INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.8' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.106844] ================================================================== [ 32.114251] BUG: KMSAN: uninit-value in tcp_v6_rcv+0x86e/0x62c0 [ 32.120296] CPU: 0 PID: 3581 Comm: syzkaller082041 Not tainted 4.16.0+ #83 [ 32.127280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.136618] Call Trace: [ 32.139174] [ 32.141303] dump_stack+0x185/0x1d0 [ 32.144907] ? tcp_v6_rcv+0x86e/0x62c0 [ 32.148785] kmsan_report+0x142/0x240 [ 32.152563] __msan_warning_32+0x6c/0xb0 [ 32.156599] tcp_v6_rcv+0x86e/0x62c0 [ 32.160294] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 32.165639] ? ip6_input_finish+0x805/0x2110 [ 32.170035] ? tcp_v6_early_demux+0xab0/0xab0 [ 32.174554] ip6_input_finish+0xa62/0x2110 [ 32.178768] ? ip6table_filter_hook+0xb5/0xe0 [ 32.183239] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 32.188579] ? ip6_input_finish+0x12a1/0x2110 [ 32.193062] ip6_input+0x294/0x320 [ 32.196582] ? ip6_input+0x320/0x320 [ 32.200274] ? ipv6_rcv+0x26d0/0x26d0 [ 32.204055] ipv6_rcv+0x20ec/0x26d0 [ 32.207676] ? local_bh_enable+0x40/0x40 [ 32.211719] __netif_receive_skb_core+0x47cf/0x4a80 [ 32.216713] ? kmsan_internal_memset_shadow_inline+0xd0/0xd0 [ 32.222489] ? ip6_rcv_finish+0x4d0/0x4d0 [ 32.226616] process_backlog+0x62d/0xe20 [ 32.230656] ? rps_trigger_softirq+0x2f0/0x2f0 [ 32.235212] net_rx_action+0x7c1/0x1a70 [ 32.239164] ? net_tx_action+0xab0/0xab0 [ 32.243202] __do_softirq+0x56d/0x93d [ 32.246985] do_softirq_own_stack+0x2a/0x40 [ 32.251278] [ 32.253492] __local_bh_enable_ip+0x114/0x140 [ 32.257963] local_bh_enable+0x36/0x40 [ 32.261832] ip6_finish_output2+0x1b6c/0x1f20 [ 32.266309] ip6_finish_output+0xb3f/0xc00 [ 32.270523] ip6_output+0x597/0x6c0 [ 32.274128] ? ip6_output+0x6c0/0x6c0 [ 32.277906] ? ac6_seq_show+0x200/0x200 [ 32.281857] ip6_local_out+0x573/0x640 [ 32.285720] ? __ip6_local_out+0x4f0/0x4f0 [ 32.289933] ip6_push_pending_frames+0x218/0x4d0 [ 32.294666] rawv6_sendmsg+0x4500/0x4cc0 [ 32.298705] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 32.304056] ? rw_copy_check_uvector+0x5af/0x6c0 [ 32.308795] ? compat_rawv6_ioctl+0x30/0x30 [ 32.313098] inet_sendmsg+0x48d/0x740 [ 32.316891] ? security_socket_sendmsg+0x9e/0x210 [ 32.321709] ? inet_getname+0x500/0x500 [ 32.325658] ___sys_sendmsg+0xec0/0x1310 [ 32.329699] ? __fdget+0x4e/0x60 [ 32.333048] ? __fget_light+0x56/0x710 [ 32.336911] ? __fdget+0x4e/0x60 [ 32.340258] ? __fget_light+0x1dc/0x710 [ 32.344210] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 32.349558] ? __fget_light+0x1f5/0x710 [ 32.353511] SYSC_sendmsg+0x2a3/0x3d0 [ 32.357291] SyS_sendmsg+0x54/0x80 [ 32.360806] do_syscall_64+0x309/0x430 [ 32.364670] ? ___sys_sendmsg+0x1310/0x1310 [ 32.368970] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 32.374136] RIP: 0033:0x440019 [ 32.377298] RSP: 002b:00007ffc59c56308 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 32.384984] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019 [ 32.392231] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 [ 32.399475] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 32.406718] R10: 00000000004002c8 R11: 0000000000000217 R12: 0000000000401940 [ 32.413962] R13: 00000000004019d0 R14: 0000000000000000 R15: 0000000000000000 [ 32.421210] [ 32.422814] Uninit was stored to memory at: [ 32.427115] kmsan_internal_chain_origin+0x12b/0x210 [ 32.432195] kmsan_memcpy_origins+0x11d/0x170 [ 32.436664] __msan_memcpy+0x19f/0x1f0 [ 32.440538] skb_copy_bits+0x63a/0xdb0 [ 32.444401] __pskb_pull_tail+0x483/0x22e0 [ 32.448609] tcp_v6_rcv+0x81f/0x62c0 [ 32.452301] ip6_input_finish+0xa62/0x2110 [ 32.456514] ip6_input+0x294/0x320 [ 32.460039] ipv6_rcv+0x20ec/0x26d0 [ 32.463651] __netif_receive_skb_core+0x47cf/0x4a80 [ 32.468640] process_backlog+0x62d/0xe20 [ 32.472679] net_rx_action+0x7c1/0x1a70 [ 32.476632] __do_softirq+0x56d/0x93d [ 32.480401] Uninit was created at: [ 32.483915] kmsan_alloc_meta_for_pages+0x161/0x3a0 [ 32.488905] kmsan_alloc_page+0x82/0xe0 [ 32.492856] __alloc_pages_nodemask+0xf5b/0x5dc0 [ 32.497588] alloc_pages_current+0x6b5/0x970 [ 32.501970] skb_page_frag_refill+0x3ba/0x5e0 [ 32.506442] sk_page_frag_refill+0xa4/0x340 [ 32.510742] __ip6_append_data+0x1a20/0x4bb0 [ 32.515129] ip6_append_data+0x40e/0x6b0 [ 32.519164] rawv6_sendmsg+0x2787/0x4cc0 [ 32.523202] inet_sendmsg+0x48d/0x740 [ 32.526985] ___sys_sendmsg+0xec0/0x1310 [ 32.531031] SYSC_sendmsg+0x2a3/0x3d0 [ 32.534816] SyS_sendmsg+0x54/0x80 [ 32.538331] do_syscall_64+0x309/0x430 [ 32.542202] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 32.547361] ================================================================== [ 32.554691] Disabling lock debugging due to kernel taint [ 32.560112] Kernel panic - not syncing: panic_on_warn set ... [ 32.560112] [ 32.567451] CPU: 0 PID: 3581 Comm: syzkaller082041 Tainted: G B 4.16.0+ #83 [ 32.575737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.585068] Call Trace: [ 32.587640] [ 32.589772] dump_stack+0x185/0x1d0 [ 32.593383] panic+0x39d/0x940 [ 32.596561] ? tcp_v6_rcv+0x86e/0x62c0 [ 32.600427] kmsan_report+0x238/0x240 [ 32.604205] __msan_warning_32+0x6c/0xb0 [ 32.608243] tcp_v6_rcv+0x86e/0x62c0 [ 32.611933] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 32.617283] ? ip6_input_finish+0x805/0x2110 [ 32.621674] ? tcp_v6_early_demux+0xab0/0xab0 [ 32.626156] ip6_input_finish+0xa62/0x2110 [ 32.630372] ? ip6table_filter_hook+0xb5/0xe0 [ 32.634851] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 32.640197] ? ip6_input_finish+0x12a1/0x2110 [ 32.644667] ip6_input+0x294/0x320 [ 32.648183] ? ip6_input+0x320/0x320 [ 32.651872] ? ipv6_rcv+0x26d0/0x26d0 [ 32.655661] ipv6_rcv+0x20ec/0x26d0 [ 32.659266] ? local_bh_enable+0x40/0x40 [ 32.663326] __netif_receive_skb_core+0x47cf/0x4a80 [ 32.668321] ? kmsan_internal_memset_shadow_inline+0xd0/0xd0 [ 32.674104] ? ip6_rcv_finish+0x4d0/0x4d0 [ 32.678228] process_backlog+0x62d/0xe20 [ 32.682270] ? rps_trigger_softirq+0x2f0/0x2f0 [ 32.686826] net_rx_action+0x7c1/0x1a70 [ 32.690778] ? net_tx_action+0xab0/0xab0 [ 32.694817] __do_softirq+0x56d/0x93d [ 32.698920] do_softirq_own_stack+0x2a/0x40 [ 32.703212] [ 32.705426] __local_bh_enable_ip+0x114/0x140 [ 32.709900] local_bh_enable+0x36/0x40 [ 32.713768] ip6_finish_output2+0x1b6c/0x1f20 [ 32.718244] ip6_finish_output+0xb3f/0xc00 [ 32.722458] ip6_output+0x597/0x6c0 [ 32.726067] ? ip6_output+0x6c0/0x6c0 [ 32.729844] ? ac6_seq_show+0x200/0x200 [ 32.733797] ip6_local_out+0x573/0x640 [ 32.737676] ? __ip6_local_out+0x4f0/0x4f0 [ 32.741918] ip6_push_pending_frames+0x218/0x4d0 [ 32.746676] rawv6_sendmsg+0x4500/0x4cc0 [ 32.750739] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 32.756092] ? rw_copy_check_uvector+0x5af/0x6c0 [ 32.760837] ? compat_rawv6_ioctl+0x30/0x30 [ 32.765134] inet_sendmsg+0x48d/0x740 [ 32.768913] ? security_socket_sendmsg+0x9e/0x210 [ 32.773731] ? inet_getname+0x500/0x500 [ 32.777682] ___sys_sendmsg+0xec0/0x1310 [ 32.781742] ? __fdget+0x4e/0x60 [ 32.785084] ? __fget_light+0x56/0x710 [ 32.788945] ? __fdget+0x4e/0x60 [ 32.792295] ? __fget_light+0x1dc/0x710 [ 32.796262] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 32.801616] ? __fget_light+0x1f5/0x710 [ 32.805570] SYSC_sendmsg+0x2a3/0x3d0 [ 32.809349] SyS_sendmsg+0x54/0x80 [ 32.812866] do_syscall_64+0x309/0x430 [ 32.816732] ? ___sys_sendmsg+0x1310/0x1310 [ 32.821046] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 32.826217] RIP: 0033:0x440019 [ 32.829381] RSP: 002b:00007ffc59c56308 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 32.837066] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019 [ 32.844311] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 [ 32.851556] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 32.858801] R10: 00000000004002c8 R11: 0000000000000217 R12: 0000000000401940 [ 32.866054] R13: 00000000004019d0 R14: 0000000000000000 R15: 0000000000000000 [ 32.873749] Dumping ftrace buffer: [ 32.877263] (ftrace buffer empty) [ 32.880946] Kernel Offset: disabled [ 32.884545] Rebooting in 86400 seconds..