=====================================================
BUG: KMSAN: use-after-free in do_slab_free mm/slub.c:3024 [inline]
BUG: KMSAN: use-after-free in slab_free mm/slub.c:3047 [inline]
BUG: KMSAN: use-after-free in kmem_cache_free+0x3df/0x2b70 mm/slub.c:3062
CPU: 0 PID: 13799 Comm: kworker/0:9 Not tainted 5.4.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events rt6_probe_deferred
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 lib/dump_stack.c:113
 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:245
 do_slab_free mm/slub.c:3024 [inline]
 slab_free mm/slub.c:3047 [inline]
 kmem_cache_free+0x3df/0x2b70 mm/slub.c:3062
 kfree_skbmem net/core/skbuff.c:644 [inline]
 __kfree_skb net/core/skbuff.c:680 [inline]
 kfree_skb+0x473/0x4c0 net/core/skbuff.c:697
 packet_rcv+0xcfd/0x2110 net/packet/af_packet.c:2148
 dev_queue_xmit_nit+0x1125/0x1200 net/core/dev.c:2077
 xmit_one net/core/dev.c:3276 [inline]
 dev_hard_start_xmit+0x21e/0xab0 net/core/dev.c:3296
 __dev_queue_xmit+0x35b6/0x4200 net/core/dev.c:3873
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3906
 neigh_resolve_output+0xab7/0xb50 net/core/neighbour.c:1490
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x2129/0x2670 net/ipv6/ip6_output.c:116
 __ip6_finish_output+0x83d/0x8f0 net/ipv6/ip6_output.c:142
 ip6_finish_output+0x2db/0x420 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x5d3/0x720 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x1083/0x15e0 net/ipv6/ndisc.c:505
 ndisc_send_ns+0xda8/0xe10 net/ipv6/ndisc.c:647
 rt6_probe_deferred+0x13c/0x240 net/ipv6/route.c:615
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151 [inline]
 kmsan_internal_chain_origin+0xbd/0x180 mm/kmsan/kmsan.c:319
 __msan_chain_origin+0x6b/0xd0 mm/kmsan/kmsan_instr.c:179
 ___slab_alloc+0x1dbc/0x1fb0 mm/slub.c:2636
 __slab_alloc mm/slub.c:2689 [inline]
 slab_alloc_node mm/slub.c:2763 [inline]
 slab_alloc mm/slub.c:2808 [inline]
 kmem_cache_alloc+0xadf/0xd20 mm/slub.c:2813
 skb_clone+0x326/0x5d0 net/core/skbuff.c:1448
 dev_queue_xmit_nit+0x539/0x1200 net/core/dev.c:2045
 xmit_one net/core/dev.c:3276 [inline]
 dev_hard_start_xmit+0x21e/0xab0 net/core/dev.c:3296
 __dev_queue_xmit+0x35b6/0x4200 net/core/dev.c:3873
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3906
 neigh_resolve_output+0xab7/0xb50 net/core/neighbour.c:1490
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x2129/0x2670 net/ipv6/ip6_output.c:116
 __ip6_finish_output+0x83d/0x8f0 net/ipv6/ip6_output.c:142
 ip6_finish_output+0x2db/0x420 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x5d3/0x720 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x1083/0x15e0 net/ipv6/ndisc.c:505
 ndisc_send_ns+0xda8/0xe10 net/ipv6/ndisc.c:647
 rt6_probe_deferred+0x13c/0x240 net/ipv6/route.c:615
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151 [inline]
 kmsan_internal_poison_shadow+0x60/0x120 mm/kmsan/kmsan.c:134
 kmsan_slab_free+0x8d/0xf0 mm/kmsan/kmsan_hooks.c:109
 slab_free_freelist_hook mm/slub.c:1473 [inline]
 slab_free mm/slub.c:3046 [inline]
 kmem_cache_free_bulk+0x3ad9/0x3f10 mm/slub.c:3171
 __kfree_skb_flush+0xb0/0x100 net/core/skbuff.c:862
 net_rx_action+0x1a5e/0x1aa0 net/core/dev.c:6483
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 do_softirq_own_stack+0x49/0x80 arch/x86/entry/entry_64.S:1093
 do_softirq kernel/softirq.c:338 [inline]
 __local_bh_enable_ip+0x184/0x1d0 kernel/softirq.c:190
 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
 update_defense_level+0xcc7/0xd10 net/netfilter/ipvs/ip_vs_ctl.c:211
 defense_work_handler+0x42/0x120 net/netfilter/ipvs/ip_vs_ctl.c:225
 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 kernel/kthread.c:256
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
=====================================================