===================================================== BUG: KMSAN: uninit-value in vring_map_one_sg drivers/virtio/virtio_ring.c:339 [inline] BUG: KMSAN: uninit-value in virtqueue_add_split drivers/virtio/virtio_ring.c:544 [inline] BUG: KMSAN: uninit-value in virtqueue_add+0x1d8a/0x6220 drivers/virtio/virtio_ring.c:1795 vring_map_one_sg drivers/virtio/virtio_ring.c:339 [inline] virtqueue_add_split drivers/virtio/virtio_ring.c:544 [inline] virtqueue_add+0x1d8a/0x6220 drivers/virtio/virtio_ring.c:1795 virtqueue_add_outbuf+0x91/0xc0 drivers/virtio/virtio_ring.c:1852 xmit_skb drivers/net/virtio_net.c:1768 [inline] start_xmit+0x13fe/0x2200 drivers/net/virtio_net.c:1795 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one+0x14e/0x5f0 net/core/dev.c:3590 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3606 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0xbe9/0x19e0 net/core/dev.c:3817 __dev_queue_xmit+0x12cb/0x31f0 net/core/dev.c:4221 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_resolve_output+0x976/0xa00 net/core/neighbour.c:1528 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x1918/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 iptunnel_xmit+0x744/0xcd0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x3267/0x3610 net/ipv4/ip_tunnel.c:811 __gre_xmit net/ipv4/ip_gre.c:469 [inline] erspan_xmit+0x13d8/0x1f00 net/ipv4/ip_gre.c:715 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one+0x14e/0x5f0 net/core/dev.c:3590 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3606 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0xbe9/0x19e0 net/core/dev.c:3817 __dev_queue_xmit+0x12cb/0x31f0 net/core/dev.c:4221 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_resolve_output+0x976/0xa00 net/core/neighbour.c:1528 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x1918/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 igmpv3_sendpack net/ipv4/igmp.c:424 [inline] igmpv3_send_cr net/ipv4/igmp.c:719 [inline] igmp_ifc_timer_expire+0x15c8/0x1f50 net/ipv4/igmp.c:808 call_timer_fn+0x43/0x480 kernel/time/timer.c:1474 expire_timers+0x272/0x610 kernel/time/timer.c:1519 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1803 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 invoke_softirq+0x8f/0x100 kernel/softirq.c:445 __irq_exit_rcu kernel/softirq.c:650 [inline] irq_exit_rcu+0x5a/0x110 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x20/0x30 kmsan_get_metadata+0x6/0x220 mm/kmsan/shadow.c:126 kmsan_get_shadow_origin_ptr+0x49/0xa0 mm/kmsan/shadow.c:103 get_shadow_origin_ptr mm/kmsan/instrumentation.c:35 [inline] __msan_metadata_ptr_for_load_4+0x20/0x30 mm/kmsan/instrumentation.c:76 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:405 [inline] batadv_nc_worker+0xb89/0x2150 net/batman-adv/network-coding.c:719 process_one_work+0xb27/0x13e0 kernel/workqueue.c:2289 worker_thread+0x1076/0x1d60 kernel/workqueue.c:2436 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Uninit was stored to memory at: pskb_expand_head+0x2c2/0x1a00 net/core/skbuff.c:1704 __skb_cow include/linux/skbuff.h:3633 [inline] skb_cow_head include/linux/skbuff.h:3667 [inline] ip_tunnel_xmit+0x2ff4/0x3610 net/ipv4/ip_tunnel.c:804 __gre_xmit net/ipv4/ip_gre.c:469 [inline] erspan_xmit+0x13d8/0x1f00 net/ipv4/ip_gre.c:715 __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one+0x14e/0x5f0 net/core/dev.c:3590 dev_hard_start_xmit+0xe5/0x370 net/core/dev.c:3606 sch_direct_xmit+0x3f1/0xdb0 net/sched/sch_generic.c:342 __dev_xmit_skb+0xbe9/0x19e0 net/core/dev.c:3817 __dev_queue_xmit+0x12cb/0x31f0 net/core/dev.c:4221 dev_queue_xmit include/linux/netdevice.h:2994 [inline] neigh_resolve_output+0x976/0xa00 net/core/neighbour.c:1528 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x1918/0x1b30 net/ipv4/ip_output.c:228 __ip_finish_output+0x266/0x720 ip_finish_output+0x3d1/0x400 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x258/0x510 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xe5/0x140 net/ipv4/ip_output.c:126 igmpv3_sendpack net/ipv4/igmp.c:424 [inline] igmpv3_send_cr net/ipv4/igmp.c:719 [inline] igmp_ifc_timer_expire+0x15c8/0x1f50 net/ipv4/igmp.c:808 call_timer_fn+0x43/0x480 kernel/time/timer.c:1474 expire_timers+0x272/0x610 kernel/time/timer.c:1519 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1803 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 Uninit was created at: slab_post_alloc_hook mm/slab.h:755 [inline] slab_alloc_node mm/slub.c:3258 [inline] __kmalloc_node_track_caller+0x86c/0x1230 mm/slub.c:4995 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x34a/0xd70 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1426 [inline] igmpv3_newpack+0x19d/0x1440 net/ipv4/igmp.c:359 add_grec+0x149b/0x2380 net/ipv4/igmp.c:533 igmpv3_send_cr net/ipv4/igmp.c:666 [inline] igmp_ifc_timer_expire+0x1d0/0x1f50 net/ipv4/igmp.c:808 call_timer_fn+0x43/0x480 kernel/time/timer.c:1474 expire_timers+0x272/0x610 kernel/time/timer.c:1519 __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790 run_timer_softirq+0x64/0xe0 kernel/time/timer.c:1803 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 Bytes 38-41 of 108 are uninitialized Memory access of size 108 starts at ffff88802ee130c0 CPU: 1 PID: 17562 Comm: kworker/u4:0 Not tainted 5.19.0-rc4-syzkaller-31333-g97117d69c353 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Workqueue: bat_events batadv_nc_worker =====================================================