===================================================== BUG: KMSAN: uninit-value in update_stack_state+0x1ee/0xb40 arch/x86/kernel/unwind_frame.c:202 CPU: 1 PID: 8460 Comm: kworker/1:0 Not tainted 5.8.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 update_stack_state+0x1ee/0xb40 arch/x86/kernel/unwind_frame.c:202 unwind_next_frame+0x8c6/0xed0 arch/x86/kernel/unwind_frame.c:305 arch_stack_walk+0x338/0x3d0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x117/0x1a0 kernel/stacktrace.c:123 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116 skb_ext_maybe_cow net/core/skbuff.c:6118 [inline] skb_ext_add+0x477/0xbc0 net/core/skbuff.c:6180 nf_bridge_unshare net/bridge/br_netfilter_hooks.c:160 [inline] br_nf_forward_ip+0x19a/0x2480 net/bridge/br_netfilter_hooks.c:589 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline] nf_hook_slow+0x17b/0x460 net/netfilter/core.c:512 nf_hook include/linux/netfilter.h:262 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] __br_forward+0x96e/0xec0 net/bridge/br_forward.c:109 deliver_clone net/bridge/br_forward.c:125 [inline] br_flood+0xf26/0x1130 net/bridge/br_forward.c:232 br_handle_frame_finish+0x1e35/0x2020 net/bridge/br_input.c:166 br_nf_hook_thresh+0x576/0x700 net/bridge/br_netfilter_hooks.c:1021 br_nf_pre_routing_finish_ipv6+0xf91/0x1110 net/bridge/br_netfilter_ipv6.c:187 NF_HOOK include/linux/netfilter.h:307 [inline] br_nf_pre_routing_ipv6+0x7e2/0x8a0 net/bridge/br_netfilter_ipv6.c:236 br_nf_pre_routing+0xfe7/0x25a0 net/bridge/br_netfilter_hooks.c:505 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline] nf_hook_bridge_pre net/bridge/br_input.c:228 [inline] br_handle_frame+0xc83/0x25a0 net/bridge/br_input.c:356 __netif_receive_skb_core+0x3710/0x6520 net/core/dev.c:5175 __netif_receive_skb_one_core net/core/dev.c:5279 [inline] __netif_receive_skb+0x164/0x670 net/core/dev.c:5395 process_backlog+0x50d/0xba0 net/core/dev.c:6239 napi_poll+0x43b/0xfd0 net/core/dev.c:6684 net_rx_action+0x35c/0xd40 net/core/dev.c:6752 __do_softirq+0x2ea/0x7f5 kernel/softirq.c:293 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711 __run_on_irqstack arch/x86/include/asm/irq_stack.h:23 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:50 [inline] do_softirq_own_stack+0x7c/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:390 [inline] __irq_exit_rcu+0x226/0x270 kernel/softirq.c:420 irq_exit_rcu+0xe/0x10 kernel/softirq.c:432 sysvec_call_function_single+0x107/0x130 arch/x86/kernel/smp.c:243 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:601 RIP: 0010:_raw_spin_unlock_irqrestore+0x4b/0x70 kernel/locking/spinlock.c:192 Code: 00 8b b8 88 0c 00 00 48 8b 00 48 85 c0 75 28 48 89 df e8 b8 6e 4b f1 c6 00 00 c6 03 00 4d 85 e4 75 1c 4c 89 7d d8 ff 75 d8 9d <48> 83 c4 08 5b 41 5c 41 5e 41 5f 5d c3 e8 53 74 4b f1 eb d1 44 89 RSP: 0018:ffff88812df63148 EFLAGS: 00000286 RAX: ffff888218348708 RBX: ffffffff9394f708 RCX: 0000000205941708 RDX: ffff888205941708 RSI: 0000000000000040 RDI: ffffffff9394f708 RBP: ffff88812df63170 R08: ffffea000000000f R09: ffff88812fffa000 R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880bb8de558 R14: 0000000000000000 R15: 0000000000000286 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline] usb_hcd_poll_rh_status+0x6d5/0xa40 drivers/usb/core/hcd.c:783 dummy_hub_control+0x21cd/0x2420 drivers/usb/gadget/udc/dummy_hcd.c:2323 rh_call_control drivers/usb/core/hcd.c:683 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:842 [inline] usb_hcd_submit_urb+0x20dc/0x4050 drivers/usb/core/hcd.c:1543 usb_submit_urb+0x2411/0x2470 drivers/usb/core/urb.c:572 usb_start_wait_urb+0x155/0x4c0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x4dc/0x820 drivers/usb/core/message.c:153 hub_port_disable+0x857/0xc40 drivers/usb/core/hub.c:432 hub_port_init+0x40fa/0x5ec0 drivers/usb/core/hub.c:4876 hub_port_connect drivers/usb/core/hub.c:5140 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x5413/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Local variable ----prefix@msg_print_text created at: msg_print_text+0xf1/0xb50 kernel/printk/printk.c:1344 msg_print_text+0xf1/0xb50 kernel/printk/printk.c:1344 =====================================================