===================================================== BUG: KMSAN: uninit-value in __skb_checksum_complete+0x421/0x630 net/core/skbuff.c:2846 CPU: 1 PID: 8265 Comm: syz-executor.0 Not tainted 5.10.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197 __skb_checksum_complete+0x421/0x630 net/core/skbuff.c:2846 nf_ip_checksum+0x686/0x7e0 net/netfilter/utils.c:36 nf_nat_icmp_reply_translation+0x3a4/0xb50 net/netfilter/nf_nat_proto.c:578 nf_nat_ipv4_fn net/netfilter/nf_nat_proto.c:637 [inline] nf_nat_ipv4_local_fn+0x278/0xa30 net/netfilter/nf_nat_proto.c:708 nf_hook_entry_hookfn include/linux/netfilter.h:136 [inline] nf_hook_slow+0x17b/0x460 net/netfilter/core.c:589 nf_hook include/linux/netfilter.h:256 [inline] __ip_local_out+0x7a6/0x860 net/ipv4/ip_output.c:115 ip_local_out net/ipv4/ip_output.c:124 [inline] ip_send_skb net/ipv4/ip_output.c:1568 [inline] ip_push_pending_frames+0x16d/0x440 net/ipv4/ip_output.c:1588 icmp_push_reply+0x7a2/0x810 net/ipv4/icmp.c:393 __icmp_send+0x2a98/0x3a90 net/ipv4/icmp.c:762 ipv4_send_dest_unreach net/ipv4/route.c:1232 [inline] ipv4_link_failure+0x915/0xdb0 net/ipv4/route.c:1239 dst_link_failure include/net/dst.h:426 [inline] arp_error_report+0x120/0x1c0 net/ipv4/arp.c:293 neigh_invalidate+0x359/0x8f0 net/core/neighbour.c:993 neigh_timer_handler+0xcce/0x1770 net/core/neighbour.c:1080 call_timer_fn+0x7d/0x450 kernel/time/timer.c:1410 expire_timers+0x318/0x6c0 kernel/time/timer.c:1455 __run_timers+0x624/0x9e0 kernel/time/timer.c:1747 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1760 __do_softirq+0x1a9/0x6fa kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu+0x226/0x270 kernel/softirq.c:423 irq_exit_rcu+0xe/0x10 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x106/0x130 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0033:0x46107a Code: 25 18 00 00 00 00 74 01 f0 48 0f b1 3d ef a5 25 01 48 39 c2 75 da f3 c3 0f 1f 84 00 00 00 00 00 48 63 ff b8 e4 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 f3 c3 0f 1f 40 00 48 c7 c2 d4 ff ff ff f7 RSP: 002b:00000000016afd58 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000002ee0 RCX: 000000000046107a RDX: 0000000000002ee0 RSI: 00000000016afd60 RDI: 0000000000000001 RBP: 0000000000148705 R08: 0000000000000000 R09: 0000000002c0f940 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000006ac R13: 0000000000000001 R14: 0000000000000032 R15: 0000000000148679 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289 kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:226 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:246 __msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110 csum_partial_copy_nocheck include/net/checksum.h:51 [inline] skb_copy_and_csum_bits+0x23e/0x13e0 net/core/skbuff.c:2733 icmp_glue_bits+0x155/0x400 net/ipv4/icmp.c:356 __ip_append_data+0x4f8e/0x6210 net/ipv4/ip_output.c:1139 ip_append_data+0x326/0x490 net/ipv4/ip_output.c:1323 icmp_push_reply+0x1f8/0x810 net/ipv4/icmp.c:374 __icmp_send+0x2a98/0x3a90 net/ipv4/icmp.c:762 ipv4_send_dest_unreach net/ipv4/route.c:1232 [inline] ipv4_link_failure+0x915/0xdb0 net/ipv4/route.c:1239 dst_link_failure include/net/dst.h:426 [inline] arp_error_report+0x120/0x1c0 net/ipv4/arp.c:293 neigh_invalidate+0x359/0x8f0 net/core/neighbour.c:993 neigh_timer_handler+0xcce/0x1770 net/core/neighbour.c:1080 call_timer_fn+0x7d/0x450 kernel/time/timer.c:1410 expire_timers+0x318/0x6c0 kernel/time/timer.c:1455 __run_timers+0x624/0x9e0 kernel/time/timer.c:1747 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1760 __do_softirq+0x1a9/0x6fa kernel/softirq.c:298 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289 kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:226 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:246 __msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110 pskb_expand_head+0x3eb/0x1df0 net/core/skbuff.c:1631 __skb_cow include/linux/skbuff.h:3165 [inline] skb_cow_head include/linux/skbuff.h:3199 [inline] ip_tunnel_xmit+0x2fe7/0x3a70 net/ipv4/ip_tunnel.c:800 __gre_xmit net/ipv4/ip_gre.c:466 [inline] erspan_xmit+0x20ec/0x32b0 net/ipv4/ip_gre.c:702 __netdev_start_xmit include/linux/netdevice.h:4718 [inline] netdev_start_xmit include/linux/netdevice.h:4732 [inline] xmit_one+0x2b9/0x770 net/core/dev.c:3564 dev_hard_start_xmit+0x195/0x430 net/core/dev.c:3580 sch_direct_xmit+0x5c7/0x1a30 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x361/0x4a0 net/sched/sch_generic.c:385 qdisc_run include/net/pkt_sched.h:131 [inline] __dev_xmit_skb net/core/dev.c:3755 [inline] __dev_queue_xmit+0x2574/0x4520 net/core/dev.c:4108 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4173 neigh_resolve_output+0xc15/0xcf0 net/core/neighbour.c:1489 neigh_output include/net/neighbour.h:509 [inline] ip_finish_output2+0x1d3a/0x2980 net/ipv4/ip_output.c:230 __ip_finish_output+0xcf8/0x1080 net/ipv4/ip_output.c:308 ip_finish_output+0x143/0x4a0 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip_output+0x32e/0x6d0 net/ipv4/ip_output.c:432 dst_output include/net/dst.h:443 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] ip_send_skb+0x192/0x340 net/ipv4/ip_output.c:1568 udp_send_skb+0x1568/0x1be0 net/ipv4/udp.c:948 udp_sendmsg+0x3c89/0x48c0 net/ipv4/udp.c:1235 udpv6_sendmsg+0x236a/0x54a0 net/ipv6/udp.c:1344 inet6_sendmsg+0x15b/0x1d0 net/ipv6/af_inet6.c:638 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg net/socket.c:671 [inline] ____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353 ___sys_sendmsg net/socket.c:2407 [inline] __sys_sendmmsg+0xa56/0x1060 net/socket.c:2497 __do_sys_sendmmsg net/socket.c:2526 [inline] __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2523 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2523 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76 slab_alloc_node mm/slub.c:2906 [inline] __kmalloc_node_track_caller+0xc61/0x15f0 mm/slub.c:4512 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0x309/0xae0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1094 [inline] alloc_skb_with_frags+0x1f3/0xc20 net/core/skbuff.c:5832 sock_alloc_send_pskb+0xc73/0xe40 net/core/sock.c:2329 sock_alloc_send_skb+0xca/0xe0 net/core/sock.c:2346 __ip_append_data+0x4184/0x6210 net/ipv4/ip_output.c:1097 ip_make_skb+0x409/0x920 net/ipv4/ip_output.c:1634 udp_sendmsg+0x3b8a/0x48c0 net/ipv4/udp.c:1230 udpv6_sendmsg+0x236a/0x54a0 net/ipv6/udp.c:1344 inet6_sendmsg+0x15b/0x1d0 net/ipv6/af_inet6.c:638 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg net/socket.c:671 [inline] ____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353 ___sys_sendmsg net/socket.c:2407 [inline] __sys_sendmmsg+0xa56/0x1060 net/socket.c:2497 __do_sys_sendmmsg net/socket.c:2526 [inline] __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2523 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2523 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48 entry_SYSCALL_64_after_hwframe+0x44/0xa9 =====================================================