KMSAN: uninit-value in kfree (2)

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KMSAN: uninit-value in kfree kernfs				1	2062d	2062d	0/26	closed as invalid on 2018/09/21 08:23
==================================================================
BUG: KMSAN: uninit-value in do_slab_free mm/slub.c:2993 [inline]
BUG: KMSAN: uninit-value in slab_free mm/slub.c:3016 [inline]
BUG: KMSAN: uninit-value in kfree+0x4f3/0x2870 mm/slub.c:3976
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.2.0-rc4+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 lib/dump_stack.c:113
 kmsan_report+0x162/0x2d0 mm/kmsan/kmsan_report.c:109
 __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:294
 do_slab_free mm/slub.c:2993 [inline]
 slab_free mm/slub.c:3016 [inline]
 kfree+0x4f3/0x2870 mm/slub.c:3976
 skb_free_head net/core/skbuff.c:588 [inline]
 skb_release_data+0xaa8/0xb50 net/core/skbuff.c:608
 skb_release_all net/core/skbuff.c:662 [inline]
 __kfree_skb+0x8a/0x210 net/core/skbuff.c:676
 consume_skb+0x2b0/0x2e0 net/core/skbuff.c:736
 neigh_probe net/core/neighbour.c:1012 [inline]
 __neigh_event_send+0x119e/0x1a80 net/core/neighbour.c:1168
 neigh_event_send include/net/neighbour.h:445 [inline]
 neigh_resolve_output+0x25e/0xb50 net/core/neighbour.c:1470
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x2129/0x2670 net/ipv6/ip6_output.c:116
 ip6_finish_output+0xae4/0xbc0 net/ipv6/ip6_output.c:150
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x5d3/0x720 net/ipv6/ip6_output.c:167
 dst_output include/net/dst.h:433 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x1083/0x15e0 net/ipv6/ndisc.c:504
 ndisc_send_ns+0xda8/0xe10 net/ipv6/ndisc.c:646
 addrconf_dad_work+0x1a3e/0x26e0 net/ipv6/addrconf.c:4117
 process_one_work+0x1572/0x1f00 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:200 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:212 [inline]
 kmsan_internal_chain_origin+0xcc/0x150 mm/kmsan/kmsan.c:367
 __msan_chain_origin+0x6b/0xe0 mm/kmsan/kmsan_instr.c:190
 ___slab_alloc+0x1dbc/0x1fb0 mm/slub.c:2613
 __slab_alloc mm/slub.c:2666 [inline]
 slab_alloc_node mm/slub.c:2729 [inline]
 slab_alloc mm/slub.c:2771 [inline]
 __kmalloc+0x375/0x3a0 mm/slub.c:3814
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc+0x7c/0xe0 include/linux/slab.h:742
 neigh_alloc net/core/neighbour.c:402 [inline]
 ___neigh_create+0x8e5/0x2990 net/core/neighbour.c:580
 __neigh_create+0xbd/0xd0 net/core/neighbour.c:672
 ip6_finish_output2+0x149a/0x2670 net/ipv6/ip6_output.c:113
 ip6_finish_output+0xae4/0xbc0 net/ipv6/ip6_output.c:150
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x5d3/0x720 net/ipv6/ip6_output.c:167
 dst_output include/net/dst.h:433 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x1083/0x15e0 net/ipv6/ndisc.c:504
 ndisc_send_ns+0xda8/0xe10 net/ipv6/ndisc.c:646
 addrconf_dad_work+0x1a3e/0x26e0 net/ipv6/addrconf.c:4117
 process_one_work+0x1572/0x1f00 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:200 [inline]
 kmsan_internal_poison_shadow+0x53/0xa0 mm/kmsan/kmsan.c:159
 kmsan_kmalloc+0xa4/0x130 mm/kmsan/kmsan_hooks.c:178
 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:187
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc_node mm/slub.c:2763 [inline]
 __kmalloc_node_track_caller+0xcba/0xf30 mm/slub.c:4390
 __kmalloc_reserve net/core/skbuff.c:138 [inline]
 __alloc_skb+0x306/0xa10 net/core/skbuff.c:206
 alloc_skb include/linux/skbuff.h:1055 [inline]
 ndisc_alloc_skb+0x1ba/0x5b0 net/ipv6/ndisc.c:416
 ndisc_send_ns+0x5e9/0xe10 net/ipv6/ndisc.c:622
 addrconf_dad_work+0x1a3e/0x26e0 net/ipv6/addrconf.c:4117
 process_one_work+0x1572/0x1f00 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
==================================================================