INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.52' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 52.655831] ================================================================== [ 52.663255] BUG: KMSAN: uninit-value in _copy_to_iter+0x46d/0x28f0 [ 52.669557] CPU: 1 PID: 4516 Comm: syz-executor879 Not tainted 4.16.0+ #87 [ 52.676892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.686241] Call Trace: [ 52.688809] dump_stack+0x185/0x1d0 [ 52.692638] ? kmsan_internal_check_memory+0x116/0x1e0 [ 52.697892] kmsan_report+0x142/0x240 [ 52.701671] kmsan_internal_check_memory+0x135/0x1e0 [ 52.706769] kmsan_copy_to_user+0x69/0x160 [ 52.711076] ? _copy_to_iter+0x95/0x28f0 [ 52.715234] _copy_to_iter+0x46d/0x28f0 [ 52.719191] ? finish_wait+0x10a/0x3e0 [ 52.723075] vhost_chr_read_iter+0x7ac/0xc50 [ 52.727489] ? init_wait_entry+0x1a0/0x1a0 [ 52.731813] vhost_net_chr_read_iter+0xf6/0x130 [ 52.736474] ? vhost_net_exit+0x30/0x30 [ 52.740446] aio_read+0x5c1/0x6f0 [ 52.743883] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 52.749514] ? fget+0x41b/0x460 [ 52.752861] do_io_submit+0x1bb4/0x2f60 [ 52.756813] ? kmsan_set_origin_inline+0x6b/0x120 [ 52.761905] SYSC_io_submit+0x98/0xb0 [ 52.765781] SyS_io_submit+0x56/0x80 [ 52.769481] do_syscall_64+0x309/0x430 [ 52.773377] ? SYSC_io_destroy+0x390/0x390 [ 52.777768] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 52.782936] RIP: 0033:0x4457b9 [ 52.786189] RSP: 002b:00007ff9343e4da8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d1 [ 52.793871] RAX: ffffffffffffffda RBX: 00000000006dac44 RCX: 00000000004457b9 [ 52.801118] RDX: 00000000200001c0 RSI: 0000000000000001 RDI: 00007ff93439a000 [ 52.808374] RBP: 00000000006dac40 R08: 0000000000000000 R09: 0000000000000000 [ 52.815629] R10: 0000000000000000 R11: 0000000000000293 R12: 901aeeff3a98f9ab [ 52.822963] R13: 98c94b26f489688e R14: ae1b2dfa3c87200a R15: 0000000000000001 [ 52.830868] [ 52.832474] Uninit was created at: [ 52.836351] kmsan_internal_poison_shadow+0xb8/0x1b0 [ 52.841516] kmsan_kmalloc+0x94/0x100 [ 52.845294] __kmalloc+0x23c/0x350 [ 52.848968] translate_desc+0xbef/0x1120 [ 52.853105] vhost_update_used_flags+0x469/0x8d0 [ 52.858119] vhost_vq_init_access+0x173/0xa20 [ 52.862603] vhost_net_ioctl+0x22b0/0x3480 [ 52.866815] do_vfs_ioctl+0xaf0/0x2440 [ 52.870689] SYSC_ioctl+0x1d2/0x260 [ 52.874827] SyS_ioctl+0x54/0x80 [ 52.878209] do_syscall_64+0x309/0x430 [ 52.882699] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 52.888122] [ 52.889739] Bytes 4-7 of 72 are uninitialized [ 52.894842] ================================================================== [ 52.902264] Disabling lock debugging due to kernel taint [ 52.907691] Kernel panic - not syncing: panic_on_warn set ... [ 52.907691] [ 52.915033] CPU: 1 PID: 4516 Comm: syz-executor879 Tainted: G B 4.16.0+ #87 [ 52.923330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.932669] Call Trace: [ 52.935254] dump_stack+0x185/0x1d0 [ 52.939463] panic+0x39d/0x940 [ 52.942643] ? kmsan_internal_check_memory+0x116/0x1e0 [ 52.947895] kmsan_report+0x238/0x240 [ 52.951681] kmsan_internal_check_memory+0x135/0x1e0 [ 52.956759] kmsan_copy_to_user+0x69/0x160 [ 52.960972] ? _copy_to_iter+0x95/0x28f0 [ 52.965013] _copy_to_iter+0x46d/0x28f0 [ 52.968963] ? finish_wait+0x10a/0x3e0 [ 52.972835] vhost_chr_read_iter+0x7ac/0xc50 [ 52.977397] ? init_wait_entry+0x1a0/0x1a0 [ 52.981612] vhost_net_chr_read_iter+0xf6/0x130 [ 52.986487] ? vhost_net_exit+0x30/0x30 [ 52.991154] aio_read+0x5c1/0x6f0 [ 52.994599] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 53.001611] ? fget+0x41b/0x460 [ 53.005141] do_io_submit+0x1bb4/0x2f60 [ 53.009135] ? kmsan_set_origin_inline+0x6b/0x120 [ 53.014006] SYSC_io_submit+0x98/0xb0 [ 53.017790] SyS_io_submit+0x56/0x80 [ 53.021583] do_syscall_64+0x309/0x430 [ 53.025583] ? SYSC_io_destroy+0x390/0x390 [ 53.029860] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 53.035128] RIP: 0033:0x4457b9 [ 53.038479] RSP: 002b:00007ff9343e4da8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d1 [ 53.046175] RAX: ffffffffffffffda RBX: 00000000006dac44 RCX: 00000000004457b9 [ 53.053437] RDX: 00000000200001c0 RSI: 0000000000000001 RDI: 00007ff93439a000 [ 53.060801] RBP: 00000000006dac40 R08: 0000000000000000 R09: 0000000000000000 [ 53.068331] R10: 0000000000000000 R11: 0000000000000293 R12: 901aeeff3a98f9ab [ 53.075850] R13: 98c94b26f489688e R14: ae1b2dfa3c87200a R15: 0000000000000001 [ 53.083628] Dumping ftrace buffer: [ 53.087142] (ftrace buffer empty) [ 53.090828] Kernel Offset: disabled [ 53.094435] Rebooting in 86400 seconds..