INIT: Entering runlevel: 2 [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.12' (ECDSA) to the list of known hosts. net.ipv6.conf.syz_tun.accept_dad = 0 syzkaller login: [ 61.342623] IPVS: ftp: loaded support on port[0] = 21 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 61.602196] ip (4537) used greatest stack depth: 54200 bytes left [ 61.615330] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.621726] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.628856] device bridge_slave_0 entered promiscuous mode [ 61.649828] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.656225] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.663493] device bridge_slave_1 entered promiscuous mode [ 61.683982] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 61.705176] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 61.768700] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 61.791798] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 61.879608] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 61.886878] team0: Port device team_slave_0 added [ 61.906780] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 61.914003] team0: Port device team_slave_1 added [ 61.936570] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 61.959439] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 61.982871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 62.006451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 62.185510] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.191936] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.198698] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.205100] bridge0: port 1(bridge_slave_0) entered forwarding state RTNETLINK answers: Operation not supported [ 62.272592] ip (4605) used greatest stack depth: 53992 bytes left RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 62.867924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.929416] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 62.990960] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 62.997181] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 63.005138] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.060791] 8021q: adding VLAN 0 to HW filter on device team0 executing program [ 63.405748] ================================================================== [ 63.413147] BUG: KMSAN: uninit-value in ip_tunnel_xmit+0x5e9/0x37c0 [ 63.419529] CPU: 0 PID: 4504 Comm: syzkaller546648 Not tainted 4.16.0+ #85 [ 63.426514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.435845] Call Trace: [ 63.438412] dump_stack+0x185/0x1d0 [ 63.442018] ? ip_tunnel_xmit+0x5e9/0x37c0 [ 63.446228] kmsan_report+0x142/0x240 [ 63.450003] __msan_warning_32+0x6c/0xb0 [ 63.454040] ip_tunnel_xmit+0x5e9/0x37c0 [ 63.458076] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 63.463419] ? skb_push+0x16b/0x260 [ 63.467024] ? __msan_metadata_ptr_for_store_2+0x13/0x20 [ 63.472462] ? gre_build_header+0x5ab/0xaa0 [ 63.476767] ipgre_xmit+0xdb7/0xe90 [ 63.480374] ? ipgre_close+0x230/0x230 [ 63.484240] dev_hard_start_xmit+0x5f1/0xc70 [ 63.488634] __dev_queue_xmit+0x27ee/0x3520 [ 63.492933] ? sock_alloc_send_pskb+0xfee/0x1190 [ 63.497675] dev_queue_xmit+0x4b/0x60 [ 63.501454] ? __netdev_pick_tx+0xb60/0xb60 [ 63.505760] packet_sendmsg+0x7c70/0x8a30 [ 63.509884] ? kmsan_set_origin+0x9e/0x160 [ 63.514096] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 63.519437] ? rw_copy_check_uvector+0x5af/0x6c0 [ 63.524174] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 63.529598] ? import_iovec+0x3cd/0x610 [ 63.533553] ? copy_msghdr_from_user+0x72c/0x830 [ 63.538291] ? compat_packet_setsockopt+0x360/0x360 [ 63.543291] ___sys_sendmsg+0xec0/0x1310 [ 63.547335] ? __fdget+0x4e/0x60 [ 63.550692] __sys_sendmmsg+0x42d/0x800 [ 63.554653] ? kmsan_set_origin_inline+0x6b/0x120 [ 63.559480] SYSC_sendmmsg+0xc4/0x110 [ 63.563262] SyS_sendmmsg+0x63/0x90 [ 63.566872] do_syscall_64+0x309/0x430 [ 63.570742] ? __sys_sendmmsg+0x800/0x800 [ 63.574869] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 63.580043] RIP: 0033:0x441659 [ 63.583214] RSP: 002b:00007ffca3b240e8 EFLAGS: 00000213 ORIG_RAX: 0000000000000133 [ 63.590905] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441659 [ 63.598154] RDX: 0000000000000001 RSI: 0000000020003a80 RDI: 0000000000000003 [ 63.605402] RBP: 00000000006cd018 R08: 0000000000000000 R09: 0000000000000000 [ 63.612645] R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004023b0 [ 63.619890] R13: 0000000000402440 R14: 0000000000000000 R15: 0000000000000000 [ 63.627137] [ 63.628738] Uninit was created at: [ 63.632259] kmsan_internal_poison_shadow+0xb8/0x1b0 [ 63.637338] kmsan_kmalloc+0x94/0x100 [ 63.641114] kmsan_slab_alloc+0x11/0x20 [ 63.645066] __kmalloc_node_track_caller+0xaed/0x11c0 [ 63.650231] __alloc_skb+0x2cf/0x9f0 [ 63.653918] alloc_skb_with_frags+0x1d4/0xb20 [ 63.658387] sock_alloc_send_pskb+0xb56/0x1190 [ 63.662944] packet_sendmsg+0x6454/0x8a30 [ 63.667067] ___sys_sendmsg+0xec0/0x1310 [ 63.671104] __sys_sendmmsg+0x42d/0x800 [ 63.675056] SYSC_sendmmsg+0xc4/0x110 [ 63.678831] SyS_sendmmsg+0x63/0x90 [ 63.682432] do_syscall_64+0x309/0x430 [ 63.686296] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 63.691453] ================================================================== [ 63.698791] Disabling lock debugging due to kernel taint [ 63.704216] Kernel panic - not syncing: panic_on_warn set ... [ 63.704216] [ 63.711563] CPU: 0 PID: 4504 Comm: syzkaller546648 Tainted: G B 4.16.0+ #85 [ 63.719850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.729187] Call Trace: [ 63.731755] dump_stack+0x185/0x1d0 [ 63.735358] panic+0x39d/0x940 [ 63.738538] ? ip_tunnel_xmit+0x5e9/0x37c0 [ 63.742747] kmsan_report+0x238/0x240 [ 63.746532] __msan_warning_32+0x6c/0xb0 [ 63.750572] ip_tunnel_xmit+0x5e9/0x37c0 [ 63.754608] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 63.759961] ? skb_push+0x16b/0x260 [ 63.763566] ? __msan_metadata_ptr_for_store_2+0x13/0x20 [ 63.768990] ? gre_build_header+0x5ab/0xaa0 [ 63.773296] ipgre_xmit+0xdb7/0xe90 [ 63.776908] ? ipgre_close+0x230/0x230 [ 63.780772] dev_hard_start_xmit+0x5f1/0xc70 [ 63.785160] __dev_queue_xmit+0x27ee/0x3520 [ 63.789459] ? sock_alloc_send_pskb+0xfee/0x1190 [ 63.794201] dev_queue_xmit+0x4b/0x60 [ 63.797978] ? __netdev_pick_tx+0xb60/0xb60 [ 63.802277] packet_sendmsg+0x7c70/0x8a30 [ 63.806402] ? kmsan_set_origin+0x9e/0x160 [ 63.810875] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 63.816228] ? rw_copy_check_uvector+0x5af/0x6c0 [ 63.820975] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 63.826418] ? import_iovec+0x3cd/0x610 [ 63.830385] ? copy_msghdr_from_user+0x72c/0x830 [ 63.835127] ? compat_packet_setsockopt+0x360/0x360 [ 63.840128] ___sys_sendmsg+0xec0/0x1310 [ 63.844172] ? __fdget+0x4e/0x60 [ 63.847523] __sys_sendmmsg+0x42d/0x800 [ 63.851477] ? kmsan_set_origin_inline+0x6b/0x120 [ 63.856314] SYSC_sendmmsg+0xc4/0x110 [ 63.860095] SyS_sendmmsg+0x63/0x90 [ 63.863702] do_syscall_64+0x309/0x430 [ 63.867570] ? __sys_sendmmsg+0x800/0x800 [ 63.871699] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 63.876868] RIP: 0033:0x441659 [ 63.880041] RSP: 002b:00007ffca3b240e8 EFLAGS: 00000213 ORIG_RAX: 0000000000000133 [ 63.887735] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441659 [ 63.894983] RDX: 0000000000000001 RSI: 0000000020003a80 RDI: 0000000000000003 [ 63.902235] RBP: 00000000006cd018 R08: 0000000000000000 R09: 0000000000000000 [ 63.909485] R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004023b0 [ 63.917178] R13: 0000000000402440 R14: 0000000000000000 R15: 0000000000000000 [ 63.924940] Dumping ftrace buffer: [ 63.928465] (ftrace buffer empty) [ 63.932164] Kernel Offset: disabled [ 63.935766] Rebooting in 86400 seconds..