syzbot

==================================================================
BUG: KMSAN: uninit-value in __skb_unlink include/linux/skbuff.h:2007 [inline]
BUG: KMSAN: uninit-value in __skb_dequeue include/linux/skbuff.h:2023 [inline]
BUG: KMSAN: uninit-value in skb_dequeue+0x2d5/0x330 net/core/skbuff.c:3034
CPU: 0 PID: 3534 Comm: aoe_tx0 Not tainted 5.3.0-rc3+ #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 lib/dump_stack.c:113
 kmsan_report+0x162/0x2d0 mm/kmsan/kmsan_report.c:109
 __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:294
 __skb_unlink include/linux/skbuff.h:2007 [inline]
 __skb_dequeue include/linux/skbuff.h:2023 [inline]
 skb_dequeue+0x2d5/0x330 net/core/skbuff.c:3034
 tx+0x196/0x2f0 drivers/block/aoe/aoenet.c:60
 kthread+0x1f6/0x470 drivers/block/aoe/aoecmd.c:1239
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:187 [inline]
 kmsan_internal_chain_origin+0xcc/0x150 mm/kmsan/kmsan.c:345
 __msan_chain_origin+0x6b/0xe0 mm/kmsan/kmsan_instr.c:190
 __skb_insert include/linux/skbuff.h:1851 [inline]
 __skb_queue_before include/linux/skbuff.h:1957 [inline]
 __skb_queue_tail include/linux/skbuff.h:1990 [inline]
 skb_queue_tail+0x258/0x2d0 net/core/skbuff.c:3139
 aoenet_xmit+0x20a/0x3b0 drivers/block/aoe/aoenet.c:121
 aoecmd_cfg+0xa53/0xa80 drivers/block/aoe/aoecmd.c:1373
 discover_timer+0x86/0xa0 drivers/block/aoe/aoemain.c:24
 call_timer_fn+0x232/0x530 kernel/time/timer.c:1322
 expire_timers kernel/time/timer.c:1366 [inline]
 __run_timers+0xcdc/0x11a0 kernel/time/timer.c:1685
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1698
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:375 [inline]
 irq_exit+0x230/0x280 kernel/softirq.c:416
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:537
 smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1097
 apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:835
 my_phys_addr_valid mm/kmsan/kmsan.c:444 [inline]
 my_virt_addr_valid mm/kmsan/kmsan.c:467 [inline]
 virt_to_page_or_null+0x26/0x100 mm/kmsan/kmsan.c:476
 is_bad_asm_addr mm/kmsan/kmsan_instr.c:22 [inline]
 __msan_instrument_asm_store+0x98/0x150 mm/kmsan/kmsan_instr.c:70
 arch_atomic_dec_and_test arch/x86/include/asm/atomic.h:125 [inline]
 atomic_dec_and_test include/asm-generic/atomic-instrumented.h:748 [inline]
 page_ref_dec_and_test include/linux/page_ref.h:139 [inline]
 put_page_testzero include/linux/mm.h:608 [inline]
 release_pages+0x5a0/0x15e0 mm/swap.c:760
 free_pages_and_swap_cache+0x4ce/0x4f0 mm/swap_state.c:296
 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:185 [inline]
 tlb_flush_mmu+0x6d7/0x870 mm/mmu_gather.c:192
 zap_pte_range mm/memory.c:1127 [inline]
 zap_pmd_range mm/memory.c:1162 [inline]
 zap_pud_range mm/memory.c:1191 [inline]
 zap_p4d_range mm/memory.c:1212 [inline]
 unmap_page_range+0x37b1/0x3f60 mm/memory.c:1233
 unmap_single_vma+0x43f/0x5e0 mm/memory.c:1278
 unmap_vmas+0x391/0x4b0 mm/memory.c:1310
 exit_mmap+0x50e/0xa00 mm/mmap.c:3145
 __mmput+0x148/0x590 kernel/fork.c:1066
 mmput+0x83/0x90 kernel/fork.c:1087
 exit_mm+0x6b7/0x770 kernel/exit.c:548
 do_exit+0xb12/0x3aa0 kernel/exit.c:868
 do_group_exit+0x18a/0x320 kernel/exit.c:985
 __do_sys_exit_group+0x21/0x30 kernel/exit.c:996
 __se_sys_exit_group+0x14/0x20 kernel/exit.c:994
 __x64_sys_exit_group+0x1d/0x20 kernel/exit.c:994
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:187 [inline]
 kmsan_internal_chain_origin+0xcc/0x150 mm/kmsan/kmsan.c:345
 __msan_chain_origin+0x6b/0xe0 mm/kmsan/kmsan_instr.c:190
 __skb_insert include/linux/skbuff.h:1851 [inline]
 __skb_queue_before include/linux/skbuff.h:1957 [inline]
 __skb_queue_tail include/linux/skbuff.h:1990 [inline]
 aoecmd_cfg_pkts drivers/block/aoe/aoecmd.c:433 [inline]
 aoecmd_cfg+0x946/0xa80 drivers/block/aoe/aoecmd.c:1372
 discover_timer+0x86/0xa0 drivers/block/aoe/aoemain.c:24
 call_timer_fn+0x232/0x530 kernel/time/timer.c:1322
 expire_timers kernel/time/timer.c:1366 [inline]
 __run_timers+0xcdc/0x11a0 kernel/time/timer.c:1685
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1698
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:375 [inline]
 irq_exit+0x230/0x280 kernel/softirq.c:416
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:537
 smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1097
 apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:835
 my_phys_addr_valid mm/kmsan/kmsan.c:444 [inline]
 my_virt_addr_valid mm/kmsan/kmsan.c:467 [inline]
 virt_to_page_or_null+0x26/0x100 mm/kmsan/kmsan.c:476
 is_bad_asm_addr mm/kmsan/kmsan_instr.c:22 [inline]
 __msan_instrument_asm_store+0x98/0x150 mm/kmsan/kmsan_instr.c:70
 arch_atomic_dec_and_test arch/x86/include/asm/atomic.h:125 [inline]
 atomic_dec_and_test include/asm-generic/atomic-instrumented.h:748 [inline]
 page_ref_dec_and_test include/linux/page_ref.h:139 [inline]
 put_page_testzero include/linux/mm.h:608 [inline]
 release_pages+0x5a0/0x15e0 mm/swap.c:760
 free_pages_and_swap_cache+0x4ce/0x4f0 mm/swap_state.c:296
 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:185 [inline]
 tlb_flush_mmu+0x6d7/0x870 mm/mmu_gather.c:192
 zap_pte_range mm/memory.c:1127 [inline]
 zap_pmd_range mm/memory.c:1162 [inline]
 zap_pud_range mm/memory.c:1191 [inline]
 zap_p4d_range mm/memory.c:1212 [inline]
 unmap_page_range+0x37b1/0x3f60 mm/memory.c:1233
 unmap_single_vma+0x43f/0x5e0 mm/memory.c:1278
 unmap_vmas+0x391/0x4b0 mm/memory.c:1310
 exit_mmap+0x50e/0xa00 mm/mmap.c:3145
 __mmput+0x148/0x590 kernel/fork.c:1066
 mmput+0x83/0x90 kernel/fork.c:1087
 exit_mm+0x6b7/0x770 kernel/exit.c:548
 do_exit+0xb12/0x3aa0 kernel/exit.c:868
 do_group_exit+0x18a/0x320 kernel/exit.c:985
 __do_sys_exit_group+0x21/0x30 kernel/exit.c:996
 __se_sys_exit_group+0x14/0x20 kernel/exit.c:994
 __x64_sys_exit_group+0x1d/0x20 kernel/exit.c:994
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:187 [inline]
 kmsan_internal_chain_origin+0xcc/0x150 mm/kmsan/kmsan.c:345
 __msan_chain_origin+0x6b/0xe0 mm/kmsan/kmsan_instr.c:190
 ___slab_alloc+0x1dbc/0x1fb0 mm/slub.c:2634
 __slab_alloc mm/slub.c:2687 [inline]
 slab_alloc_node mm/slub.c:2750 [inline]
 kmem_cache_alloc_node+0x769/0xe70 mm/slub.c:2828
 __alloc_skb+0x215/0xa10 net/core/skbuff.c:197
 alloc_skb include/linux/skbuff.h:1056 [inline]
 new_skb drivers/block/aoe/aoecmd.c:67 [inline]
 aoecmd_cfg_pkts drivers/block/aoe/aoecmd.c:426 [inline]
 aoecmd_cfg+0x205/0xa80 drivers/block/aoe/aoecmd.c:1372
 discover_timer+0x86/0xa0 drivers/block/aoe/aoemain.c:24
 call_timer_fn+0x232/0x530 kernel/time/timer.c:1322
 expire_timers kernel/time/timer.c:1366 [inline]
 __run_timers+0xcdc/0x11a0 kernel/time/timer.c:1685
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1698
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:375 [inline]
 irq_exit+0x230/0x280 kernel/softirq.c:416
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:537
 smp_apic_timer_interrupt+0x48/0x70 arch/x86/kernel/apic/apic.c:1097
 apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:835
 my_phys_addr_valid mm/kmsan/kmsan.c:444 [inline]
 my_virt_addr_valid mm/kmsan/kmsan.c:467 [inline]
 virt_to_page_or_null+0x26/0x100 mm/kmsan/kmsan.c:476
 is_bad_asm_addr mm/kmsan/kmsan_instr.c:22 [inline]
 __msan_instrument_asm_store+0x98/0x150 mm/kmsan/kmsan_instr.c:70
 arch_atomic_dec_and_test arch/x86/include/asm/atomic.h:125 [inline]
 atomic_dec_and_test include/asm-generic/atomic-instrumented.h:748 [inline]
 page_ref_dec_and_test include/linux/page_ref.h:139 [inline]
 put_page_testzero include/linux/mm.h:608 [inline]
 release_pages+0x5a0/0x15e0 mm/swap.c:760
 free_pages_and_swap_cache+0x4ce/0x4f0 mm/swap_state.c:296
 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:185 [inline]
 tlb_flush_mmu+0x6d7/0x870 mm/mmu_gather.c:192
 zap_pte_range mm/memory.c:1127 [inline]
 zap_pmd_range mm/memory.c:1162 [inline]
 zap_pud_range mm/memory.c:1191 [inline]
 zap_p4d_range mm/memory.c:1212 [inline]
 unmap_page_range+0x37b1/0x3f60 mm/memory.c:1233
 unmap_single_vma+0x43f/0x5e0 mm/memory.c:1278
 unmap_vmas+0x391/0x4b0 mm/memory.c:1310
 exit_mmap+0x50e/0xa00 mm/mmap.c:3145
 __mmput+0x148/0x590 kernel/fork.c:1066
 mmput+0x83/0x90 kernel/fork.c:1087
 exit_mm+0x6b7/0x770 kernel/exit.c:548
 do_exit+0xb12/0x3aa0 kernel/exit.c:868
 do_group_exit+0x18a/0x320 kernel/exit.c:985
 __do_sys_exit_group+0x21/0x30 kernel/exit.c:996
 __se_sys_exit_group+0x14/0x20 kernel/exit.c:994
 __x64_sys_exit_group+0x1d/0x20 kernel/exit.c:994
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:187 [inline]
 kmsan_internal_poison_shadow+0x53/0xa0 mm/kmsan/kmsan.c:146
 kmsan_slab_free+0x8d/0x100 mm/kmsan/kmsan_hooks.c:195
 slab_free_freelist_hook mm/slub.c:1472 [inline]
 slab_free mm/slub.c:3038 [inline]
 kmem_cache_free_bulk+0x3ad9/0x3f50 mm/slub.c:3163
 __kfree_skb_flush+0xb0/0x100 net/core/skbuff.c:862
 net_rx_action+0x1908/0x1950 net/core/dev.c:6436
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607
 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
==================================================================