===================================================== BUG: KMSAN: uninit-value in vring_map_one_sg drivers/virtio/virtio_ring.c:341 [inline] BUG: KMSAN: uninit-value in virtqueue_add_split drivers/virtio/virtio_ring.c:546 [inline] BUG: KMSAN: uninit-value in virtqueue_add+0x1d55/0x6210 drivers/virtio/virtio_ring.c:1797 vring_map_one_sg drivers/virtio/virtio_ring.c:341 [inline] virtqueue_add_split drivers/virtio/virtio_ring.c:546 [inline] virtqueue_add+0x1d55/0x6210 drivers/virtio/virtio_ring.c:1797 virtqueue_add_outbuf+0x91/0xc0 drivers/virtio/virtio_ring.c:1854 xmit_skb drivers/net/virtio_net.c:1768 [inline] start_xmit+0x13fe/0x2200 drivers/net/virtio_net.c:1795 __netdev_start_xmit include/linux/netdevice.h:4775 [inline] netdev_start_xmit include/linux/netdevice.h:4789 [inline] xmit_one+0x1de/0x6a0 net/core/dev.c:3532 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3548 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0x1156/0x1a70 net/core/dev.c:3759 __dev_queue_xmit+0x118d/0x2ed0 net/core/dev.c:4141 dev_queue_xmit+0x2b/0x30 net/core/dev.c:4209 neigh_resolve_output+0x974/0xa00 net/core/neighbour.c:1528 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x1916/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 iptunnel_xmit+0x744/0xcd0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x3267/0x3610 net/ipv4/ip_tunnel.c:811 __gre_xmit net/ipv4/ip_gre.c:469 [inline] erspan_xmit+0x13ea/0x2020 net/ipv4/ip_gre.c:711 __netdev_start_xmit include/linux/netdevice.h:4775 [inline] netdev_start_xmit include/linux/netdevice.h:4789 [inline] xmit_one+0x1de/0x6a0 net/core/dev.c:3532 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3548 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0x1156/0x1a70 net/core/dev.c:3759 __dev_queue_xmit+0x118d/0x2ed0 net/core/dev.c:4141 dev_queue_xmit+0x2b/0x30 net/core/dev.c:4209 neigh_resolve_output+0x974/0xa00 net/core/neighbour.c:1528 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x1916/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 igmpv3_sendpack net/ipv4/igmp.c:424 [inline] igmpv3_send_cr net/ipv4/igmp.c:719 [inline] igmp_ifc_timer_expire+0x15c8/0x1f50 net/ipv4/igmp.c:808 call_timer_fn+0x43/0x480 kernel/time/timer.c:1421 expire_timers+0x272/0x610 kernel/time/timer.c:1466 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1737 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1750 __do_softirq+0x1cc/0x7fb kernel/softirq.c:558 invoke_softirq+0x8f/0x100 kernel/softirq.c:432 __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0x5a/0x110 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 kmsan_get_shadow_origin_ptr+0x1/0xf0 mm/kmsan/shadow.c:84 ima_template_desc_current+0x31/0x2b0 security/integrity/ima/ima_template.c:272 ima_match_policy+0xaf/0x2d50 security/integrity/ima/ima_policy.c:701 ima_get_action+0x87/0xa0 security/integrity/ima/ima_api.c:198 process_measurement+0x38c/0x36d0 security/integrity/ima/ima_main.c:227 ima_file_mmap+0xfe/0x170 security/integrity/ima/ima_main.c:412 security_mmap_file+0x2bc/0x300 security/security.c:1602 vm_mmap_pgoff+0xed/0x450 mm/util.c:515 ksys_mmap_pgoff+0x623/0x760 mm/mmap.c:1628 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:96 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline] __x64_sys_mmap+0x169/0x200 arch/x86/kernel/sys_x86_64.c:89 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was stored to memory at: pskb_expand_head+0x2c2/0x1a00 net/core/skbuff.c:1709 __skb_cow include/linux/skbuff.h:3476 [inline] skb_cow_head include/linux/skbuff.h:3510 [inline] ip_tunnel_xmit+0x2ff4/0x3610 net/ipv4/ip_tunnel.c:804 __gre_xmit net/ipv4/ip_gre.c:469 [inline] erspan_xmit+0x13ea/0x2020 net/ipv4/ip_gre.c:711 __netdev_start_xmit include/linux/netdevice.h:4775 [inline] netdev_start_xmit include/linux/netdevice.h:4789 [inline] xmit_one+0x1de/0x6a0 net/core/dev.c:3532 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3548 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0x1156/0x1a70 net/core/dev.c:3759 __dev_queue_xmit+0x118d/0x2ed0 net/core/dev.c:4141 dev_queue_xmit+0x2b/0x30 net/core/dev.c:4209 neigh_resolve_output+0x974/0xa00 net/core/neighbour.c:1528 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x1916/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 igmpv3_sendpack net/ipv4/igmp.c:424 [inline] igmpv3_send_cr net/ipv4/igmp.c:719 [inline] igmp_ifc_timer_expire+0x15c8/0x1f50 net/ipv4/igmp.c:808 call_timer_fn+0x43/0x480 kernel/time/timer.c:1421 expire_timers+0x272/0x610 kernel/time/timer.c:1466 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1737 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1750 __do_softirq+0x1cc/0x7fb kernel/softirq.c:558 Uninit was created at: slab_post_alloc_hook mm/slab.h:754 [inline] slab_alloc_node mm/slub.c:3232 [inline] __kmalloc_node_track_caller+0x86c/0x1230 mm/slub.c:4963 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x353/0xce0 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1300 [inline] igmpv3_newpack+0x19d/0x1440 net/ipv4/igmp.c:359 add_grhead+0x86/0x390 net/ipv4/igmp.c:440 add_grec+0x2185/0x2380 net/ipv4/igmp.c:573 igmpv3_send_cr net/ipv4/igmp.c:671 [inline] igmp_ifc_timer_expire+0x44f/0x1f50 net/ipv4/igmp.c:808 call_timer_fn+0x43/0x480 kernel/time/timer.c:1421 expire_timers+0x272/0x610 kernel/time/timer.c:1466 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1737 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1750 __do_softirq+0x1cc/0x7fb kernel/softirq.c:558 Bytes 38-39 of 104 are uninitialized Memory access of size 104 starts at ffff88806aae60c0 CPU: 1 PID: 29114 Comm: sed Not tainted 5.18.0-syzkaller-16265-g365ac3bfacfb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 =====================================================