[ 97.052728][ T32] audit: type=1800 audit(1580007801.114:27): pid=10883 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 98.805187][ T32] kauditd_printk_skb: 1 callbacks suppressed [ 98.805233][ T32] audit: type=1800 audit(1580007802.884:29): pid=10883 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 98.832554][ T32] audit: type=1800 audit(1580007802.894:30): pid=10883 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.167' (ECDSA) to the list of known hosts. syzkaller login: [ 109.389450][T11035] IPVS: ftp: loaded support on port[0] = 21 [ 109.475168][T11035] chnl_net:caif_netlink_parms(): no params data found [ 109.520826][T11035] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.528095][T11035] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.536627][T11035] device bridge_slave_0 entered promiscuous mode [ 109.545359][T11035] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.552469][T11035] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.560929][T11035] device bridge_slave_1 entered promiscuous mode [ 109.587317][T11035] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.599092][T11035] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.626115][T11035] team0: Port device team_slave_0 added [ 109.634996][T11035] team0: Port device team_slave_1 added [ 109.656984][T11035] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.664083][T11035] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.690094][T11035] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.702157][T11035] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.709319][T11035] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.735471][T11035] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.826336][T11035] device hsr_slave_0 entered promiscuous mode [ 109.893577][T11035] device hsr_slave_1 entered promiscuous mode [ 110.069815][T11035] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.127019][T11035] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.176748][T11035] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.236886][T11035] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.298994][T11035] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.306367][T11035] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.314189][T11035] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.321503][T11035] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.380687][T11035] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.397978][ T3389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 110.410024][ T3389] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.419521][ T3389] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.429169][ T3389] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 110.445720][T11035] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.460564][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 110.469781][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.477143][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.491297][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 110.501509][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 110.510993][T11037] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.518337][T11037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.531682][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 110.554670][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 110.564596][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 110.575141][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 110.584682][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 110.595010][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 110.605363][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 110.621288][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 110.631065][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 110.649214][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 110.658560][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 110.671205][T11035] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 110.696703][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 110.704969][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 110.721656][T11035] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.745468][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 110.755810][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 110.781464][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 110.791454][T11037] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 110.804107][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 110.813927][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 110.826369][T11035] device veth0_vlan entered promiscuous mode [ 110.841024][T11035] device veth1_vlan entered promiscuous mode [ 110.869396][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 110.878818][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 110.887794][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 110.896984][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 110.910439][T11035] device veth0_macvtap entered promiscuous mode [ 110.921540][T11035] device veth1_macvtap entered promiscuous mode [ 110.945984][T11035] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.953750][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 110.963230][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 110.972422][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 110.982514][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 110.998118][T11035] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.006082][T11039] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready executing program [ 111.015581][T11039] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 111.042505][T11035] ===================================================== [ 111.049506][T11035] BUG: KMSAN: uninit-value in ip_tunnel_xmit+0x5f4/0x34f0 [ 111.056701][T11035] CPU: 0 PID: 11035 Comm: syz-executor804 Not tainted 5.5.0-rc5-syzkaller #0 [ 111.065454][T11035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 111.075630][T11035] Call Trace: [ 111.078966][T11035] dump_stack+0x1c9/0x220 [ 111.083313][T11035] kmsan_report+0xf7/0x1e0 [ 111.087790][T11035] __msan_warning+0x58/0xa0 [ 111.092301][T11035] ip_tunnel_xmit+0x5f4/0x34f0 [ 111.097066][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.102885][T11035] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 111.108963][T11035] ? skb_push+0x15b/0x250 [ 111.113406][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.119227][T11035] ? __msan_metadata_ptr_for_store_2+0x13/0x20 [ 111.125379][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.130612][T11035] ipgre_xmit+0xfe7/0x1110 [ 111.135119][T11035] ? ipgre_close+0x240/0x240 [ 111.139700][T11035] dev_hard_start_xmit+0x531/0xab0 [ 111.144958][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.150292][T11035] __dev_queue_xmit+0x37de/0x4220 [ 111.155396][T11035] dev_queue_xmit+0x4b/0x60 [ 111.159930][T11035] ? netdev_core_pick_tx+0x4d0/0x4d0 [ 111.165257][T11035] packet_sendmsg+0x8436/0x92f0 [ 111.170097][T11035] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 111.176265][T11035] ? __pagevec_lru_add_fn+0xcef/0xfa0 [ 111.181722][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.186917][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.192723][T11035] ? kmsan_get_metadata+0x4f/0x180 [ 111.197877][T11035] ? kmsan_internal_set_origin+0x75/0xb0 [ 111.203506][T11035] ? slabs_cpu_partial_show+0x3e0/0x790 [ 111.209194][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.215047][T11035] ? aa_sk_perm+0x83c/0xcd0 [ 111.219552][T11035] ? compat_packet_setsockopt+0x360/0x360 [ 111.225262][T11035] ____sys_sendmsg+0x12b6/0x1350 [ 111.230204][T11035] __sys_sendmsg+0x451/0x5f0 [ 111.234815][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.240015][T11035] __se_sys_sendmsg+0x97/0xb0 [ 111.244703][T11035] __x64_sys_sendmsg+0x4a/0x70 [ 111.249567][T11035] do_syscall_64+0xb8/0x160 [ 111.254129][T11035] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.260099][T11035] RIP: 0033:0x442519 [ 111.264000][T11035] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 111.283608][T11035] RSP: 002b:00007ffc2049f9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 111.292045][T11035] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442519 [ 111.300009][T11035] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000004 [ 111.308079][T11035] RBP: 00007ffc2049fa10 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 111.316042][T11035] R10: 0000000001bbbbbb R11: 0000000000000246 R12: 0000000000000000 [ 111.324010][T11035] R13: 0000000000403ab0 R14: 0000000000000000 R15: 0000000000000000 [ 111.332152][T11035] [ 111.334472][T11035] Uninit was created at: [ 111.338701][T11035] kmsan_internal_poison_shadow+0x66/0xd0 [ 111.344421][T11035] kmsan_slab_alloc+0x8a/0xe0 [ 111.349128][T11035] __kmalloc_node_track_caller+0xb40/0x1200 [ 111.355016][T11035] __alloc_skb+0x2fd/0xac0 [ 111.359427][T11035] alloc_skb_with_frags+0x18c/0xa70 [ 111.364619][T11035] sock_alloc_send_pskb+0xada/0xc60 [ 111.369813][T11035] packet_sendmsg+0x656e/0x92f0 [ 111.374668][T11035] ____sys_sendmsg+0x12b6/0x1350 [ 111.379595][T11035] __sys_sendmsg+0x451/0x5f0 [ 111.384179][T11035] __se_sys_sendmsg+0x97/0xb0 [ 111.388841][T11035] __x64_sys_sendmsg+0x4a/0x70 [ 111.393599][T11035] do_syscall_64+0xb8/0x160 [ 111.398095][T11035] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.403971][T11035] ===================================================== [ 111.410887][T11035] Disabling lock debugging due to kernel taint [ 111.417028][T11035] Kernel panic - not syncing: panic_on_warn set ... [ 111.423623][T11035] CPU: 0 PID: 11035 Comm: syz-executor804 Tainted: G B 5.5.0-rc5-syzkaller #0 [ 111.433900][T11035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 111.443951][T11035] Call Trace: [ 111.447302][T11035] dump_stack+0x1c9/0x220 [ 111.451632][T11035] panic+0x3d5/0xc3e [ 111.455664][T11035] kmsan_report+0x1df/0x1e0 [ 111.460160][T11035] __msan_warning+0x58/0xa0 [ 111.464741][T11035] ip_tunnel_xmit+0x5f4/0x34f0 [ 111.469510][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.475314][T11035] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 111.481485][T11035] ? skb_push+0x15b/0x250 [ 111.485809][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.491751][T11035] ? __msan_metadata_ptr_for_store_2+0x13/0x20 [ 111.497903][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.503104][T11035] ipgre_xmit+0xfe7/0x1110 [ 111.507551][T11035] ? ipgre_close+0x240/0x240 [ 111.512132][T11035] dev_hard_start_xmit+0x531/0xab0 [ 111.518198][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.523407][T11035] __dev_queue_xmit+0x37de/0x4220 [ 111.528435][T11035] dev_queue_xmit+0x4b/0x60 [ 111.533092][T11035] ? netdev_core_pick_tx+0x4d0/0x4d0 [ 111.538389][T11035] packet_sendmsg+0x8436/0x92f0 [ 111.543268][T11035] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 111.549346][T11035] ? __pagevec_lru_add_fn+0xcef/0xfa0 [ 111.554900][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.560081][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.565886][T11035] ? kmsan_get_metadata+0x4f/0x180 [ 111.570983][T11035] ? kmsan_internal_set_origin+0x75/0xb0 [ 111.576611][T11035] ? slabs_cpu_partial_show+0x3e0/0x790 [ 111.582154][T11035] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 111.588326][T11035] ? aa_sk_perm+0x83c/0xcd0 [ 111.593040][T11035] ? compat_packet_setsockopt+0x360/0x360 [ 111.598774][T11035] ____sys_sendmsg+0x12b6/0x1350 [ 111.603719][T11035] __sys_sendmsg+0x451/0x5f0 [ 111.608329][T11035] ? kmsan_get_metadata+0x11d/0x180 [ 111.613756][T11035] __se_sys_sendmsg+0x97/0xb0 [ 111.618420][T11035] __x64_sys_sendmsg+0x4a/0x70 [ 111.623200][T11035] do_syscall_64+0xb8/0x160 [ 111.627716][T11035] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 111.633606][T11035] RIP: 0033:0x442519 [ 111.637498][T11035] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 111.657191][T11035] RSP: 002b:00007ffc2049f9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 111.669892][T11035] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442519 [ 111.677859][T11035] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000004 [ 111.685870][T11035] RBP: 00007ffc2049fa10 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 111.694270][T11035] R10: 0000000001bbbbbb R11: 0000000000000246 R12: 0000000000000000 [ 111.702373][T11035] R13: 0000000000403ab0 R14: 0000000000000000 R15: 0000000000000000 [ 111.711768][T11035] Kernel Offset: 0x15c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 111.723459][T11035] Rebooting in 86400 seconds..