=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:30 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:330 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:197
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 copy_to_user_iter lib/iov_iter.c:24 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:197
 copy_to_iter include/linux/uio.h:220 [inline]
 simple_copy_to_iter net/core/datagram.c:521 [inline]
 __skb_datagram_iter+0x196/0x12c0 net/core/datagram.c:402
 skb_copy_datagram_iter+0x5b/0x1e0 net/core/datagram.c:535
 tun_put_user drivers/net/tun.c:2105 [inline]
 tun_do_read+0x398f/0x4230 drivers/net/tun.c:2184
 tun_chr_read_iter+0x393/0x6b0 drivers/net/tun.c:2208
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x8ed/0xf90 fs/read_write.c:572
 ksys_read fs/read_write.c:715 [inline]
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722
 x64_sys_call+0x3123/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 pskb_expand_head+0x310/0x15d0 net/core/skbuff.c:2290
 skb_expand_head+0x416/0x860 net/core/skbuff.c:2452
 ip_finish_output2+0xe48/0x1d50 net/ipv4/ip_output.c:218
 __ip_finish_output net/ipv4/ip_output.c:-1 [inline]
 ip_finish_output+0x292/0x8e0 net/ipv4/ip_output.c:325
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip_output+0x14f/0x3e0 net/ipv4/ip_output.c:438
 dst_output include/net/dst.h:464 [inline]
 ip_local_out net/ipv4/ip_output.c:131 [inline]
 __ip_queue_xmit+0x1fdc/0x2140 net/ipv4/ip_output.c:534
 sctp_v4_xmit+0x758/0x1190 net/sctp/protocol.c:1060
 sctp_packet_transmit+0x42e3/0x4620 net/sctp/output.c:653
 sctp_packet_singleton+0x2e3/0x450 net/sctp/outqueue.c:783
 sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]
 sctp_outq_flush+0x71c/0x67c0 net/sctp/outqueue.c:1212
 sctp_outq_uncork+0x9e/0xc0 net/sctp/outqueue.c:764
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:-1 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline]
 sctp_do_sm+0x8c8e/0x9720 net/sctp/sm_sideeffect.c:1175
 sctp_primitive_ASSOCIATE+0xd4/0x100 net/sctp/primitive.c:73
 sctp_sendmsg_to_asoc+0x1a64/0x2250 net/sctp/socket.c:1840
 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2030
 inet_sendmsg+0x26c/0x2a0 net/ipv4/af_inet.c:859
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x278/0x3d0 net/socket.c:742
 ____sys_sendmsg+0x7f5/0xcf0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1c60/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4960 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 __do_kmalloc_node mm/slub.c:5656 [inline]
 __kmalloc_node_track_caller_noprof+0xb77/0x1c90 mm/slub.c:5764
 kmalloc_reserve+0x22f/0x4b0 net/core/skbuff.c:608
 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690
 alloc_skb include/linux/skbuff.h:1383 [inline]
 sctp_packet_transmit+0x44b/0x4620 net/sctp/output.c:598
 sctp_packet_singleton+0x2e3/0x450 net/sctp/outqueue.c:783
 sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]
 sctp_outq_flush+0x71c/0x67c0 net/sctp/outqueue.c:1212
 sctp_outq_uncork+0x9e/0xc0 net/sctp/outqueue.c:764
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:-1 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline]
 sctp_do_sm+0x8c8e/0x9720 net/sctp/sm_sideeffect.c:1175
 sctp_primitive_ASSOCIATE+0xd4/0x100 net/sctp/primitive.c:73
 sctp_sendmsg_to_asoc+0x1a64/0x2250 net/sctp/socket.c:1840
 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2030
 inet_sendmsg+0x26c/0x2a0 net/ipv4/af_inet.c:859
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x278/0x3d0 net/socket.c:742
 ____sys_sendmsg+0x7f5/0xcf0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1c60/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Bytes 38-41 of 556 are uninitialized
Memory access of size 556 starts at ffff88804cd2b8b0
Data copied to user address 00007ffe4ceeceb0

CPU: 1 UID: 0 PID: 12225 Comm: syz-executor Tainted: G        W    L      syzkaller #0 PREEMPT(none) 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================