INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.18' (ECDSA) to the list of known hosts. syzkaller login: [ 46.436978] IPVS: ftp: loaded support on port[0] = 21 net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 46.687608] ip (4571) used greatest stack depth: 53960 bytes left [ 46.740594] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.747129] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.754658] device bridge_slave_0 entered promiscuous mode [ 46.777645] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.784096] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.791709] device bridge_slave_1 entered promiscuous mode [ 46.814318] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 46.836941] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 46.898424] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 46.923293] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 47.016368] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 47.023665] team0: Port device team_slave_0 added [ 47.045477] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 47.052787] team0: Port device team_slave_1 added [ 47.075240] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 47.099960] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 47.125376] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 47.150880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 47.349460] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.355898] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.362723] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.369144] bridge0: port 1(bridge_slave_0) entered forwarding state RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 48.091950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.162285] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 48.233369] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 48.239615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.247516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.316603] 8021q: adding VLAN 0 to HW filter on device team0 executing program [ 48.721534] ================================================================== [ 48.728939] BUG: KMSAN: uninit-value in raw6_local_deliver+0x137/0x1fd0 [ 48.735675] CPU: 0 PID: 4542 Comm: syzkaller636713 Not tainted 4.16.0+ #85 [ 48.742752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.752080] Call Trace: [ 48.754638] [ 48.756774] dump_stack+0x185/0x1d0 [ 48.760380] ? raw6_local_deliver+0x137/0x1fd0 [ 48.764944] kmsan_report+0x142/0x240 [ 48.768724] __msan_warning_32+0x6c/0xb0 [ 48.772765] ? ip6_input_finish+0x585/0x2250 [ 48.777160] ? ip6_input_finish+0x585/0x2250 [ 48.781549] raw6_local_deliver+0x137/0x1fd0 [ 48.785938] ip6_input_finish+0x585/0x2250 [ 48.790167] ? nf_hook_slow+0x36f/0x3d0 [ 48.794125] ip6_mc_input+0xa67/0x1080 [ 48.797991] ? ip6_input+0x320/0x320 [ 48.801686] ? ip6_input_finish+0x2250/0x2250 [ 48.806157] ip6_rcv_finish+0x46e/0x6e0 [ 48.810110] ipv6_rcv+0x1e16/0x2340 [ 48.813728] ? local_bh_enable+0x40/0x40 [ 48.817771] __netif_receive_skb_core+0x47df/0x4a90 [ 48.822765] ? kmsan_set_origin_inline+0x6b/0x120 [ 48.827592] ? kmsan_write_aligned_origin_inline+0x60/0x60 [ 48.833194] ? ip6_rcv_finish+0x6e0/0x6e0 [ 48.837408] process_backlog+0x62d/0xe20 [ 48.841451] ? rps_trigger_softirq+0x2f0/0x2f0 [ 48.846009] net_rx_action+0x7c1/0x1a70 [ 48.849968] ? net_tx_action+0xab0/0xab0 [ 48.854010] __do_softirq+0x56d/0x93d [ 48.857798] do_softirq_own_stack+0x2a/0x40 [ 48.862091] [ 48.864308] do_softirq+0xb6/0xf0 [ 48.867738] dev_loopback_xmit+0x8b0/0x900 [ 48.871949] ip6_finish_output2+0x1e4b/0x2130 [ 48.876420] ? __msan_poison_alloca+0x15c/0x1d0 [ 48.881066] ? ip6_fragment+0x323d/0x5160 [ 48.885195] ip6_fragment+0x32a8/0x5160 [ 48.889145] ? ip6_make_skb+0x1100/0x1100 [ 48.893277] ip6_finish_output+0xa0d/0xba0 [ 48.897497] ip6_output+0x597/0x6c0 [ 48.901102] ? __ip6_local_out+0x730/0x730 [ 48.905314] ? ac6_seq_show+0x200/0x200 [ 48.909262] ip6_local_out+0x15e/0x1d0 [ 48.913126] ip6_send_skb+0xfa/0x380 [ 48.916822] udp_v6_send_skb+0x12a3/0x18e0 [ 48.921047] udpv6_sendmsg+0x466c/0x47c0 [ 48.925088] ? __local_bh_enable_ip+0x3b/0x140 [ 48.929648] ? _raw_spin_unlock_bh+0x57/0x70 [ 48.934042] ? udp_lib_get_port+0x28e1/0x2d70 [ 48.938517] ? ip_copy_metadata+0xee0/0xee0 [ 48.942822] ? udpv6_queue_rcv_skb+0x1c60/0x1c60 [ 48.947553] inet_sendmsg+0x48d/0x740 [ 48.951331] ? inet_getname+0x500/0x500 [ 48.955283] SYSC_sendto+0x6c3/0x7e0 [ 48.958979] SyS_sendto+0x8a/0xb0 [ 48.962410] do_syscall_64+0x309/0x430 [ 48.966274] ? SYSC_getpeername+0x560/0x560 [ 48.970572] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 48.975737] RIP: 0033:0x441989 [ 48.978902] RSP: 002b:00007ffd4ed98c28 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 48.986589] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441989 [ 48.993838] RDX: 0000000000001000 RSI: 0000000020000100 RDI: 0000000000000003 [ 49.001089] RBP: 00000000006ce018 R08: 0000000020000040 R09: 000000000000001c [ 49.008337] R10: 0000000000004004 R11: 0000000000000212 R12: 0000000000402680 [ 49.015586] R13: 0000000000402710 R14: 0000000000000000 R15: 0000000000000000 [ 49.022840] [ 49.024464] Uninit was stored to memory at: [ 49.028787] kmsan_internal_chain_origin+0x12b/0x210 [ 49.033868] kmsan_memcpy_origins+0x11d/0x170 [ 49.038344] kmsan_memmove_origins+0x9/0x10 [ 49.042646] __msan_memmove+0xda/0x130 [ 49.046513] ipv6_frag_rcv+0x50cb/0x6a00 [ 49.050554] ip6_input_finish+0xaac/0x2250 [ 49.054765] ip6_mc_input+0xa67/0x1080 [ 49.058632] ip6_rcv_finish+0x46e/0x6e0 [ 49.062579] ipv6_rcv+0x1e16/0x2340 [ 49.066183] __netif_receive_skb_core+0x47df/0x4a90 [ 49.071184] process_backlog+0x62d/0xe20 [ 49.075218] net_rx_action+0x7c1/0x1a70 [ 49.079168] __do_softirq+0x56d/0x93d [ 49.082940] Uninit was created at: [ 49.086456] kmsan_internal_poison_shadow+0xb8/0x1b0 [ 49.091534] kmsan_kmalloc+0x94/0x100 [ 49.095330] kmsan_slab_alloc+0x11/0x20 [ 49.099280] __kmalloc_node_track_caller+0xaed/0x11c0 [ 49.104457] __alloc_skb+0x2cf/0x9f0 [ 49.108233] alloc_skb_with_frags+0x1d4/0xb20 [ 49.112703] sock_alloc_send_pskb+0xb56/0x1190 [ 49.117261] sock_alloc_send_skb+0xca/0xe0 [ 49.121474] __ip6_append_data+0x339d/0x4bc0 [ 49.125859] ip6_make_skb+0x87a/0x1100 [ 49.129735] udpv6_sendmsg+0x4471/0x47c0 [ 49.133773] inet_sendmsg+0x48d/0x740 [ 49.137553] SYSC_sendto+0x6c3/0x7e0 [ 49.141250] SyS_sendto+0x8a/0xb0 [ 49.144678] do_syscall_64+0x309/0x430 [ 49.148542] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 49.153700] ================================================================== [ 49.161034] Disabling lock debugging due to kernel taint [ 49.166459] Kernel panic - not syncing: panic_on_warn set ... [ 49.166459] [ 49.173801] CPU: 0 PID: 4542 Comm: syzkaller636713 Tainted: G B 4.16.0+ #85 [ 49.182090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.191423] Call Trace: [ 49.194001] [ 49.196151] dump_stack+0x185/0x1d0 [ 49.199755] panic+0x39d/0x940 [ 49.202937] ? raw6_local_deliver+0x137/0x1fd0 [ 49.207503] kmsan_report+0x238/0x240 [ 49.211285] __msan_warning_32+0x6c/0xb0 [ 49.215327] ? ip6_input_finish+0x585/0x2250 [ 49.219716] ? ip6_input_finish+0x585/0x2250 [ 49.224108] raw6_local_deliver+0x137/0x1fd0 [ 49.228501] ip6_input_finish+0x585/0x2250 [ 49.232720] ? nf_hook_slow+0x36f/0x3d0 [ 49.236676] ip6_mc_input+0xa67/0x1080 [ 49.240551] ? ip6_input+0x320/0x320 [ 49.244251] ? ip6_input_finish+0x2250/0x2250 [ 49.248726] ip6_rcv_finish+0x46e/0x6e0 [ 49.252682] ipv6_rcv+0x1e16/0x2340 [ 49.256288] ? local_bh_enable+0x40/0x40 [ 49.260336] __netif_receive_skb_core+0x47df/0x4a90 [ 49.265331] ? kmsan_set_origin_inline+0x6b/0x120 [ 49.270150] ? kmsan_write_aligned_origin_inline+0x60/0x60 [ 49.275758] ? ip6_rcv_finish+0x6e0/0x6e0 [ 49.279884] process_backlog+0x62d/0xe20 [ 49.283923] ? rps_trigger_softirq+0x2f0/0x2f0 [ 49.288482] net_rx_action+0x7c1/0x1a70 [ 49.292436] ? net_tx_action+0xab0/0xab0 [ 49.296477] __do_softirq+0x56d/0x93d [ 49.300264] do_softirq_own_stack+0x2a/0x40 [ 49.304577] [ 49.306797] do_softirq+0xb6/0xf0 [ 49.310229] dev_loopback_xmit+0x8b0/0x900 [ 49.314445] ip6_finish_output2+0x1e4b/0x2130 [ 49.318918] ? __msan_poison_alloca+0x15c/0x1d0 [ 49.323563] ? ip6_fragment+0x323d/0x5160 [ 49.327704] ip6_fragment+0x32a8/0x5160 [ 49.331655] ? ip6_make_skb+0x1100/0x1100 [ 49.335788] ip6_finish_output+0xa0d/0xba0 [ 49.340000] ip6_output+0x597/0x6c0 [ 49.343612] ? __ip6_local_out+0x730/0x730 [ 49.347837] ? ac6_seq_show+0x200/0x200 [ 49.351786] ip6_local_out+0x15e/0x1d0 [ 49.355657] ip6_send_skb+0xfa/0x380 [ 49.359354] udp_v6_send_skb+0x12a3/0x18e0 [ 49.363568] udpv6_sendmsg+0x466c/0x47c0 [ 49.367607] ? __local_bh_enable_ip+0x3b/0x140 [ 49.372173] ? _raw_spin_unlock_bh+0x57/0x70 [ 49.376558] ? udp_lib_get_port+0x28e1/0x2d70 [ 49.381043] ? ip_copy_metadata+0xee0/0xee0 [ 49.385351] ? udpv6_queue_rcv_skb+0x1c60/0x1c60 [ 49.390086] inet_sendmsg+0x48d/0x740 [ 49.393866] ? inet_getname+0x500/0x500 [ 49.397821] SYSC_sendto+0x6c3/0x7e0 [ 49.401525] SyS_sendto+0x8a/0xb0 [ 49.404965] do_syscall_64+0x309/0x430 [ 49.408916] ? SYSC_getpeername+0x560/0x560 [ 49.413216] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 49.418381] RIP: 0033:0x441989 [ 49.421560] RSP: 002b:00007ffd4ed98c28 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 49.429242] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441989 [ 49.436486] RDX: 0000000000001000 RSI: 0000000020000100 RDI: 0000000000000003 [ 49.443734] RBP: 00000000006ce018 R08: 0000000020000040 R09: 000000000000001c [ 49.450981] R10: 0000000000004004 R11: 0000000000000212 R12: 0000000000402680 [ 49.458225] R13: 0000000000402710 R14: 0000000000000000 R15: 0000000000000000 [ 49.466005] Dumping ftrace buffer: [ 49.469534] (ftrace buffer empty) [ 49.473220] Kernel Offset: disabled [ 49.476821] Rebooting in 86400 seconds..