=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:30 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:330 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 copy_to_user_iter lib/iov_iter.c:24 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185
 copy_to_iter include/linux/uio.h:220 [inline]
 simple_copy_to_iter net/core/datagram.c:521 [inline]
 __skb_datagram_iter+0x196/0x12c0 net/core/datagram.c:402
 skb_copy_datagram_iter+0x5b/0x1e0 net/core/datagram.c:535
 tun_put_user drivers/net/tun.c:2102 [inline]
 tun_do_read+0x3a71/0x4100 drivers/net/tun.c:2181
 tun_chr_read_iter+0x393/0x6b0 drivers/net/tun.c:2205
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x8ed/0xf90 fs/read_write.c:572
 ksys_read fs/read_write.c:715 [inline]
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722
 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 pskb_expand_head+0x310/0x1610 net/core/skbuff.c:2248
 __skb_cow include/linux/skbuff.h:3806 [inline]
 skb_cow_head include/linux/skbuff.h:3840 [inline]
 erspan_xmit+0x952/0x1ce0 net/ipv4/ip_gre.c:719
 __netdev_start_xmit include/linux/netdevice.h:5222 [inline]
 netdev_start_xmit include/linux/netdevice.h:5231 [inline]
 xmit_one net/core/dev.c:3839 [inline]
 dev_hard_start_xmit+0x22f/0xa30 net/core/dev.c:3855
 sch_direct_xmit+0x3b2/0xcf0 net/sched/sch_generic.c:344
 __dev_xmit_skb net/core/dev.c:4114 [inline]
 __dev_queue_xmit+0x3588/0x5e60 net/core/dev.c:4691
 dev_queue_xmit include/linux/netdevice.h:3361 [inline]
 neigh_resolve_output+0x9c5/0xaf0 net/core/neighbour.c:1595
 neigh_output include/net/neighbour.h:547 [inline]
 ip_finish_output2+0x1abc/0x1d50 net/ipv4/ip_output.c:235
 ip_do_fragment+0x20ac/0x27e0 net/ipv4/ip_output.c:857
 ip_fragment+0x1ad/0x2c0 net/ipv4/ip_output.c:-1
 __ip_finish_output net/ipv4/ip_output.c:311 [inline]
 ip_finish_output+0x5c3/0x8e0 net/ipv4/ip_output.c:323
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip_output+0x14f/0x3e0 net/ipv4/ip_output.c:436
 dst_output include/net/dst.h:461 [inline]
 ip_local_out net/ipv4/ip_output.c:129 [inline]
 ip_send_skb+0x344/0x420 net/ipv4/ip_output.c:1506
 udp_send_skb+0x1375/0x1cb0 net/ipv4/udp.c:1195
 udp_push_pending_frames net/ipv4/udp.c:1224 [inline]
 udp_sendmsg+0x9d7/0x3370 net/ipv4/udp.c:1516
 inet_sendmsg+0x1ef/0x2a0 net/ipv4/af_inet.c:851
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x278/0x3d0 net/socket.c:729
 sock_write_iter+0x318/0x390 net/socket.c:1179
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0xbe2/0x15d0 fs/read_write.c:686
 ksys_write fs/read_write.c:738 [inline]
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
 x64_sys_call+0x3014/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4186 [inline]
 slab_alloc_node mm/slub.c:4229 [inline]
 kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4281
 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:578
 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:669
 alloc_skb include/linux/skbuff.h:1336 [inline]
 alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6665
 sock_alloc_send_pskb+0xad8/0xc70 net/core/sock.c:2980
 sock_alloc_send_skb include/net/sock.h:1847 [inline]
 __ip_append_data+0x4e9f/0x7160 net/ipv4/ip_output.c:1125
 ip_append_data+0x145/0x220 net/ipv4/ip_output.c:1376
 udp_sendmsg+0x4e2/0x3370 net/ipv4/udp.c:1510
 inet_sendmsg+0x1ef/0x2a0 net/ipv4/af_inet.c:851
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x278/0x3d0 net/socket.c:729
 ____sys_sendmsg+0x893/0xd80 net/socket.c:2614
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2668
 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2757
 __do_sys_sendmmsg net/socket.c:2784 [inline]
 __se_sys_sendmmsg net/socket.c:2781 [inline]
 __x64_sys_sendmmsg+0xc6/0x150 net/socket.c:2781
 x64_sys_call+0x21de/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Bytes 38-41 of 92 are uninitialized
Memory access of size 92 starts at ffff888026ef0b80
Data copied to user address 00007fff665c9750

CPU: 0 UID: 0 PID: 17228 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
=====================================================