===================================================== BUG: KMSAN: uninit-value in bpf_prog_run_generic_xdp+0x1a74/0x1ff0 net/core/dev.c:5293 bpf_prog_run_generic_xdp+0x1a74/0x1ff0 net/core/dev.c:5293 netif_receive_generic_xdp net/core/dev.c:5376 [inline] do_xdp_generic+0xd52/0x1690 net/core/dev.c:5438 tun_get_user+0x45be/0x6ca0 drivers/net/tun.c:1872 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __ia32_sys_write+0x1f9/0x4d0 fs/read_write.c:746 ia32_sys_call+0x35bc/0x4310 arch/x86/include/generated/asm/syscalls_32.h:5 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Uninit was stored to memory at: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 7026 at kernel/stacktrace.c:29 stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29 Modules linked in: CPU: 0 UID: 0 PID: 7026 Comm: syz.0.304 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29 Code: df b3 03 92 89 de ba 20 00 00 00 4c 89 e1 e8 63 2d 4d ff 49 83 c6 08 49 ff cd 0f 85 6e ff ff ff eb 0b e8 8f 83 c3 00 eb d4 90 <0f> 0b 90 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 66 0f 1f RSP: 0018:ffff88802d8573a8 EFLAGS: 00010246 RAX: ffff88804f41ac20 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88802d8573d0 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88802d0573e8 R11: 0000000000000001 R12: 0000000000000000 R13: 00000000abcd0100 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881aa8a0000(0063) knlGS:00000000f54d6b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000080010000 CR3: 0000000068f1e000 CR4: 00000000003526f0 Call Trace: kmsan_print_origin+0xb0/0x340 mm/kmsan/report.c:133 kmsan_report+0x1d3/0x320 mm/kmsan/report.c:196 __msan_warning+0x1b/0x30 mm/kmsan/instrumentation.c:315 bpf_prog_run_generic_xdp+0x1a74/0x1ff0 net/core/dev.c:5293 netif_receive_generic_xdp net/core/dev.c:5376 [inline] do_xdp_generic+0xd52/0x1690 net/core/dev.c:5438 tun_get_user+0x45be/0x6ca0 drivers/net/tun.c:1872 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __ia32_sys_write+0x1f9/0x4d0 fs/read_write.c:746 ia32_sys_call+0x35bc/0x4310 arch/x86/include/generated/asm/syscalls_32.h:5 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7fb6539 Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f54d6520 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000300 RDX: 000000000000fdef RSI: 00000000f7444ff4 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 0000000000000000 ]--- Uninit was created at: slab_post_alloc_hook mm/slub.c:4186 [inline] slab_alloc_node mm/slub.c:4229 [inline] __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_node_track_caller_noprof+0x96d/0x12f0 mm/slub.c:4384 kmalloc_reserve+0x22f/0x4b0 net/core/skbuff.c:600 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:669 alloc_skb include/linux/skbuff.h:1336 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6665 sock_alloc_send_pskb+0xad8/0xc70 net/core/sock.c:2980 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x113f/0x6ca0 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __ia32_sys_write+0x1f9/0x4d0 fs/read_write.c:746 ia32_sys_call+0x35bc/0x4310 arch/x86/include/generated/asm/syscalls_32.h:5 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369 entry_SYSENTER_compat_after_hwframe+0x84/0x8e CPU: 0 UID: 0 PID: 7026 Comm: syz.0.304 Tainted: G W 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(none) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 ===================================================== ---------------- Code disassembly (best guess): 0: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 4: 10 07 adc %al,(%rdi) 6: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi a: 10 08 adc %cl,(%rax) c: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 20: 00 51 52 add %dl,0x52(%rcx) 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 ret 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 90 nop 33: 90 nop 34: 90 nop 35: 90 nop 36: 90 nop 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop