==================================================================
BUG: KMSAN: uninit-value in pcpu_addr_in_chunk mm/percpu.c:208 [inline]
BUG: KMSAN: uninit-value in pcpu_chunk_addr_search mm/percpu.c:1308 [inline]
BUG: KMSAN: uninit-value in free_percpu+0x2b8/0xb20 mm/percpu.c:1723
CPU: 1 PID: 9471 Comm: syz-executor4 Not tainted 4.16.0+ #86
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:53
 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
 pcpu_addr_in_chunk mm/percpu.c:208 [inline]
 pcpu_chunk_addr_search mm/percpu.c:1308 [inline]
 free_percpu+0x2b8/0xb20 mm/percpu.c:1723
 ip6_dst_destroy+0x157/0x750 net/ipv6/route.c:398
 dst_destroy+0x209/0x7a0 net/core/dst.c:131
 dst_destroy_rcu+0x46/0x50 net/core/dst.c:153
 __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
 rcu_do_batch kernel/rcu/tree.c:2674 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
 rcu_process_callbacks+0x1708/0x2070 kernel/rcu/tree.c:2917
 __do_softirq+0x56d/0x93d kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x202/0x240 kernel/softirq.c:405
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:541
 smp_apic_timer_interrupt+0x64/0x90 arch/x86/kernel/apic/apic.c:1055
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
 </IRQ>
RIP: 0010:find_entry fs/proc/proc_sysctl.c:107 [inline]
RIP: 0010:find_subdir fs/proc/proc_sysctl.c:923 [inline]
RIP: 0010:get_subdir fs/proc/proc_sysctl.c:977 [inline]
RIP: 0010:__register_sysctl_table+0x137a/0x29f0 fs/proc/proc_sysctl.c:1327
RSP: 0018:ffff8801ca7cf368 EFLAGS: 00000292 ORIG_RAX: ffffffffffffff12
RAX: 0000000000000000 RBX: ffff88015a2bb670 RCX: ffff880000000000
RDX: ffff88015a2bd670 RSI: aaaaaaaaaaaab000 RDI: ffffea0000000000
RBP: ffff8801ca7cf4a0 R08: 0000000000000000 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88015a2bb600
R13: 0000000000000000 R14: ffff88015a2bb658 R15: 0000000000000000
 register_net_sysctl+0x9f/0xb0 net/sysctl_net.c:120
 neigh_sysctl_register+0xa9e/0xd60 net/core/neighbour.c:3234
 addrconf_sysctl_register+0x159/0x370 net/ipv6/addrconf.c:6470
 ipv6_add_dev+0x1b4b/0x1ee0 net/ipv6/addrconf.c:459
 addrconf_notify+0x8f0/0x58f0 net/ipv6/addrconf.c:3381
 notifier_call_chain kernel/notifier.c:93 [inline]
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x13b/0x250 kernel/notifier.c:401
 call_netdevice_notifiers_info net/core/dev.c:1707 [inline]
 call_netdevice_notifiers net/core/dev.c:1725 [inline]
 register_netdevice+0x211d/0x26d0 net/core/dev.c:7929
 register_netdev+0x46/0x80 net/core/dev.c:8014
 br_add_bridge+0x140/0x240 net/bridge/br_if.c:394
 br_ioctl_deviceless_stub+0x5b4/0xc20 net/bridge/br_ioctl.c:378
 sock_ioctl+0x8a2/0xca0 net/socket.c:1048
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0xaf0/0x2440 fs/ioctl.c:686
 SYSC_ioctl+0x1d2/0x260 fs/ioctl.c:701
 SyS_ioctl+0x54/0x80 fs/ioctl.c:692
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x455389
RSP: 002b:00007f61d8892c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f61d88936d4 RCX: 0000000000455389
RDX: 0000000020000980 RSI: 00000000000089a0 RDI: 0000000000000014
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 000000000000036d R14: 00000000006f82d8 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:528
 ip6_dst_alloc net/ipv6/route.c:379 [inline]
 icmp6_dst_alloc+0x674/0xc60 net/ipv6/route.c:2365
 ndisc_send_skb+0x343/0x1360 net/ipv6/ndisc.c:471
 ndisc_send_rs+0xbc5/0xbf0 net/ipv6/ndisc.c:685
 addrconf_rs_timer+0x63e/0xc80 net/ipv6/addrconf.c:3769
 call_timer_fn+0x26a/0x5a0 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0xda7/0x11c0 kernel/time/timer.c:1666
 run_timer_softirq+0x43/0x70 kernel/time/timer.c:1692
 __do_softirq+0x56d/0x93d kernel/softirq.c:285
Local variable description: ----vid@br_handle_frame_finish
Variable was created at:
 br_handle_frame_finish+0x48/0x1a50 net/bridge/br_input.c:76
 br_nf_hook_thresh+0x4ed/0x650 net/bridge/br_netfilter_hooks.c:1010
==================================================================