=====================================================
BUG: KMSAN: uninit-value in ip_route_output_key_hash_rcu+0x709/0x3b10 net/ipv4/route.c:2803
 ip_route_output_key_hash_rcu+0x709/0x3b10 net/ipv4/route.c:2803
 ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
 __ip_route_output_key include/net/route.h:169 [inline]
 ip_route_output_flow+0x8f/0x270 net/ipv4/route.c:2932
 ip_route_output_key include/net/route.h:179 [inline]
 ip_tunnel_xmit+0x13e9/0x3be0 net/ipv4/ip_tunnel.c:781
 sit_tunnel_xmit__ net/ipv6/sit.c:1052 [inline]
 sit_tunnel_xmit+0x9be/0x3510 net/ipv6/sit.c:-1
 __netdev_start_xmit include/linux/netdevice.h:5273 [inline]
 netdev_start_xmit include/linux/netdevice.h:5282 [inline]
 xmit_one net/core/dev.c:3853 [inline]
 dev_hard_start_xmit+0x22f/0xa30 net/core/dev.c:3869
 __dev_queue_xmit+0x3561/0x58e0 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 neigh_connected_output+0x5d3/0x6c0 net/core/neighbour.c:1623
 neigh_output include/net/neighbour.h:556 [inline]
 ip_finish_output2+0x1abf/0x1d50 net/ipv4/ip_output.c:237
 __ip_finish_output net/ipv4/ip_output.c:-1 [inline]
 ip_finish_output+0x292/0x8e0 net/ipv4/ip_output.c:325
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip_output+0x14f/0x3e0 net/ipv4/ip_output.c:438
 dst_output include/net/dst.h:464 [inline]
 ip_local_out+0x1d2/0x250 net/ipv4/ip_output.c:131
 iptunnel_xmit+0x786/0xd70 net/ipv4/ip_tunnel_core.c:84
 ip_tunnel_xmit+0x3975/0x3be0 net/ipv4/ip_tunnel.c:845
 __gre_xmit net/ipv4/ip_gre.c:490 [inline]
 ipgre_xmit+0x1098/0x1250 net/ipv4/ip_gre.c:694
 __netdev_start_xmit include/linux/netdevice.h:5273 [inline]
 netdev_start_xmit include/linux/netdevice.h:5282 [inline]
 xmit_one net/core/dev.c:3853 [inline]
 dev_hard_start_xmit+0x22f/0xa30 net/core/dev.c:3869
 __dev_queue_xmit+0x3561/0x58e0 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x333/0x3d0 net/socket.c:742
 __sys_sendto+0x593/0x720 net/socket.c:2206
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __ia32_sys_sendto+0x12f/0x200 net/socket.c:2209
 ia32_sys_call+0x1a3d/0x4340 arch/x86/include/generated/asm/syscalls_32.h:370
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x154/0x320 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:332
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was stored to memory at:
 ip_tunnel_init_flow include/net/ip_tunnels.h:365 [inline]
 ip_tunnel_xmit+0x10b2/0x3be0 net/ipv4/ip_tunnel.c:762
 sit_tunnel_xmit__ net/ipv6/sit.c:1052 [inline]
 sit_tunnel_xmit+0x9be/0x3510 net/ipv6/sit.c:-1
 __netdev_start_xmit include/linux/netdevice.h:5273 [inline]
 netdev_start_xmit include/linux/netdevice.h:5282 [inline]
 xmit_one net/core/dev.c:3853 [inline]
 dev_hard_start_xmit+0x22f/0xa30 net/core/dev.c:3869
 __dev_queue_xmit+0x3561/0x58e0 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 neigh_connected_output+0x5d3/0x6c0 net/core/neighbour.c:1623
 neigh_output include/net/neighbour.h:556 [inline]
 ip_finish_output2+0x1abf/0x1d50 net/ipv4/ip_output.c:237
 __ip_finish_output net/ipv4/ip_output.c:-1 [inline]
 ip_finish_output+0x292/0x8e0 net/ipv4/ip_output.c:325
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip_output+0x14f/0x3e0 net/ipv4/ip_output.c:438
 dst_output include/net/dst.h:464 [inline]
 ip_local_out+0x1d2/0x250 net/ipv4/ip_output.c:131
 iptunnel_xmit+0x786/0xd70 net/ipv4/ip_tunnel_core.c:84
 ip_tunnel_xmit+0x3975/0x3be0 net/ipv4/ip_tunnel.c:845
 __gre_xmit net/ipv4/ip_gre.c:490 [inline]
 ipgre_xmit+0x1098/0x1250 net/ipv4/ip_gre.c:694
 __netdev_start_xmit include/linux/netdevice.h:5273 [inline]
 netdev_start_xmit include/linux/netdevice.h:5282 [inline]
 xmit_one net/core/dev.c:3853 [inline]
 dev_hard_start_xmit+0x22f/0xa30 net/core/dev.c:3869
 __dev_queue_xmit+0x3561/0x58e0 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x333/0x3d0 net/socket.c:742
 __sys_sendto+0x593/0x720 net/socket.c:2206
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __ia32_sys_sendto+0x12f/0x200 net/socket.c:2209
 ia32_sys_call+0x1a3d/0x4340 arch/x86/include/generated/asm/syscalls_32.h:370
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x154/0x320 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:332
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4960 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 __do_kmalloc_node mm/slub.c:5656 [inline]
 __kmalloc_node_track_caller_noprof+0xb77/0x1c90 mm/slub.c:5764
 kmalloc_reserve+0x22f/0x4b0 net/core/skbuff.c:608
 pskb_expand_head+0x1fc/0x15d0 net/core/skbuff.c:2282
 __skb_cow include/linux/skbuff.h:3853 [inline]
 skb_cow_head include/linux/skbuff.h:3887 [inline]
 ip_tunnel_xmit+0x359e/0x3be0 net/ipv4/ip_tunnel.c:836
 __gre_xmit net/ipv4/ip_gre.c:490 [inline]
 ipgre_xmit+0x1098/0x1250 net/ipv4/ip_gre.c:694
 __netdev_start_xmit include/linux/netdevice.h:5273 [inline]
 netdev_start_xmit include/linux/netdevice.h:5282 [inline]
 xmit_one net/core/dev.c:3853 [inline]
 dev_hard_start_xmit+0x22f/0xa30 net/core/dev.c:3869
 __dev_queue_xmit+0x3561/0x58e0 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x333/0x3d0 net/socket.c:742
 __sys_sendto+0x593/0x720 net/socket.c:2206
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __ia32_sys_sendto+0x12f/0x200 net/socket.c:2209
 ia32_sys_call+0x1a3d/0x4340 arch/x86/include/generated/asm/syscalls_32.h:370
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x154/0x320 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:332
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

CPU: 0 UID: 0 PID: 25903 Comm: syz.6.7251 Tainted: G        W    L      syzkaller #0 PREEMPT(none) 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================