===================================================== BUG: KMSAN: uninit-value in kmsan_check_skb+0x3c/0x240 mm/kmsan/kmsan_hooks.c:275 CPU: 0 PID: 17440 Comm: kworker/u4:2 Not tainted 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:121 kmsan_internal_check_memory+0x1f5/0x500 mm/kmsan/kmsan.c:399 kmsan_check_skb+0x3c/0x240 mm/kmsan/kmsan_hooks.c:275 pfifo_fast_dequeue+0x1031/0x1190 net/sched/sch_generic.c:659 dequeue_skb+0x4ad/0x3680 net/sched/sch_generic.c:264 qdisc_restart net/sched/sch_generic.c:367 [inline] __qdisc_run+0x101/0x490 net/sched/sch_generic.c:385 qdisc_run include/net/pkt_sched.h:136 [inline] __dev_xmit_skb net/core/dev.c:3807 [inline] __dev_queue_xmit+0x26ad/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 br_dev_queue_push_xmit+0xbda/0xcc0 net/bridge/br_forward.c:51 NF_HOOK include/linux/netfilter.h:301 [inline] br_forward_finish net/bridge/br_forward.c:64 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] __br_forward+0x9bd/0xe90 net/bridge/br_forward.c:108 deliver_clone net/bridge/br_forward.c:124 [inline] maybe_deliver net/bridge/br_forward.c:180 [inline] br_flood+0xcbe/0x1130 net/bridge/br_forward.c:222 br_handle_frame_finish+0x1c31/0x20e0 net/bridge/br_input.c:162 nf_hook_bridge_pre net/bridge/br_input.c:246 [inline] br_handle_frame+0x1526/0x2830 net/bridge/br_input.c:367 __netif_receive_skb_core+0x1f9d/0x65a0 net/core/dev.c:5279 __netif_receive_skb_one_core net/core/dev.c:5382 [inline] __netif_receive_skb+0xf2/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 do_softirq+0x123/0x1c0 kernel/softirq.c:248 __local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:745 [inline] __dev_queue_xmit+0x3b4a/0x4600 net/core/dev.c:4221 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 batadv_send_skb_packet+0x622/0x970 net/batman-adv/send.c:108 batadv_send_broadcast_skb+0x76/0x90 net/batman-adv/send.c:127 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:419 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0xb2d/0xef0 net/batman-adv/bat_iv_ogm.c:1711 process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421 kthread+0x521/0x560 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:120 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:288 kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:225 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:245 __msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110 pskb_expand_head+0x3d6/0x1e20 net/core/skbuff.c:1685 __skb_cow include/linux/skbuff.h:3232 [inline] skb_cow_head include/linux/skbuff.h:3266 [inline] batadv_skb_head_push+0x2cc/0x410 net/batman-adv/soft-interface.c:73 batadv_send_skb_packet+0x1ed/0x970 net/batman-adv/send.c:86 batadv_send_broadcast_skb+0x76/0x90 net/batman-adv/send.c:127 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:419 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0xb2d/0xef0 net/batman-adv/bat_iv_ogm.c:1711 process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421 kthread+0x521/0x560 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:120 [inline] kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:103 kmsan_slab_alloc+0x8e/0xe0 mm/kmsan/kmsan_hooks.c:76 slab_alloc_node mm/slub.c:2922 [inline] __kmalloc_node_track_caller+0xa4f/0x1470 mm/slub.c:4609 kmalloc_reserve net/core/skbuff.c:353 [inline] __alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424 __netdev_alloc_skb+0x45d/0x810 net/core/skbuff.c:491 __netdev_alloc_skb_ip_align include/linux/skbuff.h:2884 [inline] netdev_alloc_skb_ip_align include/linux/skbuff.h:2894 [inline] batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:558 [inline] batadv_iv_ogm_queue_add+0x1376/0x1c40 net/batman-adv/bat_iv_ogm.c:670 batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:849 [inline] batadv_iv_ogm_schedule+0x12cd/0x16b0 net/batman-adv/bat_iv_ogm.c:869 batadv_iv_send_outstanding_bat_ogm_packet+0xd6e/0xef0 net/batman-adv/bat_iv_ogm.c:1723 process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421 kthread+0x521/0x560 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Bytes 52-53 of 74 are uninitialized Memory access of size 74 starts at ffff88811bd5cc40 =====================================================