=====================================================
BUG: KMSAN: uninit-value in set_freepointer mm/slub.c:330 [inline]
BUG: KMSAN: uninit-value in __slab_free+0x43f/0x1bf0 mm/slub.c:3021
CPU: 1 PID: 21137 Comm: kworker/u4:9 Tainted: G        W         5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 set_freepointer mm/slub.c:330 [inline]
 __slab_free+0x43f/0x1bf0 mm/slub.c:3021
 do_slab_free mm/slub.c:3165 [inline]
 slab_free mm/slub.c:3178 [inline]
 kfree+0x10f4/0x11f0 mm/slub.c:4230
 skb_free_head net/core/skbuff.c:650 [inline]
 skb_release_data+0xb13/0xbf0 net/core/skbuff.c:671
 skb_release_all net/core/skbuff.c:725 [inline]
 __kfree_skb+0x9e/0x320 net/core/skbuff.c:739
 sk_wmem_free_skb+0x229/0x9a0 include/net/sock.h:1558
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1878 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3268 [inline]
 tcp_ack+0x4f36/0xc030 net/ipv4/tcp_input.c:3813
 tcp_rcv_established+0xffa/0x4130 net/ipv4/tcp_input.c:5872
 tcp_v4_do_rcv+0x802/0x1000 net/ipv4/tcp_ipv4.c:1679
 tcp_v4_rcv+0x6f5d/0x73f0 net/ipv4/tcp_ipv4.c:2062
 ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x585/0x8d0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:458 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
 ip_sublist_rcv+0x121b/0x1560 net/ipv4/ip_input.c:609
 ip_list_rcv+0x8f1/0x960 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5427 [inline]
 __netif_receive_skb_list_core+0xe65/0x1250 net/core/dev.c:5475
 __netif_receive_skb_list+0x7e2/0x930 net/core/dev.c:5527
 netif_receive_skb_list_internal+0x837/0xdb0 net/core/dev.c:5637
 gro_normal_list net/core/dev.c:5791 [inline]
 napi_complete_done+0x558/0xdb0 net/core/dev.c:6493
 virtqueue_napi_complete+0xb9/0x1f0 drivers/net/virtio_net.c:334
 virtnet_poll+0x170f/0x1d10 drivers/net/virtio_net.c:1455
 __napi_poll+0x13e/0xca0 net/core/dev.c:6912
 napi_poll net/core/dev.c:6979 [inline]
 net_rx_action+0x726/0x14a0 net/core/dev.c:7065
 __do_softirq+0x1b9/0x715 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434
 common_interrupt+0xed/0x120 arch/x86/kernel/irq.c:240
 </IRQ>
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:641
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:process_one_work+0x11dc/0x1fe0 kernel/workqueue.c:2248
Code: 83 44 24 fc 00 48 83 bd 70 ff ff ff 00 0f 85 63 03 00 00 48 8b 5d a8 48 89 df e8 2f d7 cb 00 c6 00 00 c6 03 00 fb 4c 8b 6d b8 <4c> 8b 7d b0 4c 8b 65 c8 0f 1f 44 00 00 4d 85 ff 48 8b 9d 78 ff ff
RSP: 0018:ffff8880132e7c80 EFLAGS: 00000286
RAX: ffff8880bb458000 RBX: ffff888100058000 RCX: 00000000bb858000
RDX: ffff8880bb858000 RSI: 0000000000000200 RDI: ffff888100058000
RBP: ffff8880132e7d78 R08: ffffea000000000f R09: ffff88813fffa000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88815117e848 R14: 0000000000000000 R15: ffff8880667cce80
 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
 kthread+0x521/0x560 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Local variable ----regs@__bpf_prog_run32 created at:
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
=====================================================
=====================================================
BUG: KMSAN: uninit-value in cmpxchg_double_slab mm/slub.c:425 [inline]
BUG: KMSAN: uninit-value in __slab_free+0x83b/0x1bf0 mm/slub.c:3053
CPU: 1 PID: 21137 Comm: kworker/u4:9 Tainted: G    B   W         5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 cmpxchg_double_slab mm/slub.c:425 [inline]
 __slab_free+0x83b/0x1bf0 mm/slub.c:3053
 do_slab_free mm/slub.c:3165 [inline]
 slab_free mm/slub.c:3178 [inline]
 kfree+0x10f4/0x11f0 mm/slub.c:4230
 skb_free_head net/core/skbuff.c:650 [inline]
 skb_release_data+0xb13/0xbf0 net/core/skbuff.c:671
 skb_release_all net/core/skbuff.c:725 [inline]
 __kfree_skb+0x9e/0x320 net/core/skbuff.c:739
 sk_wmem_free_skb+0x229/0x9a0 include/net/sock.h:1558
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1878 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3268 [inline]
 tcp_ack+0x4f36/0xc030 net/ipv4/tcp_input.c:3813
 tcp_rcv_established+0xffa/0x4130 net/ipv4/tcp_input.c:5872
 tcp_v4_do_rcv+0x802/0x1000 net/ipv4/tcp_ipv4.c:1679
 tcp_v4_rcv+0x6f5d/0x73f0 net/ipv4/tcp_ipv4.c:2062
 ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x585/0x8d0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:458 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
 ip_sublist_rcv+0x121b/0x1560 net/ipv4/ip_input.c:609
 ip_list_rcv+0x8f1/0x960 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5427 [inline]
 __netif_receive_skb_list_core+0xe65/0x1250 net/core/dev.c:5475
 __netif_receive_skb_list+0x7e2/0x930 net/core/dev.c:5527
 netif_receive_skb_list_internal+0x837/0xdb0 net/core/dev.c:5637
 gro_normal_list net/core/dev.c:5791 [inline]
 napi_complete_done+0x558/0xdb0 net/core/dev.c:6493
 virtqueue_napi_complete+0xb9/0x1f0 drivers/net/virtio_net.c:334
 virtnet_poll+0x170f/0x1d10 drivers/net/virtio_net.c:1455
 __napi_poll+0x13e/0xca0 net/core/dev.c:6912
 napi_poll net/core/dev.c:6979 [inline]
 net_rx_action+0x726/0x14a0 net/core/dev.c:7065
 __do_softirq+0x1b9/0x715 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434
 common_interrupt+0xed/0x120 arch/x86/kernel/irq.c:240
 </IRQ>
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:641
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:process_one_work+0x11dc/0x1fe0 kernel/workqueue.c:2248
Code: 83 44 24 fc 00 48 83 bd 70 ff ff ff 00 0f 85 63 03 00 00 48 8b 5d a8 48 89 df e8 2f d7 cb 00 c6 00 00 c6 03 00 fb 4c 8b 6d b8 <4c> 8b 7d b0 4c 8b 65 c8 0f 1f 44 00 00 4d 85 ff 48 8b 9d 78 ff ff
RSP: 0018:ffff8880132e7c80 EFLAGS: 00000286
RAX: ffff8880bb458000 RBX: ffff888100058000 RCX: 00000000bb858000
RDX: ffff8880bb858000 RSI: 0000000000000200 RDI: ffff888100058000
RBP: ffff8880132e7d78 R08: ffffea000000000f R09: ffff88813fffa000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88815117e848 R14: 0000000000000000 R15: ffff8880667cce80
 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
 kthread+0x521/0x560 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Local variable ----regs@__bpf_prog_run32 created at:
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
=====================================================
=====================================================
BUG: KMSAN: uninit-value in set_freepointer mm/slub.c:330 [inline]
BUG: KMSAN: uninit-value in __slab_free+0x43f/0x1bf0 mm/slub.c:3021
CPU: 1 PID: 21137 Comm: kworker/u4:9 Tainted: G    B   W         5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 set_freepointer mm/slub.c:330 [inline]
 __slab_free+0x43f/0x1bf0 mm/slub.c:3021
 do_slab_free mm/slub.c:3165 [inline]
 slab_free mm/slub.c:3178 [inline]
 kfree+0x10f4/0x11f0 mm/slub.c:4230
 skb_free_head net/core/skbuff.c:650 [inline]
 skb_release_data+0xb13/0xbf0 net/core/skbuff.c:671
 skb_release_all net/core/skbuff.c:725 [inline]
 __kfree_skb+0x9e/0x320 net/core/skbuff.c:739
 sk_wmem_free_skb+0x229/0x9a0 include/net/sock.h:1558
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1878 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3268 [inline]
 tcp_ack+0x4f36/0xc030 net/ipv4/tcp_input.c:3813
 tcp_rcv_established+0xffa/0x4130 net/ipv4/tcp_input.c:5872
 tcp_v4_do_rcv+0x802/0x1000 net/ipv4/tcp_ipv4.c:1679
 tcp_v4_rcv+0x6f5d/0x73f0 net/ipv4/tcp_ipv4.c:2062
 ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x585/0x8d0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:458 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
 ip_sublist_rcv+0x121b/0x1560 net/ipv4/ip_input.c:609
 ip_list_rcv+0x8f1/0x960 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5427 [inline]
 __netif_receive_skb_list_core+0xe65/0x1250 net/core/dev.c:5475
 __netif_receive_skb_list+0x7e2/0x930 net/core/dev.c:5527
 netif_receive_skb_list_internal+0x837/0xdb0 net/core/dev.c:5637
 gro_normal_list net/core/dev.c:5791 [inline]
 napi_complete_done+0x558/0xdb0 net/core/dev.c:6493
 virtqueue_napi_complete+0xb9/0x1f0 drivers/net/virtio_net.c:334
 virtnet_poll+0x170f/0x1d10 drivers/net/virtio_net.c:1455
 __napi_poll+0x13e/0xca0 net/core/dev.c:6912
 napi_poll net/core/dev.c:6979 [inline]
 net_rx_action+0x726/0x14a0 net/core/dev.c:7065
 __do_softirq+0x1b9/0x715 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434
 common_interrupt+0xed/0x120 arch/x86/kernel/irq.c:240
 </IRQ>
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:641
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:process_one_work+0x11dc/0x1fe0 kernel/workqueue.c:2248
Code: 83 44 24 fc 00 48 83 bd 70 ff ff ff 00 0f 85 63 03 00 00 48 8b 5d a8 48 89 df e8 2f d7 cb 00 c6 00 00 c6 03 00 fb 4c 8b 6d b8 <4c> 8b 7d b0 4c 8b 65 c8 0f 1f 44 00 00 4d 85 ff 48 8b 9d 78 ff ff
RSP: 0018:ffff8880132e7c80 EFLAGS: 00000286
RAX: ffff8880bb458000 RBX: ffff888100058000 RCX: 00000000bb858000
RDX: ffff8880bb858000 RSI: 0000000000000200 RDI: ffff888100058000
RBP: ffff8880132e7d78 R08: ffffea000000000f R09: ffff88813fffa000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88815117e848 R14: 0000000000000000 R15: ffff8880667cce80
 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
 kthread+0x521/0x560 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Local variable ----regs@__bpf_prog_run32 created at:
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
=====================================================
=====================================================
BUG: KMSAN: uninit-value in cmpxchg_double_slab mm/slub.c:425 [inline]
BUG: KMSAN: uninit-value in __slab_free+0x83b/0x1bf0 mm/slub.c:3053
CPU: 1 PID: 21137 Comm: kworker/u4:9 Tainted: G    B   W         5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 cmpxchg_double_slab mm/slub.c:425 [inline]
 __slab_free+0x83b/0x1bf0 mm/slub.c:3053
 do_slab_free mm/slub.c:3165 [inline]
 slab_free mm/slub.c:3178 [inline]
 kfree+0x10f4/0x11f0 mm/slub.c:4230
 skb_free_head net/core/skbuff.c:650 [inline]
 skb_release_data+0xb13/0xbf0 net/core/skbuff.c:671
 skb_release_all net/core/skbuff.c:725 [inline]
 __kfree_skb+0x9e/0x320 net/core/skbuff.c:739
 sk_wmem_free_skb+0x229/0x9a0 include/net/sock.h:1558
 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1878 [inline]
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3268 [inline]
 tcp_ack+0x4f36/0xc030 net/ipv4/tcp_input.c:3813
 tcp_rcv_established+0xffa/0x4130 net/ipv4/tcp_input.c:5872
 tcp_v4_do_rcv+0x802/0x1000 net/ipv4/tcp_ipv4.c:1679
 tcp_v4_rcv+0x6f5d/0x73f0 net/ipv4/tcp_ipv4.c:2062
 ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x585/0x8d0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:458 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
 ip_sublist_rcv+0x121b/0x1560 net/ipv4/ip_input.c:609
 ip_list_rcv+0x8f1/0x960 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5427 [inline]
 __netif_receive_skb_list_core+0xe65/0x1250 net/core/dev.c:5475
 __netif_receive_skb_list+0x7e2/0x930 net/core/dev.c:5527
 netif_receive_skb_list_internal+0x837/0xdb0 net/core/dev.c:5637
 gro_normal_list net/core/dev.c:5791 [inline]
 napi_complete_done+0x558/0xdb0 net/core/dev.c:6493
 virtqueue_napi_complete+0xb9/0x1f0 drivers/net/virtio_net.c:334
 virtnet_poll+0x170f/0x1d10 drivers/net/virtio_net.c:1455
 __napi_poll+0x13e/0xca0 net/core/dev.c:6912
 napi_poll net/core/dev.c:6979 [inline]
 net_rx_action+0x726/0x14a0 net/core/dev.c:7065
 __do_softirq+0x1b9/0x715 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434
 common_interrupt+0xed/0x120 arch/x86/kernel/irq.c:240
 </IRQ>
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:641
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:process_one_work+0x11dc/0x1fe0 kernel/workqueue.c:2248
Code: 83 44 24 fc 00 48 83 bd 70 ff ff ff 00 0f 85 63 03 00 00 48 8b 5d a8 48 89 df e8 2f d7 cb 00 c6 00 00 c6 03 00 fb 4c 8b 6d b8 <4c> 8b 7d b0 4c 8b 65 c8 0f 1f 44 00 00 4d 85 ff 48 8b 9d 78 ff ff
RSP: 0018:ffff8880132e7c80 EFLAGS: 00000286
RAX: ffff8880bb458000 RBX: ffff888100058000 RCX: 00000000bb858000
RDX: ffff8880bb858000 RSI: 0000000000000200 RDI: ffff888100058000
RBP: ffff8880132e7d78 R08: ffffea000000000f R09: ffff88813fffa000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88815117e848 R14: 0000000000000000 R15: ffff8880667cce80
 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
 kthread+0x521/0x560 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Local variable ----regs@__bpf_prog_run32 created at:
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748
=====================================================