===================================================== BUG: KMSAN: uninit-value in vring_map_one_sg drivers/virtio/virtio_ring.c:341 [inline] BUG: KMSAN: uninit-value in virtqueue_add_split drivers/virtio/virtio_ring.c:546 [inline] BUG: KMSAN: uninit-value in virtqueue_add+0x1d8a/0x6220 drivers/virtio/virtio_ring.c:1818 vring_map_one_sg drivers/virtio/virtio_ring.c:341 [inline] virtqueue_add_split drivers/virtio/virtio_ring.c:546 [inline] virtqueue_add+0x1d8a/0x6220 drivers/virtio/virtio_ring.c:1818 virtqueue_add_outbuf+0x91/0xc0 drivers/virtio/virtio_ring.c:1875 xmit_skb drivers/net/virtio_net.c:1768 [inline] start_xmit+0x13fe/0x2200 drivers/net/virtio_net.c:1795 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one+0x14e/0x5f0 net/core/dev.c:3590 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3606 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0xbe9/0x19e0 net/core/dev.c:3817 __dev_queue_xmit+0x12cb/0x31f0 net/core/dev.c:4221 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_hh_output include/net/neighbour.h:533 [inline] neigh_output include/net/neighbour.h:547 [inline] ip_finish_output2+0x188a/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 iptunnel_xmit+0x744/0xcd0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x3267/0x3610 net/ipv4/ip_tunnel.c:811 __gre_xmit net/ipv4/ip_gre.c:469 [inline] erspan_xmit+0x13d8/0x1f00 net/ipv4/ip_gre.c:715 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one+0x14e/0x5f0 net/core/dev.c:3590 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3606 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0xbe9/0x19e0 net/core/dev.c:3817 __dev_queue_xmit+0x12cb/0x31f0 net/core/dev.c:4221 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_hh_output include/net/neighbour.h:533 [inline] neigh_output include/net/neighbour.h:547 [inline] ip_finish_output2+0x188a/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 igmpv3_sendpack net/ipv4/igmp.c:424 [inline] igmpv3_send_cr net/ipv4/igmp.c:720 [inline] igmp_ifc_timer_expire+0x15c8/0x1f50 net/ipv4/igmp.c:810 call_timer_fn+0x43/0x480 kernel/time/timer.c:1474 expire_timers+0x272/0x610 kernel/time/timer.c:1519 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1803 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 invoke_softirq+0x8f/0x100 kernel/softirq.c:445 __irq_exit_rcu kernel/softirq.c:650 [inline] irq_exit_rcu+0x5a/0x110 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 kmsan_internal_is_module_addr+0x0/0x20 mm/kmsan/core.c:468 kmsan_get_shadow_origin_ptr+0x49/0xa0 mm/kmsan/shadow.c:103 get_shadow_origin_ptr mm/kmsan/instrumentation.c:35 [inline] __msan_metadata_ptr_for_store_8+0x23/0x40 mm/kmsan/instrumentation.c:77 slab_free_freelist_hook+0xc5/0x650 mm/slub.c:1788 slab_free mm/slub.c:3551 [inline] kmem_cache_free+0x279/0xa40 mm/slub.c:3568 __kfree_skb+0x1ed/0x240 net/core/skbuff.c:757 consume_skb+0x96/0x290 net/core/skbuff.c:917 nsim_dev_trap_report drivers/net/netdevsim/dev.c:815 [inline] nsim_dev_trap_report_work+0xb38/0x11d0 drivers/net/netdevsim/dev.c:840 process_one_work+0xb27/0x13e0 kernel/workqueue.c:2289 worker_thread+0x1076/0x1d60 kernel/workqueue.c:2436 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Uninit was stored to memory at: pskb_expand_head+0x2c2/0x1a00 net/core/skbuff.c:1704 __skb_cow include/linux/skbuff.h:3633 [inline] skb_cow_head include/linux/skbuff.h:3667 [inline] ip_tunnel_xmit+0x2ff4/0x3610 net/ipv4/ip_tunnel.c:804 __gre_xmit net/ipv4/ip_gre.c:469 [inline] erspan_xmit+0x13d8/0x1f00 net/ipv4/ip_gre.c:715 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one+0x14e/0x5f0 net/core/dev.c:3590 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3606 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0xbe9/0x19e0 net/core/dev.c:3817 __dev_queue_xmit+0x12cb/0x31f0 net/core/dev.c:4221 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_hh_output include/net/neighbour.h:533 [inline] neigh_output include/net/neighbour.h:547 [inline] ip_finish_output2+0x188a/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 igmpv3_sendpack net/ipv4/igmp.c:424 [inline] igmpv3_send_cr net/ipv4/igmp.c:720 [inline] igmp_ifc_timer_expire+0x15c8/0x1f50 net/ipv4/igmp.c:810 call_timer_fn+0x43/0x480 kernel/time/timer.c:1474 expire_timers+0x272/0x610 kernel/time/timer.c:1519 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1803 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 Uninit was created at: slab_post_alloc_hook mm/slab.h:755 [inline] slab_alloc_node mm/slub.c:3258 [inline] __kmalloc_node_track_caller+0x86c/0x1230 mm/slub.c:4995 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x34a/0xd70 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1426 [inline] igmpv3_newpack+0x19d/0x1440 net/ipv4/igmp.c:359 add_grhead+0x86/0x390 net/ipv4/igmp.c:440 add_grec+0x2185/0x2380 net/ipv4/igmp.c:574 igmpv3_send_cr net/ipv4/igmp.c:672 [inline] igmp_ifc_timer_expire+0x44f/0x1f50 net/ipv4/igmp.c:810 call_timer_fn+0x43/0x480 kernel/time/timer.c:1474 expire_timers+0x272/0x610 kernel/time/timer.c:1519 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1803 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 Bytes 38-39 of 104 are uninitialized Memory access of size 104 starts at ffff888094d850c0 CPU: 1 PID: 114 Comm: kworker/1:2 Not tainted 5.19.0-rc8-syzkaller-32502-gf469ea3cc7c5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Workqueue: events nsim_dev_trap_report_work =====================================================