===================================================== BUG: KMSAN: uninit-value in __skb_checksum_complete+0x371/0x480 net/core/skbuff.c:3774 __skb_checksum_complete+0x371/0x480 net/core/skbuff.c:3774 nf_ip_checksum+0x2d6/0x6e0 net/netfilter/utils.c:36 nf_nat_icmp_reply_translation+0x210/0x830 net/netfilter/nf_nat_proto.c:535 nf_nat_ipv4_fn net/netfilter/nf_nat_proto.c:594 [inline] nf_nat_ipv4_local_fn+0x1ec/0x8a0 net/netfilter/nf_nat_proto.c:757 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] __ip_local_out+0x752/0x7f0 net/ipv4/ip_output.c:120 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x6a/0x410 net/ipv4/ip_output.c:1508 ip_push_pending_frames+0xad/0x110 net/ipv4/ip_output.c:1528 icmp_push_reply+0x625/0x760 net/ipv4/icmp.c:395 __icmp_send+0x1a3f/0x1bb0 net/ipv4/icmp.c:972 ipv4_send_dest_unreach net/ipv4/route.c:1255 [inline] ipv4_link_failure+0x8c1/0xbe0 net/ipv4/route.c:1262 dst_link_failure include/net/dst.h:432 [inline] arp_error_report+0xe5/0x160 net/ipv4/arp.c:296 neigh_invalidate+0x2aa/0x700 net/core/neighbour.c:1081 neigh_timer_handler+0x1004/0x1450 net/core/neighbour.c:1172 call_timer_fn+0x4c/0x4b0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x80f/0xd90 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0x3a/0x70 kernel/time/timer.c:2404 handle_softirqs+0x168/0x6f0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x65/0x170 kernel/softirq.c:723 irq_exit_rcu+0x12/0x20 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697 pfn_valid arch/x86/include/asm/cpufeature.h:-1 [inline] kmsan_virt_addr_valid arch/x86/include/asm/kmsan.h:94 [inline] virt_to_page_or_null+0x67/0x170 mm/kmsan/shadow.c:75 kmsan_get_metadata+0xf1/0x160 mm/kmsan/shadow.c:141 kmsan_get_shadow_origin_ptr+0x4a/0xb0 mm/kmsan/shadow.c:102 get_shadow_origin_ptr mm/kmsan/instrumentation.c:38 [inline] __msan_metadata_ptr_for_store_8+0x27/0x40 mm/kmsan/instrumentation.c:94 update_stack_state+0x13a/0x1c0 arch/x86/kernel/unwind_frame.c:243 unwind_next_frame+0x116/0x350 arch/x86/kernel/unwind_frame.c:315 arch_stack_walk+0x1b0/0x280 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xc2/0x100 kernel/stacktrace.c:122 kmsan_save_stack_with_flags+0x2f/0x60 mm/kmsan/core.c:73 kmsan_alloc_page+0x169/0x210 mm/kmsan/shadow.c:195 __alloc_frozen_pages_noprof+0x6df/0xf50 mm/page_alloc.c:5263 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486 folio_alloc_mpol_noprof+0x56/0x1d0 mm/mempolicy.c:2505 shmem_alloc_folio mm/shmem.c:1913 [inline] shmem_alloc_and_add_folio+0xc54/0x1bd0 mm/shmem.c:1955 shmem_get_folio_gfp+0xad3/0x1fc0 mm/shmem.c:2579 shmem_fault+0x1e4/0x6b0 mm/shmem.c:2780 __do_fault+0x136/0x5c0 mm/memory.c:5323 do_read_fault mm/memory.c:5758 [inline] do_fault mm/memory.c:5892 [inline] do_pte_missing+0x18af/0x7420 mm/memory.c:4404 handle_pte_fault mm/memory.c:6276 [inline] __handle_mm_fault mm/memory.c:6414 [inline] handle_mm_fault+0x2d96/0x6e90 mm/memory.c:6583 faultin_page mm/gup.c:1126 [inline] __get_user_pages+0x2eff/0x5f00 mm/gup.c:1428 populate_vma_page_range mm/gup.c:1860 [inline] __mm_populate+0x626/0xab0 mm/gup.c:1963 mm_populate include/linux/mm.h:3705 [inline] vm_mmap_pgoff+0x577/0x760 mm/util.c:586 ksys_mmap_pgoff+0x16b/0x7d0 mm/mmap.c:604 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline] __x64_sys_mmap+0x19c/0x260 arch/x86/kernel/sys_x86_64.c:82 x64_sys_call+0x1b28/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:10 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: csum_partial_copy_nocheck include/net/checksum.h:53 [inline] skb_copy_and_csum_bits+0x844/0x1580 net/core/skbuff.c:3618 icmp_glue_bits+0x8e/0x2f0 net/ipv4/icmp.c:359 __ip_append_data+0x60ed/0x7030 net/ipv4/ip_output.c:1172 ip_append_data+0x144/0x220 net/ipv4/ip_output.c:1378 icmp_push_reply+0xb7/0x760 net/ipv4/icmp.c:376 __icmp_send+0x1a3f/0x1bb0 net/ipv4/icmp.c:972 ipv4_send_dest_unreach net/ipv4/route.c:1255 [inline] ipv4_link_failure+0x8c1/0xbe0 net/ipv4/route.c:1262 dst_link_failure include/net/dst.h:432 [inline] arp_error_report+0xe5/0x160 net/ipv4/arp.c:296 neigh_invalidate+0x2aa/0x700 net/core/neighbour.c:1081 neigh_timer_handler+0x1004/0x1450 net/core/neighbour.c:1172 call_timer_fn+0x4c/0x4b0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x80f/0xd90 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0x3a/0x70 kernel/time/timer.c:2404 handle_softirqs+0x168/0x6f0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x65/0x170 kernel/softirq.c:723 irq_exit_rcu+0x12/0x20 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697 Uninit was created at: __alloc_frozen_pages_noprof+0x6df/0xf50 mm/page_alloc.c:5263 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline] alloc_pages_noprof+0x101/0x280 mm/mempolicy.c:2577 skb_page_frag_refill+0x34e/0x730 net/core/sock.c:3146 sk_page_frag_refill+0x59/0x190 net/core/sock.c:3166 tcp_sendmsg_locked+0x23d8/0x76f0 net/ipv4/tcp.c:1247 tcp_sendmsg+0x4b/0x90 net/ipv4/tcp.c:1412 inet_sendmsg+0x134/0x290 net/ipv4/af_inet.c:859 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x8ea/0xb90 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2209 x64_sys_call+0x332b/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5320 Comm: syz.3.10879 Tainted: G W L syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 =====================================================