[ 54.547028] audit: type=1800 audit(1541565174.601:25): pid=6122 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 54.567127] audit: type=1800 audit(1541565174.611:26): pid=6122 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 54.587248] audit: type=1800 audit(1541565174.631:27): pid=6122 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 54.606866] audit: type=1800 audit(1541565174.651:28): pid=6122 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.72' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 66.153145] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 66.202313] ================================================================== [ 66.209707] BUG: KMSAN: kernel-infoleak in kvm_write_guest_page+0x373/0x500 [ 66.216799] CPU: 1 PID: 6274 Comm: syz-executor149 Not tainted 4.19.0+ #78 [ 66.223797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.233135] Call Trace: [ 66.235714] dump_stack+0x32d/0x480 [ 66.239329] ? kvm_write_guest_page+0x373/0x500 [ 66.243995] kmsan_report+0x19f/0x300 [ 66.248105] kmsan_internal_check_memory+0x35f/0x450 [ 66.253199] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 66.258647] kmsan_copy_to_user+0x7c/0xe0 [ 66.262792] kvm_write_guest_page+0x373/0x500 [ 66.267283] kvm_write_guest+0x1e1/0x360 [ 66.271343] kvm_emulate_hypercall+0x1c96/0x21b0 [ 66.276133] handle_vmcall+0x41/0x50 [ 66.279834] ? handle_rdpmc+0x80/0x80 [ 66.283622] vmx_handle_exit+0x1e81/0xbac0 [ 66.287847] ? vmalloc_to_page+0x585/0x6c0 [ 66.292077] ? kmsan_get_shadow_origin_ptr+0x142/0x410 [ 66.297355] ? vmx_flush_tlb_gva+0x4b0/0x4b0 [ 66.301758] kvm_arch_vcpu_ioctl_run+0xac32/0x11d80 [ 66.306813] ? __msan_poison_alloca+0x1e0/0x2b0 [ 66.311476] ? __msan_get_context_state+0x9/0x30 [ 66.316224] ? INIT_INT+0xc/0x30 [ 66.319577] ? kfree+0x1d7/0x2f20 [ 66.323029] ? kmsan_set_origin+0x83/0x130 [ 66.327252] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 66.332611] ? __msan_get_context_state+0x9/0x30 [ 66.337357] ? INIT_BOOL+0xc/0x30 [ 66.340799] ? mutex_lock_killable+0x2f7/0x450 [ 66.345378] kvm_vcpu_ioctl+0xfb1/0x1f90 [ 66.349778] ? do_vfs_ioctl+0x187/0x2d30 [ 66.353834] ? kvm_vm_release+0x90/0x90 [ 66.357793] do_vfs_ioctl+0xf77/0x2d30 [ 66.361699] ? __msan_poison_alloca+0x1e0/0x2b0 [ 66.366369] ? security_file_ioctl+0x92/0x200 [ 66.370855] __se_sys_ioctl+0x1da/0x270 [ 66.374822] __x64_sys_ioctl+0x4a/0x70 [ 66.378697] do_syscall_64+0xcf/0x110 [ 66.382512] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 66.387705] RIP: 0033:0x442b39 [ 66.390889] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0c fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 66.409779] RSP: 002b:00007ffcb4e05478 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ 66.417949] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000442b39 [ 66.425208] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 66.432464] RBP: 00000000006cd018 R08: 0000000020000100 R09: 0000000020000100 [ 66.439726] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000403be0 [ 66.446983] R13: 0000000000403c70 R14: 0000000000000000 R15: 0000000000000000 [ 66.454246] [ 66.455857] Local variable description: ----clock_pairing.i@kvm_emulate_hypercall [ 66.463571] Variable was created at: [ 66.467634] kvm_emulate_hypercall+0x60/0x21b0 [ 66.472206] handle_vmcall+0x41/0x50 [ 66.475902] [ 66.477515] Bytes 28-63 of 64 are uninitialized [ 66.482168] Memory access of size 64 starts at ffff8801aac5f3d8 [ 66.488221] Data copied to user address 0000000020000000 [ 66.493651] ================================================================== [ 66.501005] Disabling lock debugging due to kernel taint [ 66.506446] Kernel panic - not syncing: panic_on_warn set ... [ 66.506446] [ 66.513812] CPU: 1 PID: 6274 Comm: syz-executor149 Tainted: G B 4.19.0+ #78 [ 66.522199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.531547] Call Trace: [ 66.534142] dump_stack+0x32d/0x480 [ 66.537766] panic+0x57e/0xb28 [ 66.540965] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 66.546412] kmsan_report+0x300/0x300 [ 66.550205] kmsan_internal_check_memory+0x35f/0x450 [ 66.555401] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 66.560845] kmsan_copy_to_user+0x7c/0xe0 [ 66.564998] kvm_write_guest_page+0x373/0x500 [ 66.569498] kvm_write_guest+0x1e1/0x360 [ 66.573572] kvm_emulate_hypercall+0x1c96/0x21b0 [ 66.578337] handle_vmcall+0x41/0x50 [ 66.582041] ? handle_rdpmc+0x80/0x80 [ 66.585832] vmx_handle_exit+0x1e81/0xbac0 [ 66.590061] ? vmalloc_to_page+0x585/0x6c0 [ 66.594659] ? kmsan_get_shadow_origin_ptr+0x142/0x410 [ 66.599936] ? vmx_flush_tlb_gva+0x4b0/0x4b0 [ 66.604336] kvm_arch_vcpu_ioctl_run+0xac32/0x11d80 [ 66.609408] ? __msan_poison_alloca+0x1e0/0x2b0 [ 66.614076] ? __msan_get_context_state+0x9/0x30 [ 66.618820] ? INIT_INT+0xc/0x30 [ 66.622181] ? kfree+0x1d7/0x2f20 [ 66.625625] ? kmsan_set_origin+0x83/0x130 [ 66.629848] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 66.635238] ? __msan_get_context_state+0x9/0x30 [ 66.639990] ? INIT_BOOL+0xc/0x30 [ 66.643453] ? mutex_lock_killable+0x2f7/0x450 [ 66.648042] kvm_vcpu_ioctl+0xfb1/0x1f90 [ 66.652098] ? do_vfs_ioctl+0x187/0x2d30 [ 66.656152] ? kvm_vm_release+0x90/0x90 [ 66.660115] do_vfs_ioctl+0xf77/0x2d30 [ 66.663994] ? __msan_poison_alloca+0x1e0/0x2b0 [ 66.668669] ? security_file_ioctl+0x92/0x200 [ 66.673156] __se_sys_ioctl+0x1da/0x270 [ 66.677120] __x64_sys_ioctl+0x4a/0x70 [ 66.680996] do_syscall_64+0xcf/0x110 [ 66.684790] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 66.690061] RIP: 0033:0x442b39 [ 66.693241] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0c fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 66.712448] RSP: 002b:00007ffcb4e05478 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ 66.720145] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000442b39 [ 66.727403] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 66.734663] RBP: 00000000006cd018 R08: 0000000020000100 R09: 0000000020000100 [ 66.741924] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000403be0 [ 66.749181] R13: 0000000000403c70 R14: 0000000000000000 R15: 0000000000000000 [ 66.757511] Kernel Offset: disabled [ 66.761153] Rebooting in 86400 seconds..