=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:30 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:300 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:328 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0xf0e/0x33f0 lib/iov_iter.c:185
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 copy_to_user_iter lib/iov_iter.c:24 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:300 [inline]
 iterate_and_advance include/linux/iov_iter.h:328 [inline]
 _copy_to_iter+0xf0e/0x33f0 lib/iov_iter.c:185
 copy_to_iter include/linux/uio.h:220 [inline]
 simple_copy_to_iter net/core/datagram.c:521 [inline]
 __skb_datagram_iter+0x196/0x12c0 net/core/datagram.c:402
 skb_copy_datagram_iter+0x5b/0x1e0 net/core/datagram.c:535
 tun_put_user drivers/net/tun.c:2082 [inline]
 tun_do_read+0x26d8/0x30f0 drivers/net/tun.c:2161
 tun_chr_read_iter+0x393/0x6b0 drivers/net/tun.c:2185
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x857/0xf00 fs/read_write.c:572
 ksys_read fs/read_write.c:715 [inline]
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722
 x64_sys_call+0x39db/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4154 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 __do_kmalloc_node mm/slub.c:4327 [inline]
 __kmalloc_node_track_caller_noprof+0x96d/0x12f0 mm/slub.c:4347
 kmalloc_reserve+0x22f/0x4b0 net/core/skbuff.c:601
 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:670
 alloc_skb include/linux/skbuff.h:1336 [inline]
 ip_frag_next+0x17a/0xe80 net/ipv4/ip_output.c:687
 ip_do_fragment+0xf73/0x27e0 net/ipv4/ip_output.c:897
 ip_fragment+0x1ad/0x2c0 net/ipv4/ip_output.c:-1
 __ip_finish_output+0x5d8/0x860 net/ipv4/ip_output.c:311
 ip_finish_output+0x4a/0x640 net/ipv4/ip_output.c:323
 NF_HOOK_COND include/linux/netfilter.h:306 [inline]
 ip_output+0x149/0x3d0 net/ipv4/ip_output.c:433
 dst_output include/net/dst.h:459 [inline]
 ip_local_out+0x1b2/0x210 net/ipv4/ip_output.c:129
 iptunnel_xmit+0x67a/0xc00 net/ipv4/ip_tunnel_core.c:82
 ip_tunnel_xmit+0x3973/0x3be0 net/ipv4/ip_tunnel.c:859
 __gre_xmit net/ipv4/ip_gre.c:488 [inline]
 ipgre_xmit+0x1098/0x1250 net/ipv4/ip_gre.c:692
 __netdev_start_xmit include/linux/netdevice.h:5215 [inline]
 netdev_start_xmit include/linux/netdevice.h:5224 [inline]
 xmit_one net/core/dev.c:3830 [inline]
 dev_hard_start_xmit+0x22c/0xa30 net/core/dev.c:3846
 __dev_queue_xmit+0x3cb4/0x5e20 net/core/dev.c:4713
 dev_queue_xmit include/linux/netdevice.h:3355 [inline]
 __bpf_tx_skb net/core/filter.c:2144 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2174 [inline]
 __bpf_redirect+0xda6/0x1760 net/core/filter.c:2197
 ____bpf_clone_redirect net/core/filter.c:2469 [inline]
 bpf_clone_redirect+0x366/0x530 net/core/filter.c:2439
 ___bpf_prog_run+0x1294/0xeba0 kernel/bpf/core.c:2018
 __bpf_prog_run512+0xc5/0x100 kernel/bpf/core.c:2313
 bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 bpf_test_run+0x547/0xd20 net/bpf/test_run.c:434
 bpf_prog_test_run_skb+0x19f8/0x26c0 net/bpf/test_run.c:1099
 bpf_prog_test_run+0x5c2/0xa40 kernel/bpf/syscall.c:4429
 __sys_bpf+0x6ca/0xe60 kernel/bpf/syscall.c:5854
 __do_sys_bpf kernel/bpf/syscall.c:5943 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5941 [inline]
 __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5941
 x64_sys_call+0x2c3b/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Bytes 38-41 of 1000 are uninitialized
Memory access of size 1000 starts at ffff888013e42080
Data copied to user address 00007ffd24f81770

CPU: 0 UID: 0 PID: 8125 Comm: syz-executor Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================