===================================================== BUG: KMSAN: uninit-value in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: uninit-value in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_slab_alloc+0x8e/0xe0 mm/kmsan/kmsan_hooks.c:76 slab_alloc_node mm/slub.c:2922 [inline] slab_alloc mm/slub.c:2931 [inline] __kmalloc_track_caller+0x965/0x11f0 mm/slub.c:4578 kmemdup+0x95/0x140 mm/util.c:128 neigh_sysctl_register+0xd2/0xd10 net/core/neighbour.c:3629 addrconf_sysctl_register+0x1b5/0x3e0 net/ipv6/addrconf.c:6985 ipv6_add_dev+0x1312/0x1b60 net/ipv6/addrconf.c:445 addrconf_notify+0xd44/0x6540 net/ipv6/addrconf.c:3491 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0x123/0x290 kernel/notifier.c:410 call_netdevice_notifiers_info net/core/dev.c:2075 [inline] call_netdevice_notifiers_extack net/core/dev.c:2087 [inline] call_netdevice_notifiers net/core/dev.c:2101 [inline] register_netdevice+0x306f/0x3710 net/core/dev.c:10238 br_dev_newlink+0x92/0x2f0 net/bridge/br_netlink.c:1435 __rtnl_newlink net/core/rtnetlink.c:3443 [inline] rtnl_newlink+0x2ecc/0x3d80 net/core/rtnetlink.c:3491 rtnetlink_rcv_msg+0x143b/0x18e0 net/core/rtnetlink.c:5553 netlink_rcv_skb+0x6fa/0x810 net/netlink/af_netlink.c:2502 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5571 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x11d6/0x14a0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x1740/0x1840 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2433 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: uninit-value in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121 kmsan_alloc_page+0xd0/0x1e0 mm/kmsan/kmsan_shadow.c:274 __alloc_pages_nodemask+0x827/0xf90 mm/page_alloc.c:5044 alloc_pages_current+0x7b6/0xb60 mm/mempolicy.c:2277 alloc_pages include/linux/gfp.h:561 [inline] alloc_slab_page mm/slub.c:1653 [inline] allocate_slab+0x364/0x1260 mm/slub.c:1793 new_slab mm/slub.c:1856 [inline] new_slab_objects mm/slub.c:2602 [inline] ___slab_alloc+0xd42/0x1930 mm/slub.c:2765 __slab_alloc mm/slub.c:2805 [inline] slab_alloc_node mm/slub.c:2886 [inline] __kmalloc_node_track_caller+0xbaf/0x1470 mm/slub.c:4609 kmalloc_reserve net/core/skbuff.c:353 [inline] __alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424 alloc_skb include/linux/skbuff.h:1103 [inline] ip6_frag_next+0x239/0x1130 net/ipv6/ip6_output.c:742 ip6_fragment+0x3645/0x3eb0 net/ipv6/ip6_output.c:948 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: uninit-value in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121 kmsan_alloc_page+0xd0/0x1e0 mm/kmsan/kmsan_shadow.c:274 __alloc_pages_nodemask+0x827/0xf90 mm/page_alloc.c:5044 alloc_pages_current+0x7b6/0xb60 mm/mempolicy.c:2277 alloc_pages include/linux/gfp.h:561 [inline] alloc_slab_page mm/slub.c:1653 [inline] allocate_slab+0x364/0x1260 mm/slub.c:1793 new_slab mm/slub.c:1856 [inline] new_slab_objects mm/slub.c:2602 [inline] ___slab_alloc+0xd42/0x1930 mm/slub.c:2765 __slab_alloc mm/slub.c:2805 [inline] slab_alloc_node mm/slub.c:2886 [inline] __kmalloc_node_track_caller+0xbaf/0x1470 mm/slub.c:4609 kmalloc_reserve net/core/skbuff.c:353 [inline] __alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424 alloc_skb include/linux/skbuff.h:1103 [inline] ip6_frag_next+0x239/0x1130 net/ipv6/ip6_output.c:742 ip6_fragment+0x3645/0x3eb0 net/ipv6/ip6_output.c:948 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_kfree_large+0x107/0x160 mm/kmsan/kmsan_hooks.c:138 kfree_hook mm/slub.c:1546 [inline] kfree+0xefc/0x11f0 mm/slub.c:4224 kvfree+0x91/0xa0 mm/util.c:616 kvm_free_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:691 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:902 [inline] kvm_put_kvm+0x1b12/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 kvm_vm_release+0x67/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:943 __fput+0x6bd/0xf00 fs/file_table.c:280 ____fput+0x37/0x40 fs/file_table.c:313 task_work_run+0x140/0x280 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: uninit-value in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121 kmsan_alloc_page+0xd0/0x1e0 mm/kmsan/kmsan_shadow.c:274 __alloc_pages_nodemask+0x827/0xf90 mm/page_alloc.c:5044 alloc_pages_current+0x7b6/0xb60 mm/mempolicy.c:2277 alloc_pages include/linux/gfp.h:561 [inline] alloc_slab_page mm/slub.c:1653 [inline] allocate_slab+0x364/0x1260 mm/slub.c:1793 new_slab mm/slub.c:1856 [inline] new_slab_objects mm/slub.c:2602 [inline] ___slab_alloc+0xd42/0x1930 mm/slub.c:2765 __slab_alloc mm/slub.c:2805 [inline] slab_alloc_node mm/slub.c:2886 [inline] kmem_cache_alloc_node+0xae6/0x1180 mm/slub.c:2959 alloc_task_struct_node kernel/fork.c:171 [inline] dup_task_struct kernel/fork.c:861 [inline] copy_process+0xca8/0x9b80 kernel/fork.c:1950 kernel_clone+0x4ea/0x1350 kernel/fork.c:2502 __do_compat_sys_ia32_clone arch/x86/kernel/sys_ia32.c:254 [inline] __se_compat_sys_ia32_clone+0x222/0x350 arch/x86/kernel/sys_ia32.c:240 __ia32_compat_sys_ia32_clone+0x5d/0x80 arch/x86/kernel/sys_ia32.c:240 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] do_int80_syscall_32+0x95/0xd0 arch/x86/entry/common.c:96 entry_INT80_compat+0x71/0x76 arch/x86/entry/entry_64_compat.S:413 ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: uninit-value in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121 kmsan_alloc_page+0xd0/0x1e0 mm/kmsan/kmsan_shadow.c:274 __alloc_pages_nodemask+0x827/0xf90 mm/page_alloc.c:5044 alloc_pages_current+0x7b6/0xb60 mm/mempolicy.c:2277 alloc_pages include/linux/gfp.h:561 [inline] alloc_slab_page mm/slub.c:1653 [inline] allocate_slab+0x364/0x1260 mm/slub.c:1793 new_slab mm/slub.c:1856 [inline] new_slab_objects mm/slub.c:2602 [inline] ___slab_alloc+0xd42/0x1930 mm/slub.c:2765 __slab_alloc mm/slub.c:2805 [inline] slab_alloc_node mm/slub.c:2886 [inline] kmem_cache_alloc_node+0xae6/0x1180 mm/slub.c:2959 alloc_task_struct_node kernel/fork.c:171 [inline] dup_task_struct kernel/fork.c:861 [inline] copy_process+0xca8/0x9b80 kernel/fork.c:1950 kernel_clone+0x4ea/0x1350 kernel/fork.c:2502 __do_compat_sys_ia32_clone arch/x86/kernel/sys_ia32.c:254 [inline] __se_compat_sys_ia32_clone+0x222/0x350 arch/x86/kernel/sys_ia32.c:240 __ia32_compat_sys_ia32_clone+0x5d/0x80 arch/x86/kernel/sys_ia32.c:240 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] do_int80_syscall_32+0x95/0xd0 arch/x86/entry/common.c:96 entry_INT80_compat+0x71/0x76 arch/x86/entry/entry_64_compat.S:413 ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: uninit-value in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121 kmsan_alloc_page+0xd0/0x1e0 mm/kmsan/kmsan_shadow.c:274 __alloc_pages_nodemask+0x827/0xf90 mm/page_alloc.c:5044 alloc_pages_current+0x7b6/0xb60 mm/mempolicy.c:2277 alloc_pages include/linux/gfp.h:561 [inline] alloc_slab_page mm/slub.c:1653 [inline] allocate_slab+0x364/0x1260 mm/slub.c:1793 new_slab mm/slub.c:1856 [inline] new_slab_objects mm/slub.c:2602 [inline] ___slab_alloc+0xd42/0x1930 mm/slub.c:2765 __slab_alloc mm/slub.c:2805 [inline] slab_alloc_node mm/slub.c:2886 [inline] kmem_cache_alloc_node+0xae6/0x1180 mm/slub.c:2959 alloc_task_struct_node kernel/fork.c:171 [inline] dup_task_struct kernel/fork.c:861 [inline] copy_process+0xca8/0x9b80 kernel/fork.c:1950 kernel_clone+0x4ea/0x1350 kernel/fork.c:2502 __do_compat_sys_ia32_clone arch/x86/kernel/sys_ia32.c:254 [inline] __se_compat_sys_ia32_clone+0x222/0x350 arch/x86/kernel/sys_ia32.c:240 __ia32_compat_sys_ia32_clone+0x5d/0x80 arch/x86/kernel/sys_ia32.c:240 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] do_int80_syscall_32+0x95/0xd0 arch/x86/entry/common.c:96 entry_INT80_compat+0x71/0x76 arch/x86/entry/entry_64_compat.S:413 ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: uninit-value in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227 neigh_connected_output+0x716/0x790 net/core/neighbour.c:1520 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x2486/0x2a40 net/ipv6/ip6_output.c:117 ip6_fragment+0x3730/0x3eb0 net/ipv6/ip6_output.c:958 __ip6_finish_output+0xb3a/0xee0 net/ipv6/ip6_output.c:180 ip6_finish_output+0x329/0x480 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x4a4/0x7f0 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0x17b/0x1e0 net/ipv6/output_core.c:179 ip6_send_skb net/ipv6/ip6_output.c:1904 [inline] ip6_push_pending_frames+0x243/0x570 net/ipv6/ip6_output.c:1924 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline] rawv6_sendmsg+0x40f4/0x46b0 net/ipv6/raw.c:956 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] kernel_sendmsg+0x22c/0x2f0 net/socket.c:694 sock_no_sendpage+0x205/0x2b0 net/core/sock.c:2860 kernel_sendpage+0x47a/0x590 net/socket.c:3631 sock_sendpage+0x161/0x1a0 net/socket.c:947 pipe_to_sendpage+0x3e4/0x520 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x5e3/0xff0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0x1d5/0x2c0 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] do_splice+0x23c3/0x2c10 fs/splice.c:1079 __do_splice fs/splice.c:1144 [inline] __do_sys_splice fs/splice.c:1350 [inline] __se_sys_splice+0x8fa/0xb50 fs/splice.c:1332 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1332 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f9f549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f55785fc EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000103300 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121 kmsan_alloc_page+0xd0/0x1e0 mm/kmsan/kmsan_shadow.c:274 __alloc_pages_nodemask+0x827/0xf90 mm/page_alloc.c:5044 alloc_pages_current+0x7b6/0xb60 mm/mempolicy.c:2277 alloc_pages include/linux/gfp.h:561 [inline] alloc_slab_page mm/slub.c:1653 [inline] allocate_slab+0x364/0x1260 mm/slub.c:1793 new_slab mm/slub.c:1856 [inline] new_slab_objects mm/slub.c:2602 [inline] ___slab_alloc+0xd42/0x1930 mm/slub.c:2765 __slab_alloc mm/slub.c:2805 [inline] slab_alloc_node mm/slub.c:2886 [inline] kmem_cache_alloc_node+0xae6/0x1180 mm/slub.c:2959 alloc_task_struct_node kernel/fork.c:171 [inline] dup_task_struct kernel/fork.c:861 [inline] copy_process+0xca8/0x9b80 kernel/fork.c:1950 kernel_clone+0x4ea/0x1350 kernel/fork.c:2502 __do_compat_sys_ia32_clone arch/x86/kernel/sys_ia32.c:254 [inline] __se_compat_sys_ia32_clone+0x222/0x350 arch/x86/kernel/sys_ia32.c:240 __ia32_compat_sys_ia32_clone+0x5d/0x80 arch/x86/kernel/sys_ia32.c:240 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] do_int80_syscall_32+0x95/0xd0 arch/x86/entry/common.c:96 entry_INT80_compat+0x71/0x76 arch/x86/entry/entry_64_compat.S:413 ===================================================== ===================================================== BUG: KMSAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] BUG: KMSAN: use-after-free in __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 CPU: 1 PID: 26121 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 decode_session6 net/xfrm/xfrm_policy.c:3420 [inline] __xfrm_decode_session+0xa81/0x3780 net/xfrm/xfrm_policy.c:3495 vti6_tnl_xmit+0x9ea/0x3260 net/ipv6/ip6_vti.c:568 __netdev_start_xmit include/linux/netdevice.h:4825 [inline] netdev_start_xmit include/linux/netdevice.h:4839 [inline] xmit_one+0x2b6/0x760 net/core/dev.c:3605 dev_hard_start_xmit+0x196/0x420 net/core/dev.c:3621 sch_direct_xmit+0x57c/0x1a60 net/sched/sch_generic.c:314 qdisc_restart net/sched/sch_generic.c:377 [inline] __qdisc_run+0x35b/0x490 net/sched/sch_generic.c:385 __dev_xmit_skb net/core/dev.c:3855 [inline] __dev_queue_xmit+0x212c/0x4600 net/core/dev.c:4162