0 [ 130.105836][T11897] ksys_write+0x267/0x450 [ 130.105839][T11897] __se_sys_write+0x92/0xb0 [ 130.105841][T11897] __x64_sys_write+0x4a/0x70 [ 130.105844][T11897] do_syscall_64+0xb8/0x160 [ 130.105847][T11897] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.105850][T11897] RIP: 0033:0x440239 [ 130.105857][T11897] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 130.105860][T11897] RSP: 002b:00007ffd3d6d1f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 130.105866][T11897] RAX: ffffffffffffffda RBX: 0000000000003172 RCX: 0000000000440239 [ 130.105870][T11897] RDX: 0000000000000004 RSI: 0000000020000200 RDI: 0000000000000003 [ 130.105874][T11897] RBP: 656c6c616b7a7973 R08: 0000000000401ac0 R09: 0000000000401ac0 [ 130.105878][T11897] R10: 0000000000401ac0 R11: 0000000000000246 R12: 0000000000401ac0 [ 130.105881][T11897] R13: 0000000000401b50 R14: 0000000000000000 R15: 0000000000000000 [ 130.105886][T11897] Kernel Offset: 0x1c000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)