[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 106.539728][ T31] audit: type=1800 audit(1565018467.597:25): pid=11647 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 106.572710][ T31] audit: type=1800 audit(1565018467.627:26): pid=11647 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 106.592985][ T31] audit: type=1800 audit(1565018467.637:27): pid=11647 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.33' (ECDSA) to the list of known hosts. 2019/08/05 15:21:23 fuzzer started 2019/08/05 15:21:30 dialing manager at 10.128.0.26:46627 2019/08/05 15:21:33 syscalls: 2367 2019/08/05 15:21:33 code coverage: enabled 2019/08/05 15:21:33 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/08/05 15:21:33 extra coverage: enabled 2019/08/05 15:21:33 setuid sandbox: enabled 2019/08/05 15:21:33 namespace sandbox: enabled 2019/08/05 15:21:33 Android sandbox: /sys/fs/selinux/policy does not exist 2019/08/05 15:21:33 fault injection: enabled 2019/08/05 15:21:33 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/08/05 15:21:33 net packet injection: enabled 2019/08/05 15:21:33 net device setup: enabled syzkaller login: [ 320.416608][ C0] ================================================================== [ 320.424749][ C0] BUG: KMSAN: uninit-value in kmem_cache_alloc_node+0x5d0/0xe70 [ 320.432392][ C0] CPU: 0 PID: 11799 Comm: syz-fuzzer Not tainted 5.3.0-rc3+ #16 [ 320.440011][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 320.450077][ C0] Call Trace: [ 320.453364][ C0] [ 320.456242][ C0] dump_stack+0x191/0x1f0 [ 320.460575][ C0] kmsan_report+0x162/0x2d0 [ 320.465074][ C0] __msan_warning+0x75/0xe0 [ 320.469573][ C0] kmem_cache_alloc_node+0x5d0/0xe70 [ 320.474856][ C0] ? __alloc_skb+0x215/0xa10 [ 320.479456][ C0] __alloc_skb+0x215/0xa10 [ 320.483889][ C0] aoecmd_cfg+0x205/0xa80 [ 320.488239][ C0] discover_timer+0x86/0xa0 [ 320.492739][ C0] call_timer_fn+0x232/0x530 [ 320.497323][ C0] ? skbfree+0x4a0/0x4a0 [ 320.501586][ C0] __run_timers+0xcdc/0x11a0 [ 320.506195][ C0] ? skbfree+0x4a0/0x4a0 [ 320.510442][ C0] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 320.516438][ C0] run_timer_softirq+0x2d/0x50 [ 320.521197][ C0] ? timers_dead_cpu+0x9d0/0x9d0 [ 320.526145][ C0] __do_softirq+0x4a1/0x83a [ 320.530663][ C0] irq_exit+0x230/0x280 [ 320.534809][ C0] do_IRQ+0x20d/0x3a0 [ 320.538790][ C0] common_interrupt+0x2e/0x2e [ 320.543448][ C0] [ 320.546381][ C0] RIP: 0010:__msan_instrument_asm_store+0x8b/0x150 [ 320.552863][ C0] Code: ff 7f 00 00 48 39 d8 76 21 e9 8a 00 00 00 ba 00 00 00 c0 48 8d 82 00 e0 ff 3f f6 81 53 04 00 00 08 48 0f 45 c2 48 39 d8 77 6e <48> 89 df 4c 89 f6 31 d2 e8 18 db ff ff 48 85 c0 74 5c 9c 8f 45 d8 [ 320.572469][ C0] RSP: 0018:ffff8880af83ec30 EFLAGS: 00000203 ORIG_RAX: ffffffffffffffd9 [ 320.580882][ C0] RAX: 00007ffffffff000 RBX: ffff8880af83ec80 RCX: ffff88810b163c80 [ 320.588854][ C0] RDX: 0000000000000002 RSI: 0000000000000008 RDI: ffff8880af83ec80 [ 320.596833][ C0] RBP: ffff8880af83ec60 R08: ffffea000000000f R09: ffff88812fffb000 [ 320.604799][ C0] R10: 0000000000000004 R11: ffffffff8be73a50 R12: ffff88810b164620 [ 320.612759][ C0] R13: 0000000000000200 R14: 0000000000000008 R15: 0000000000000000 [ 320.620737][ C0] ? pfifo_fast_enqueue+0x8d0/0x8d0 [ 320.625958][ C0] __local_bh_enable_ip+0xf7/0x1d0 [ 320.631074][ C0] local_bh_enable+0x36/0x40 [ 320.635655][ C0] ip_finish_output2+0x20dc/0x25d0 [ 320.640757][ C0] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 320.646821][ C0] ? nf_ct_deliver_cached_events+0x4d5/0x6e0 [ 320.652816][ C0] __ip_finish_output+0xaf8/0xda0 [ 320.657864][ C0] ip_finish_output+0x2db/0x420 [ 320.662723][ C0] ip_output+0x541/0x610 [ 320.666978][ C0] ? ip_mc_finish_output+0x6d0/0x6d0 [ 320.672265][ C0] ? ip_finish_output+0x420/0x420 [ 320.677288][ C0] __ip_queue_xmit+0x1caf/0x21f0 [ 320.682234][ C0] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 320.688232][ C0] ip_queue_xmit+0xcc/0xf0 [ 320.692648][ C0] ? tcp_v4_inbound_md5_hash+0xd10/0xd10 [ 320.698269][ C0] __tcp_transmit_skb+0x409e/0x5c60 [ 320.703501][ C0] tcp_write_xmit+0x38d9/0xa870 [ 320.708414][ C0] __tcp_push_pending_frames+0x124/0x4e0 [ 320.714044][ C0] tcp_push+0x705/0x8b0 [ 320.718217][ C0] tcp_sendmsg_locked+0x5af9/0x6880 [ 320.723476][ C0] tcp_sendmsg+0xb2/0x100 [ 320.727798][ C0] ? sk_wmem_free_skb+0x850/0x850 [ 320.732810][ C0] ? sk_wmem_free_skb+0x850/0x850 [ 320.737840][ C0] inet_sendmsg+0x178/0x2e0 [ 320.742365][ C0] ? inet_send_prepare+0x600/0x600 [ 320.747476][ C0] sock_write_iter+0x599/0x650 [ 320.752241][ C0] ? sock_read_iter+0x660/0x660 [ 320.757243][ C0] __vfs_write+0xa2c/0xcb0 [ 320.761678][ C0] vfs_write+0x481/0x920 [ 320.765940][ C0] ksys_write+0x265/0x430 [ 320.770272][ C0] __se_sys_write+0x92/0xb0 [ 320.774772][ C0] __x64_sys_write+0x4a/0x70 [ 320.779380][ C0] do_syscall_64+0xbc/0xf0 [ 320.783791][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 320.789668][ C0] RIP: 0033:0x47fcb4 [ 320.793553][ C0] Code: ff ff cc cc cc cc e8 2b 41 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 45 31 d2 45 31 c0 45 31 c9 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 320.813493][ C0] RSP: 002b:000000c421801478 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 320.821900][ C0] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fcb4 [ 320.829867][ C0] RDX: 0000000000000007 RSI: 000000c42012c3e0 RDI: 0000000000000003 [ 320.837832][ C0] RBP: 000000c4218014c8 R08: 0000000000000000 R09: 0000000000000000 [ 320.845795][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 000000c42006f1e0 [ 320.853753][ C0] R13: 0000000000000007 R14: 0000000000c1cd60 R15: 000000000000972a [ 320.861727][ C0] [ 320.864047][ C0] Uninit was stored to memory at: [ 320.869059][ C0] kmsan_internal_chain_origin+0xcc/0x150 [ 320.874763][ C0] __msan_chain_origin+0x6b/0xe0 [ 320.879683][ C0] ___slab_alloc+0x1dbc/0x1fb0 [ 320.884430][ C0] kmem_cache_alloc_node+0x769/0xe70 [ 320.889712][ C0] __alloc_skb+0x215/0xa10 [ 320.894117][ C0] aoecmd_cfg+0x205/0xa80 [ 320.898429][ C0] discover_timer+0x86/0xa0 [ 320.902914][ C0] call_timer_fn+0x232/0x530 [ 320.907488][ C0] __run_timers+0xcdc/0x11a0 [ 320.912062][ C0] run_timer_softirq+0x2d/0x50 [ 320.916820][ C0] __do_softirq+0x4a1/0x83a [ 320.921309][ C0] irq_exit+0x230/0x280 [ 320.925458][ C0] do_IRQ+0x20d/0x3a0 [ 320.929479][ C0] ret_from_intr+0x0/0x33 [ 320.933804][ C0] __msan_instrument_asm_store+0x8b/0x150 [ 320.939518][ C0] __local_bh_enable_ip+0xf7/0x1d0 [ 320.944621][ C0] local_bh_enable+0x36/0x40 [ 320.949201][ C0] ip_finish_output2+0x20dc/0x25d0 [ 320.954318][ C0] __ip_finish_output+0xaf8/0xda0 [ 320.959324][ C0] ip_finish_output+0x2db/0x420 [ 320.964154][ C0] ip_output+0x541/0x610 [ 320.968380][ C0] __ip_queue_xmit+0x1caf/0x21f0 [ 320.973305][ C0] ip_queue_xmit+0xcc/0xf0 [ 320.977712][ C0] __tcp_transmit_skb+0x409e/0x5c60 [ 320.982989][ C0] tcp_write_xmit+0x38d9/0xa870 [ 320.987828][ C0] __tcp_push_pending_frames+0x124/0x4e0 [ 320.993478][ C0] tcp_push+0x705/0x8b0 [ 320.997624][ C0] tcp_sendmsg_locked+0x5af9/0x6880 [ 321.002803][ C0] tcp_sendmsg+0xb2/0x100 [ 321.007113][ C0] inet_sendmsg+0x178/0x2e0 [ 321.011596][ C0] sock_write_iter+0x599/0x650 [ 321.016346][ C0] __vfs_write+0xa2c/0xcb0 [ 321.020744][ C0] vfs_write+0x481/0x920 [ 321.024983][ C0] ksys_write+0x265/0x430 [ 321.029325][ C0] __se_sys_write+0x92/0xb0 [ 321.033816][ C0] __x64_sys_write+0x4a/0x70 [ 321.038397][ C0] do_syscall_64+0xbc/0xf0 [ 321.042813][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 321.048705][ C0] [ 321.051019][ C0] Uninit was created at: [ 321.055252][ C0] kmsan_internal_poison_shadow+0x53/0xa0 [ 321.061041][ C0] kmsan_slab_free+0x8d/0x100 [ 321.065704][ C0] kmem_cache_free_bulk+0x3ad9/0x3f50 [ 321.071076][ C0] __kfree_skb_flush+0xb0/0x100 [ 321.075932][ C0] net_rx_action+0x1908/0x1950 [ 321.080692][ C0] __do_softirq+0x4a1/0x83a [ 321.085180][ C0] irq_exit+0x230/0x280 [ 321.089321][ C0] do_IRQ+0x20d/0x3a0 [ 321.093294][ C0] ret_from_intr+0x0/0x33 [ 321.097609][ C0] do_syscall_64+0xa2/0xf0 [ 321.102010][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 321.107879][ C0] ================================================================== [ 321.115935][ C0] Disabling lock debugging due to kernel taint [ 321.122085][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 321.128668][ C0] CPU: 0 PID: 11799 Comm: syz-fuzzer Tainted: G B 5.3.0-rc3+ #16 [ 321.137668][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 321.147723][ C0] Call Trace: [ 321.150999][ C0] [ 321.153859][ C0] dump_stack+0x191/0x1f0 [ 321.158191][ C0] panic+0x3c9/0xc1e [ 321.162123][ C0] kmsan_report+0x2ca/0x2d0 [ 321.166629][ C0] __msan_warning+0x75/0xe0 [ 321.171155][ C0] kmem_cache_alloc_node+0x5d0/0xe70 [ 321.176439][ C0] ? __alloc_skb+0x215/0xa10 [ 321.181051][ C0] __alloc_skb+0x215/0xa10 [ 321.185500][ C0] aoecmd_cfg+0x205/0xa80 [ 321.189854][ C0] discover_timer+0x86/0xa0 [ 321.194361][ C0] call_timer_fn+0x232/0x530 [ 321.198954][ C0] ? skbfree+0x4a0/0x4a0 [ 321.203204][ C0] __run_timers+0xcdc/0x11a0 [ 321.207797][ C0] ? skbfree+0x4a0/0x4a0 [ 321.212078][ C0] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 321.218086][ C0] run_timer_softirq+0x2d/0x50 [ 321.222846][ C0] ? timers_dead_cpu+0x9d0/0x9d0 [ 321.227777][ C0] __do_softirq+0x4a1/0x83a [ 321.232288][ C0] irq_exit+0x230/0x280 [ 321.236449][ C0] do_IRQ+0x20d/0x3a0 [ 321.240473][ C0] common_interrupt+0x2e/0x2e [ 321.245144][ C0] [ 321.248096][ C0] RIP: 0010:__msan_instrument_asm_store+0x8b/0x150 [ 321.254591][ C0] Code: ff 7f 00 00 48 39 d8 76 21 e9 8a 00 00 00 ba 00 00 00 c0 48 8d 82 00 e0 ff 3f f6 81 53 04 00 00 08 48 0f 45 c2 48 39 d8 77 6e <48> 89 df 4c 89 f6 31 d2 e8 18 db ff ff 48 85 c0 74 5c 9c 8f 45 d8 [ 321.274190][ C0] RSP: 0018:ffff8880af83ec30 EFLAGS: 00000203 ORIG_RAX: ffffffffffffffd9 [ 321.282613][ C0] RAX: 00007ffffffff000 RBX: ffff8880af83ec80 RCX: ffff88810b163c80 [ 321.290576][ C0] RDX: 0000000000000002 RSI: 0000000000000008 RDI: ffff8880af83ec80 [ 321.298536][ C0] RBP: ffff8880af83ec60 R08: ffffea000000000f R09: ffff88812fffb000 [ 321.306497][ C0] R10: 0000000000000004 R11: ffffffff8be73a50 R12: ffff88810b164620 [ 321.314456][ C0] R13: 0000000000000200 R14: 0000000000000008 R15: 0000000000000000 [ 321.322441][ C0] ? pfifo_fast_enqueue+0x8d0/0x8d0 [ 321.327654][ C0] __local_bh_enable_ip+0xf7/0x1d0 [ 321.332769][ C0] local_bh_enable+0x36/0x40 [ 321.337354][ C0] ip_finish_output2+0x20dc/0x25d0 [ 321.342460][ C0] ? __msan_metadata_ptr_for_load_2+0x10/0x20 [ 321.348521][ C0] ? nf_ct_deliver_cached_events+0x4d5/0x6e0 [ 321.354519][ C0] __ip_finish_output+0xaf8/0xda0 [ 321.359565][ C0] ip_finish_output+0x2db/0x420 [ 321.364415][ C0] ip_output+0x541/0x610 [ 321.368657][ C0] ? ip_mc_finish_output+0x6d0/0x6d0 [ 321.373929][ C0] ? ip_finish_output+0x420/0x420 [ 321.378936][ C0] __ip_queue_xmit+0x1caf/0x21f0 [ 321.383871][ C0] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 321.389863][ C0] ip_queue_xmit+0xcc/0xf0 [ 321.394279][ C0] ? tcp_v4_inbound_md5_hash+0xd10/0xd10 [ 321.399905][ C0] __tcp_transmit_skb+0x409e/0x5c60 [ 321.405133][ C0] tcp_write_xmit+0x38d9/0xa870 [ 321.410057][ C0] __tcp_push_pending_frames+0x124/0x4e0 [ 321.415717][ C0] tcp_push+0x705/0x8b0 [ 321.419879][ C0] tcp_sendmsg_locked+0x5af9/0x6880 [ 321.425149][ C0] tcp_sendmsg+0xb2/0x100 [ 321.429497][ C0] ? sk_wmem_free_skb+0x850/0x850 [ 321.434512][ C0] ? sk_wmem_free_skb+0x850/0x850 [ 321.439550][ C0] inet_sendmsg+0x178/0x2e0 [ 321.444855][ C0] ? inet_send_prepare+0x600/0x600 [ 321.449959][ C0] sock_write_iter+0x599/0x650 [ 321.454748][ C0] ? sock_read_iter+0x660/0x660 [ 321.459595][ C0] __vfs_write+0xa2c/0xcb0 [ 321.464038][ C0] vfs_write+0x481/0x920 [ 321.468301][ C0] ksys_write+0x265/0x430 [ 321.472633][ C0] __se_sys_write+0x92/0xb0 [ 321.477128][ C0] __x64_sys_write+0x4a/0x70 [ 321.481704][ C0] do_syscall_64+0xbc/0xf0 [ 321.486110][ C0] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 321.491989][ C0] RIP: 0033:0x47fcb4 [ 321.495868][ C0] Code: ff ff cc cc cc cc e8 2b 41 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 45 31 d2 45 31 c0 45 31 c9 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 321.515475][ C0] RSP: 002b:000000c421801478 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 321.523884][ C0] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047fcb4 [ 321.531864][ C0] RDX: 0000000000000007 RSI: 000000c42012c3e0 RDI: 0000000000000003 [ 321.539832][ C0] RBP: 000000c4218014c8 R08: 0000000000000000 R09: 0000000000000000 [ 321.547794][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 000000c42006f1e0 [ 321.555755][ C0] R13: 0000000000000007 R14: 0000000000c1cd60 R15: 000000000000972a [ 321.564914][ C0] Kernel Offset: disabled [ 321.569255][ C0] Rebooting in 86400 seconds..