===================================================== BUG: KMSAN: uninit-value in set_freepointer mm/slub.c:330 [inline] BUG: KMSAN: uninit-value in __slab_free+0x43f/0x1bf0 mm/slub.c:3021 CPU: 0 PID: 8454 Comm: kworker/0:3 Not tainted 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 set_freepointer mm/slub.c:330 [inline] __slab_free+0x43f/0x1bf0 mm/slub.c:3021 do_slab_free mm/slub.c:3165 [inline] slab_free mm/slub.c:3178 [inline] kfree+0x10f4/0x11f0 mm/slub.c:4230 skb_free_head net/core/skbuff.c:650 [inline] skb_release_data+0xb13/0xbf0 net/core/skbuff.c:671 skb_release_all net/core/skbuff.c:725 [inline] __kfree_skb+0x9e/0x320 net/core/skbuff.c:739 kfree_skb+0xd5/0x300 net/core/skbuff.c:757 ip6_mc_input+0xcde/0x12f0 net/ipv6/ip6_input.c:569 dst_input include/net/dst.h:458 [inline] ip6_rcv_finish+0x5fc/0x7f0 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x1d1/0x460 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core net/core/dev.c:5384 [inline] __netif_receive_skb+0x1ec/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 do_softirq+0x123/0x1c0 kernel/softirq.c:248 __local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:745 [inline] ip6_finish_output2+0x249c/0x2a40 net/ipv6/ip6_output.c:118 __ip6_finish_output+0xe04/0xee0 net/ipv6/ip6_output.c:182 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ndisc_send_skb+0xd7f/0x16b0 net/ipv6/ndisc.c:508 ndisc_send_ns+0xfda/0x1020 net/ipv6/ndisc.c:650 addrconf_dad_work+0x22f0/0x3410 net/ipv6/addrconf.c:4119 process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421 kthread+0x521/0x560 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Local variable ----regs@__bpf_prog_run32 created at: __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748 ===================================================== ===================================================== BUG: KMSAN: uninit-value in cmpxchg_double_slab mm/slub.c:425 [inline] BUG: KMSAN: uninit-value in __slab_free+0x83b/0x1bf0 mm/slub.c:3053 CPU: 0 PID: 8454 Comm: kworker/0:3 Tainted: G B 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 cmpxchg_double_slab mm/slub.c:425 [inline] __slab_free+0x83b/0x1bf0 mm/slub.c:3053 do_slab_free mm/slub.c:3165 [inline] slab_free mm/slub.c:3178 [inline] kfree+0x10f4/0x11f0 mm/slub.c:4230 skb_free_head net/core/skbuff.c:650 [inline] skb_release_data+0xb13/0xbf0 net/core/skbuff.c:671 skb_release_all net/core/skbuff.c:725 [inline] __kfree_skb+0x9e/0x320 net/core/skbuff.c:739 kfree_skb+0xd5/0x300 net/core/skbuff.c:757 ip6_mc_input+0xcde/0x12f0 net/ipv6/ip6_input.c:569 dst_input include/net/dst.h:458 [inline] ip6_rcv_finish+0x5fc/0x7f0 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x1d1/0x460 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core net/core/dev.c:5384 [inline] __netif_receive_skb+0x1ec/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 do_softirq+0x123/0x1c0 kernel/softirq.c:248 __local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:745 [inline] ip6_finish_output2+0x249c/0x2a40 net/ipv6/ip6_output.c:118 __ip6_finish_output+0xe04/0xee0 net/ipv6/ip6_output.c:182 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ndisc_send_skb+0xd7f/0x16b0 net/ipv6/ndisc.c:508 ndisc_send_ns+0xfda/0x1020 net/ipv6/ndisc.c:650 addrconf_dad_work+0x22f0/0x3410 net/ipv6/addrconf.c:4119 process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275 worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421 kthread+0x521/0x560 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Local variable ----regs@__bpf_prog_run32 created at: __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1748 =====================================================