[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 67.288286] audit: type=1800 audit(1546161582.338:25): pid=9047 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 67.307503] audit: type=1800 audit(1546161582.338:26): pid=9047 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 67.326864] audit: type=1800 audit(1546161582.338:27): pid=9047 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.237' (ECDSA) to the list of known hosts. 2018/12/30 09:19:57 fuzzer started 2018/12/30 09:20:01 dialing manager at 10.128.0.26:41469 2018/12/30 09:20:01 syscalls: 1 2018/12/30 09:20:01 code coverage: enabled 2018/12/30 09:20:01 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/12/30 09:20:01 setuid sandbox: enabled 2018/12/30 09:20:01 namespace sandbox: enabled 2018/12/30 09:20:01 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/30 09:20:01 fault injection: enabled 2018/12/30 09:20:01 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/30 09:20:01 net packet injection: enabled 2018/12/30 09:20:01 net device setup: enabled 09:20:04 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x4) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000002ac0)=0x1000, 0x4) sendto$inet6(r0, &(0x7f0000000000), 0xffa7, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0x0, 0x8}}, 0x1c) syzkaller login: [ 89.823331] IPVS: ftp: loaded support on port[0] = 21 [ 89.945768] chnl_net:caif_netlink_parms(): no params data found [ 90.006875] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.013522] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.021728] device bridge_slave_0 entered promiscuous mode [ 90.030933] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.037504] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.045651] device bridge_slave_1 entered promiscuous mode [ 90.075120] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 90.085758] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 90.113193] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 90.121385] team0: Port device team_slave_0 added [ 90.128404] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 90.136721] team0: Port device team_slave_1 added [ 90.143629] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 90.151872] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 90.415502] device hsr_slave_0 entered promiscuous mode [ 90.572133] device hsr_slave_1 entered promiscuous mode [ 90.832712] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 90.840863] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 90.866134] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.872692] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.879713] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.886276] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.958642] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 90.964878] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.977758] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 90.987816] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.996480] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.013827] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 91.029694] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 91.036580] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 91.044129] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 91.056712] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 91.063446] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.074788] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 91.082947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 91.091651] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 91.099625] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.106165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.119561] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 91.131137] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 91.139414] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 91.148382] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 91.156527] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.163072] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.170612] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 91.185730] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 91.197299] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 91.209369] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 91.216803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 91.226007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 91.234897] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 91.243412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 91.252256] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 91.265763] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 91.277665] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 91.287621] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 91.297436] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 91.309225] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 91.315817] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 91.323629] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 91.332144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 91.340590] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 91.348917] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 91.358743] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 91.379275] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 91.397328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.441670] ================================================================== [ 91.449140] BUG: KMSAN: uninit-value in send_hsr_supervision_frame+0x1056/0x1510 [ 91.456700] CPU: 0 PID: 9200 Comm: syz-fuzzer Not tainted 4.20.0-rc7+ #16 [ 91.463607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.472942] Call Trace: [ 91.475509] [ 91.477652] dump_stack+0x173/0x1d0 [ 91.481273] kmsan_report+0x12e/0x2a0 [ 91.485065] __msan_warning+0x82/0xf0 [ 91.488858] send_hsr_supervision_frame+0x1056/0x1510 [ 91.494046] hsr_announce+0x14c/0x3a0 [ 91.497844] call_timer_fn+0x285/0x600 [ 91.501715] ? hsr_dev_finalize+0xb90/0xb90 [ 91.506038] __run_timers+0xdb4/0x11d0 [ 91.509922] ? hsr_dev_finalize+0xb90/0xb90 [ 91.514238] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 91.519757] ? irqtime_account_irq+0xcf/0x2e0 [ 91.524249] ? timers_dead_cpu+0xa50/0xa50 [ 91.528473] run_timer_softirq+0x2e/0x50 [ 91.532523] __do_softirq+0x53f/0x93a [ 91.536322] irq_exit+0x214/0x250 [ 91.539761] exiting_irq+0xe/0x10 [ 91.543198] smp_apic_timer_interrupt+0x48/0x70 [ 91.547863] apic_timer_interrupt+0x2e/0x40 [ 91.552174] [ 91.554441] RIP: 0010:kmsan_get_shadow_origin_ptr+0x0/0x3e0 [ 91.560149] Code: c0 e8 94 23 7c ff 0f 0b 66 90 55 48 89 e5 31 d2 31 c9 e8 f3 f4 ff ff 5d c3 90 b0 01 c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 50 49 89 fe 48 81 fe 01 10 [ 91.579042] RSP: 0018:ffff88808106ed28 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 91.586738] RAX: ffffffff84332c47 RBX: 0000000000000000 RCX: ffff8880ae7d9e00 [ 91.593991] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88808106ef70 [ 91.601245] RBP: ffff88808106ed30 R08: ffff88808106f040 R09: 0000000000000000 [ 91.608511] R10: 0000000000000000 R11: 00000000790f424b R12: 0000000000000030 [ 91.615767] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 91.623058] ? sha256_generic_block_fn+0x1a7/0xab60 [ 91.628095] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 91.633543] sha256_generic_block_fn+0x1bb/0xab60 [ 91.638423] crypto_sha256_update+0x35f/0x3b0 [ 91.642907] ? sha1_base_init+0x180/0x180 [ 91.647047] crypto_shash_update+0x484/0x4f0 [ 91.651449] ? integrity_kernel_read+0x221/0x280 [ 91.656207] ima_calc_file_hash+0x25ca/0x2ca0 [ 91.660714] ? ext4_xattr_ibody_get+0x1a0/0x1290 [ 91.665468] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 91.670826] ? ext4_xattr_get+0xcd0/0xff0 [ 91.674971] ? __msan_poison_alloca+0x1f0/0x2a0 [ 91.679636] ima_collect_measurement+0x48d/0x980 [ 91.684394] process_measurement+0x1b37/0x2740 [ 91.688980] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 91.694326] ? refcount_dec_and_test_checked+0x1e8/0x2c0 [ 91.699769] ? apparmor_task_getsecid+0x172/0x190 [ 91.704599] ? apparmor_task_alloc+0x300/0x300 [ 91.709169] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 91.714518] ? security_task_getsecid+0x17f/0x190 [ 91.719364] ima_file_check+0x131/0x170 [ 91.723337] path_openat+0x4af5/0x6b90 [ 91.727230] ? rb_erase_cached+0xde8/0x2c00 [ 91.731564] ? expand_files+0x5d/0xcf0 [ 91.735447] ? do_sys_open+0x640/0x960 [ 91.739319] do_filp_open+0x2b8/0x710 [ 91.743135] do_sys_open+0x640/0x960 [ 91.746843] __se_sys_openat+0xcb/0xe0 [ 91.750720] __x64_sys_openat+0x56/0x70 [ 91.754681] do_syscall_64+0xbc/0xf0 [ 91.758382] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 91.763656] RIP: 0033:0x47fcba [ 91.766850] Code: e8 2b 41 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 4c 8b 54 24 28 4c 8b 44 24 30 4c 8b 4c 24 38 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 40 ff ff ff ff 48 c7 44 24 48 [ 91.785740] RSP: 002b:000000c4203577e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000101 [ 91.793435] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fcba [ 91.800691] RDX: 0000000000080002 RSI: 000000c4200122a0 RDI: ffffffffffffff9c [ 91.807946] RBP: 000000c420357868 R08: 0000000000000000 R09: 0000000000000000 [ 91.815213] R10: 00000000000001a4 R11: 0000000000000212 R12: 0000000000000000 [ 91.822476] R13: 00000000000000f5 R14: 0000000000000075 R15: 0000000000000004 [ 91.829739] [ 91.831348] Uninit was created at: [ 91.834965] kmsan_save_stack_with_flags+0x7a/0x130 [ 91.839965] kmsan_internal_alloc_meta_for_pages+0x113/0x580 [ 91.845744] kmsan_alloc_page+0x7e/0x100 [ 91.849787] __alloc_pages_nodemask+0x1587/0x5f20 [ 91.854615] page_frag_alloc+0x3c1/0x980 [ 91.858677] __netdev_alloc_skb+0x1f1/0xa50 [ 91.862985] send_hsr_supervision_frame+0x168/0x1510 [ 91.868070] hsr_announce+0x14c/0x3a0 [ 91.871866] call_timer_fn+0x285/0x600 [ 91.875738] __run_timers+0xdb4/0x11d0 [ 91.879609] run_timer_softirq+0x2e/0x50 [ 91.883657] __do_softirq+0x53f/0x93a [ 91.887436] ================================================================== [ 91.894771] Disabling lock debugging due to kernel taint [ 91.900282] Kernel panic - not syncing: panic_on_warn set ... [ 91.906330] CPU: 0 PID: 9200 Comm: syz-fuzzer Tainted: G B 4.20.0-rc7+ #16 [ 91.914626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.923973] Call Trace: [ 91.926542] [ 91.928689] dump_stack+0x173/0x1d0 [ 91.932308] panic+0x3ce/0x961 [ 91.935502] kmsan_report+0x293/0x2a0 [ 91.939306] __msan_warning+0x82/0xf0 [ 91.943102] send_hsr_supervision_frame+0x1056/0x1510 [ 91.948288] hsr_announce+0x14c/0x3a0 [ 91.952091] call_timer_fn+0x285/0x600 [ 91.955971] ? hsr_dev_finalize+0xb90/0xb90 [ 91.960282] __run_timers+0xdb4/0x11d0 [ 91.964154] ? hsr_dev_finalize+0xb90/0xb90 [ 91.968471] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 91.973905] ? irqtime_account_irq+0xcf/0x2e0 [ 91.978385] ? timers_dead_cpu+0xa50/0xa50 [ 91.982605] run_timer_softirq+0x2e/0x50 [ 91.986651] __do_softirq+0x53f/0x93a [ 91.990463] irq_exit+0x214/0x250 [ 91.993906] exiting_irq+0xe/0x10 [ 91.997343] smp_apic_timer_interrupt+0x48/0x70 [ 92.001997] apic_timer_interrupt+0x2e/0x40 [ 92.006299] [ 92.008612] RIP: 0010:kmsan_get_shadow_origin_ptr+0x0/0x3e0 [ 92.014326] Code: c0 e8 94 23 7c ff 0f 0b 66 90 55 48 89 e5 31 d2 31 c9 e8 f3 f4 ff ff 5d c3 90 b0 01 c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 50 49 89 fe 48 81 fe 01 10 [ 92.033333] RSP: 0018:ffff88808106ed28 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 92.041035] RAX: ffffffff84332c47 RBX: 0000000000000000 RCX: ffff8880ae7d9e00 [ 92.048289] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88808106ef70 [ 92.055550] RBP: ffff88808106ed30 R08: ffff88808106f040 R09: 0000000000000000 [ 92.062809] R10: 0000000000000000 R11: 00000000790f424b R12: 0000000000000030 [ 92.070060] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 92.077330] ? sha256_generic_block_fn+0x1a7/0xab60 [ 92.082348] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 92.094622] sha256_generic_block_fn+0x1bb/0xab60 [ 92.099497] crypto_sha256_update+0x35f/0x3b0 [ 92.103984] ? sha1_base_init+0x180/0x180 [ 92.108116] crypto_shash_update+0x484/0x4f0 [ 92.112522] ? integrity_kernel_read+0x221/0x280 [ 92.117278] ima_calc_file_hash+0x25ca/0x2ca0 [ 92.121766] ? ext4_xattr_ibody_get+0x1a0/0x1290 [ 92.126522] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 92.131907] ? ext4_xattr_get+0xcd0/0xff0 [ 92.136059] ? __msan_poison_alloca+0x1f0/0x2a0 [ 92.140721] ima_collect_measurement+0x48d/0x980 [ 92.145477] process_measurement+0x1b37/0x2740 [ 92.150063] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 92.155415] ? refcount_dec_and_test_checked+0x1e8/0x2c0 [ 92.160940] ? apparmor_task_getsecid+0x172/0x190 [ 92.165770] ? apparmor_task_alloc+0x300/0x300 [ 92.170338] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 92.175704] ? security_task_getsecid+0x17f/0x190 [ 92.180541] ima_file_check+0x131/0x170 [ 92.184517] path_openat+0x4af5/0x6b90 [ 92.188394] ? rb_erase_cached+0xde8/0x2c00 [ 92.192718] ? expand_files+0x5d/0xcf0 [ 92.196602] ? do_sys_open+0x640/0x960 [ 92.200479] do_filp_open+0x2b8/0x710 [ 92.204280] do_sys_open+0x640/0x960 [ 92.208009] __se_sys_openat+0xcb/0xe0 [ 92.211888] __x64_sys_openat+0x56/0x70 [ 92.215849] do_syscall_64+0xbc/0xf0 [ 92.219565] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 92.224741] RIP: 0033:0x47fcba [ 92.227922] Code: e8 2b 41 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 4c 8b 54 24 28 4c 8b 44 24 30 4c 8b 4c 24 38 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 40 ff ff ff ff 48 c7 44 24 48 [ 92.246807] RSP: 002b:000000c4203577e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000101 [ 92.254499] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fcba [ 92.261758] RDX: 0000000000080002 RSI: 000000c4200122a0 RDI: ffffffffffffff9c [ 92.269008] RBP: 000000c420357868 R08: 0000000000000000 R09: 0000000000000000 [ 92.276269] R10: 00000000000001a4 R11: 0000000000000212 R12: 0000000000000000 [ 92.283524] R13: 00000000000000f5 R14: 0000000000000075 R15: 0000000000000004 [ 92.291945] Kernel Offset: disabled [ 92.295577] Rebooting in 86400 seconds..