===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:167 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x376/0x1c60 lib/iov_iter.c:316 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copyout lib/iov_iter.c:167 [inline] _copy_to_iter+0x376/0x1c60 lib/iov_iter.c:316 copy_to_iter include/linux/uio.h:194 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:513 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:527 tun_put_user drivers/net/tun.c:2159 [inline] tun_do_read+0x2167/0x2ae0 drivers/net/tun.c:2238 tun_chr_read_iter+0x3f0/0x670 drivers/net/tun.c:2262 call_read_iter include/linux/fs.h:1865 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8fc/0xf50 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __ia32_sys_read+0x91/0xd0 fs/read_write.c:621 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was stored to memory at: pskb_expand_head+0x305/0x1a10 net/core/skbuff.c:2050 __skb_cow include/linux/skbuff.h:3571 [inline] skb_cow_head include/linux/skbuff.h:3605 [inline] ip_tunnel_xmit+0x36ef/0x3e80 net/ipv4/ip_tunnel.c:824 __gre_xmit+0x170/0x1b0 net/ipv4/ip_gre.c:469 erspan_xmit+0x132e/0x1e40 net/ipv4/ip_gre.c:717 __netdev_start_xmit include/linux/netdevice.h:4910 [inline] netdev_start_xmit include/linux/netdevice.h:4924 [inline] xmit_one net/core/dev.c:3537 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3553 sch_direct_xmit+0x3c5/0xd40 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3764 [inline] __dev_queue_xmit+0x2f1c/0x50f0 net/core/dev.c:4169 dev_queue_xmit include/linux/netdevice.h:3088 [inline] neigh_resolve_output+0x99a/0xab0 net/core/neighbour.c:1552 neigh_output include/net/neighbour.h:544 [inline] ip_finish_output2+0x1807/0x1a10 net/ipv4/ip_output.c:230 ip_do_fragment+0x115c/0x2790 net/ipv4/ip_output.c:915 ip_fragment+0x201/0x2f0 __ip_finish_output+0x4d7/0x720 net/ipv4/ip_output.c:306 ip_finish_output+0x4b/0x420 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip_output+0x1f3/0x4e0 net/ipv4/ip_output.c:432 dst_output include/net/dst.h:458 [inline] ip_local_out+0xe9/0x140 net/ipv4/ip_output.c:127 iptunnel_xmit+0x6b7/0xba0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x398d/0x3e80 net/ipv4/ip_tunnel.c:831 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0xd1c/0xe20 net/ipv4/ip_gre.c:662 __netdev_start_xmit include/linux/netdevice.h:4910 [inline] netdev_start_xmit include/linux/netdevice.h:4924 [inline] xmit_one net/core/dev.c:3537 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3553 __dev_queue_xmit+0x34eb/0x50f0 net/core/dev.c:4203 dev_queue_xmit include/linux/netdevice.h:3088 [inline] __bpf_tx_skb net/core/filter.c:2129 [inline] __bpf_redirect_no_mac net/core/filter.c:2159 [inline] __bpf_redirect+0xe39/0x16f0 net/core/filter.c:2182 ____bpf_clone_redirect net/core/filter.c:2453 [inline] bpf_clone_redirect+0x328/0x470 net/core/filter.c:2425 ___bpf_prog_run+0x805/0xb260 kernel/bpf/core.c:1828 __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2051 bpf_dispatcher_nop_func include/linux/bpf.h:1167 [inline] __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run include/linux/filter.h:607 [inline] bpf_test_run+0x474/0xaf0 net/bpf/test_run.c:422 bpf_prog_test_run_skb+0x14e5/0x1f20 net/bpf/test_run.c:1028 bpf_prog_test_run+0x6af/0xac0 kernel/bpf/syscall.c:3770 __sys_bpf+0x649/0xd60 kernel/bpf/syscall.c:5155 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5239 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3470 [inline] __kmem_cache_alloc_node+0x536/0x8d0 mm/slub.c:3509 __do_kmalloc_node mm/slab_common.c:984 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1005 kmalloc_reserve+0x248/0x470 net/core/skbuff.c:575 __alloc_skb+0x318/0x740 net/core/skbuff.c:644 alloc_skb include/linux/skbuff.h:1289 [inline] ip_frag_next+0x15e/0xd90 net/ipv4/ip_output.c:694 ip_do_fragment+0xf99/0x2790 net/ipv4/ip_output.c:904 ip_fragment+0x201/0x2f0 __ip_finish_output+0x4d7/0x720 net/ipv4/ip_output.c:306 ip_finish_output+0x4b/0x420 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip_output+0x1f3/0x4e0 net/ipv4/ip_output.c:432 dst_output include/net/dst.h:458 [inline] ip_local_out+0xe9/0x140 net/ipv4/ip_output.c:127 iptunnel_xmit+0x6b7/0xba0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x398d/0x3e80 net/ipv4/ip_tunnel.c:831 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0xd1c/0xe20 net/ipv4/ip_gre.c:662 __netdev_start_xmit include/linux/netdevice.h:4910 [inline] netdev_start_xmit include/linux/netdevice.h:4924 [inline] xmit_one net/core/dev.c:3537 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3553 __dev_queue_xmit+0x34eb/0x50f0 net/core/dev.c:4203 dev_queue_xmit include/linux/netdevice.h:3088 [inline] __bpf_tx_skb net/core/filter.c:2129 [inline] __bpf_redirect_no_mac net/core/filter.c:2159 [inline] __bpf_redirect+0xe39/0x16f0 net/core/filter.c:2182 ____bpf_clone_redirect net/core/filter.c:2453 [inline] bpf_clone_redirect+0x328/0x470 net/core/filter.c:2425 ___bpf_prog_run+0x805/0xb260 kernel/bpf/core.c:1828 __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2051 bpf_dispatcher_nop_func include/linux/bpf.h:1167 [inline] __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run include/linux/filter.h:607 [inline] bpf_test_run+0x474/0xaf0 net/bpf/test_run.c:422 bpf_prog_test_run_skb+0x14e5/0x1f20 net/bpf/test_run.c:1028 bpf_prog_test_run+0x6af/0xac0 kernel/bpf/syscall.c:3770 __sys_bpf+0x649/0xd60 kernel/bpf/syscall.c:5155 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline] __se_sys_bpf kernel/bpf/syscall.c:5239 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5239 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Bytes 38-41 of 1000 are uninitialized Memory access of size 1000 starts at ffff8880906670c0 Data copied to user address 00000000ff969318 CPU: 0 PID: 3011 Comm: syz-executor.2 Not tainted 6.5.0-rc3-syzkaller-00283-g12214540ad87 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 =====================================================