===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 tun_put_user drivers/net/tun.c:2164 [inline] tun_do_read+0x2167/0x2ae0 drivers/net/tun.c:2243 tun_chr_read_iter+0x3f0/0x670 drivers/net/tun.c:2267 call_read_iter include/linux/fs.h:2014 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8f6/0xe00 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __ia32_sys_read+0x91/0xd0 fs/read_write.c:621 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:321 do_fast_syscall_32+0x37/0x70 arch/x86/entry/common.c:346 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:384 entry_SYSENTER_compat_after_hwframe+0x70/0x7a Uninit was stored to memory at: pskb_expand_head+0x305/0x1a00 net/core/skbuff.c:2106 __skb_cow include/linux/skbuff.h:3586 [inline] skb_cow_head include/linux/skbuff.h:3620 [inline] ip_tunnel_xmit+0x36ef/0x3e80 net/ipv4/ip_tunnel.c:824 __gre_xmit+0x170/0x1b0 net/ipv4/ip_gre.c:469 erspan_xmit+0x132e/0x1e40 net/ipv4/ip_gre.c:720 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 sch_direct_xmit+0x3c5/0xd40 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3775 [inline] __dev_queue_xmit+0x2de4/0x5130 net/core/dev.c:4315 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_resolve_output+0x99a/0xab0 net/core/neighbour.c:1563 neigh_output include/net/neighbour.h:542 [inline] ip_finish_output2+0x1931/0x1b40 net/ipv4/ip_output.c:235 __ip_finish_output+0x266/0x720 ip_finish_output+0x4b/0x550 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x15f/0x3e0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x110/0x2a0 net/ipv4/ip_output.c:1489 udp_send_skb+0x1002/0x1ae0 net/ipv4/udp.c:963 udp_sendmsg+0x2efc/0x31f0 net/ipv4/udp.c:1250 udpv6_sendmsg+0x14bd/0x3f50 net/ipv6/udp.c:1390 inet6_sendmsg+0x105/0x190 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2586 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2640 __sys_sendmmsg+0x4e2/0x950 net/socket.c:2719 __compat_sys_sendmmsg net/compat.c:360 [inline] __do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline] __ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:321 do_fast_syscall_32+0x37/0x70 arch/x86/entry/common.c:346 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:384 entry_SYSENTER_compat_after_hwframe+0x70/0x7a Uninit was stored to memory at: pskb_expand_head+0x305/0x1a00 net/core/skbuff.c:2106 __skb_cow include/linux/skbuff.h:3586 [inline] skb_cow_head include/linux/skbuff.h:3620 [inline] erspan_xmit+0xe83/0x1e40 net/ipv4/ip_gre.c:692 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 sch_direct_xmit+0x3c5/0xd40 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3775 [inline] __dev_queue_xmit+0x2de4/0x5130 net/core/dev.c:4315 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_resolve_output+0x99a/0xab0 net/core/neighbour.c:1563 neigh_output include/net/neighbour.h:542 [inline] ip_finish_output2+0x1931/0x1b40 net/ipv4/ip_output.c:235 __ip_finish_output+0x266/0x720 ip_finish_output+0x4b/0x550 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x15f/0x3e0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x110/0x2a0 net/ipv4/ip_output.c:1489 udp_send_skb+0x1002/0x1ae0 net/ipv4/udp.c:963 udp_sendmsg+0x2efc/0x31f0 net/ipv4/udp.c:1250 udpv6_sendmsg+0x14bd/0x3f50 net/ipv6/udp.c:1390 inet6_sendmsg+0x105/0x190 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2586 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2640 __sys_sendmmsg+0x4e2/0x950 net/socket.c:2719 __compat_sys_sendmmsg net/compat.c:360 [inline] __do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline] __ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:321 do_fast_syscall_32+0x37/0x70 arch/x86/entry/common.c:346 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:384 entry_SYSENTER_compat_after_hwframe+0x70/0x7a Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 sock_alloc_send_skb include/net/sock.h:1884 [inline] __ip_append_data+0x49e8/0x69a0 net/ipv4/ip_output.c:1121 ip_make_skb+0x1ce/0x610 net/ipv4/ip_output.c:1555 udp_sendmsg+0x2dad/0x31f0 net/ipv4/udp.c:1245 udpv6_sendmsg+0x14bd/0x3f50 net/ipv6/udp.c:1390 inet6_sendmsg+0x105/0x190 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2586 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2640 __sys_sendmmsg+0x4e2/0x950 net/socket.c:2719 __compat_sys_sendmmsg net/compat.c:360 [inline] __do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline] __ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:321 do_fast_syscall_32+0x37/0x70 arch/x86/entry/common.c:346 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:384 entry_SYSENTER_compat_after_hwframe+0x70/0x7a Bytes 38-41 of 92 are uninitialized Memory access of size 92 starts at ffff8880a18fe8c0 Data copied to user address 00000000ff8805a8 CPU: 1 PID: 11923 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00130-g6d0dc8559c84 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 =====================================================