TITLE: KMSAN: uninit-value in ip_route_output_key_hash_rcu

setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000100)={'filter\x00', 0x3, [{}, {}, {}]}, 0x58)
getsockopt$netrom_NETROM_T4(0xffffffffffffffff, 0x103, 0x6, &(0x7f00000001c0), &(0x7f0000000200)=0x4)

[  176.992079] ==================================================================
[  176.999506] BUG: KMSAN: uninit-value in ip_route_output_key_hash_rcu+0x31f0/0x3940
[  177.007217] CPU: 1 PID: 12207 Comm: syz-executor0 Not tainted 4.16.0+ #81
[  177.014155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  177.023519] Call Trace:
[  177.026109]  dump_stack+0x185/0x1d0
[  177.029745]  ? ip_route_output_key_hash_rcu+0x31f0/0x3940
[  177.035283]  kmsan_report+0x142/0x240
2018/04/06 22:31:14 executing program 6:
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000ff4))
migrate_pages(0x0, 0x7fff, &(0x7f000000aff8), &(0x7f0000000000))

[  177.039083]  __msan_warning_32+0x6c/0xb0
[  177.043145]  ip_route_output_key_hash_rcu+0x31f0/0x3940
[  177.048510]  ? futex_wait_queue_me+0x4ba/0x710
[  177.053089]  ? rcu_all_qs+0x32/0x1f0
[  177.056811]  ip_route_output_flow+0x1eb/0x3c0
[  177.061301]  ? security_sk_classify_flow+0x49/0x190
[  177.066328]  raw_sendmsg+0x1861/0x3ed0
[  177.070236]  ? compat_raw_ioctl+0x100/0x100
[  177.074558]  inet_sendmsg+0x48d/0x740
[  177.078360]  ? security_socket_sendmsg+0x9e/0x210
[  177.083206]  ? inet_getname+0x500/0x500
[  177.087183]  SYSC_sendto+0x6c3/0x7e0
[  177.090899]  ? __msan_metadata_ptr_for_store_4+0x13/0x20
[  177.096347]  ? prepare_exit_to_usermode+0x149/0x3a0
[  177.101374]  SyS_sendto+0x8a/0xb0
[  177.104827]  do_syscall_64+0x309/0x430
[  177.108723]  ? SYSC_getpeername+0x560/0x560
[  177.113057]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[  177.118243] RIP: 0033:0x455259
[  177.121425] RSP: 002b:00007fdc0625dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  177.129128] RAX: ffffffffffffffda RBX: 00007fdc0625e6d4 RCX: 0000000000455259
2018/04/06 22:31:14 executing program 6:
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000f40000)='/dev/ptmx\x00', 0x200000000101002, 0x0)
sendfile(r1, r0, &(0x7f0000001740), 0x8a)

[  177.136386] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000013
[  177.143652] RBP: 000000000072bea0 R08: 0000000020000080 R09: 0000000000000010
[  177.150915] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[  177.158181] R13: 00000000000004f7 R14: 00000000006fa7c8 R15: 0000000000000000
[  177.165446] 
[  177.167065] Local variable description: ----res.i.i@ip_route_output_flow
[  177.173892] Variable was created at:
[  177.177610]  ip_route_output_flow+0x75/0x3c0
[  177.182016]  raw_sendmsg+0x1861/0x3ed0
[  177.185896] ==================================================================
[  177.193260] Disabling lock debugging due to kernel taint
[  177.198725] Kernel panic - not syncing: panic_on_warn set ...
[  177.198725] 
[  177.206091] CPU: 1 PID: 12207 Comm: syz-executor0 Tainted: G    B            4.16.0+ #81
[  177.214312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  177.223828] Call Trace:
[  177.226413]  dump_stack+0x185/0x1d0
[  177.230040]  panic+0x39d/0x940
[  177.233260]  ? ip_route_output_key_hash_rcu+0x31f0/0x3940
[  177.238796]  kmsan_report+0x238/0x240
2018/04/06 22:31:14 executing program 6:
r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001)
write$evdev(r0, &(0x7f0000037fe8)=[{{}, 0x1, 0x48, 0x2}, {}], 0x30)

[  177.242592]  __msan_warning_32+0x6c/0xb0
[  177.246653]  ip_route_output_key_hash_rcu+0x31f0/0x3940
[  177.252017]  ? futex_wait_queue_me+0x4ba/0x710
[  177.256601]  ? rcu_all_qs+0x32/0x1f0
[  177.260324]  ip_route_output_flow+0x1eb/0x3c0
[  177.264817]  ? security_sk_classify_flow+0x49/0x190
[  177.269836]  raw_sendmsg+0x1861/0x3ed0
[  177.273743]  ? compat_raw_ioctl+0x100/0x100
[  177.278064]  inet_sendmsg+0x48d/0x740
[  177.281864]  ? security_socket_sendmsg+0x9e/0x210
[  177.286707]  ? inet_getname+0x500/0x500
[  177.290682]  SYSC_sendto+0x6c3/0x7e0
[  177.294397]  ? __msan_metadata_ptr_for_store_4+0x13/0x20
[  177.299841]  ? prepare_exit_to_usermode+0x149/0x3a0
[  177.304867]  SyS_sendto+0x8a/0xb0
[  177.308321]  do_syscall_64+0x309/0x430
[  177.312213]  ? SYSC_getpeername+0x560/0x560
[  177.316541]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[  177.321719] RIP: 0033:0x455259
[  177.324898] RSP: 002b:00007fdc0625dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  177.332603] RAX: ffffffffffffffda RBX: 00007fdc0625e6d4 RCX: 0000000000455259
[  177.339867] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000013
[  177.347143] RBP: 000000000072bea0 R08: 0000000020000080 R09: 0000000000000010
[  177.347150] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[  177.347158] R13: 00000000000004f7 R14: 00000000006fa7c8 R15: 0000000000000000
[  177.347607] Dumping ftrace buffer:
[  177.347612]    (ftrace buffer empty)
[  177.347616] Kernel Offset: disabled
[  177.380116] Rebooting in 86400 seconds..

REPORT:
==================================================================
BUG: KMSAN: uninit-value in ip_route_output_key_hash_rcu+0x31f0/0x3940
CPU: 1 PID: 12207 Comm: syz-executor0 Not tainted 4.16.0+ #81
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 dump_stack+0x185/0x1d0
 kmsan_report+0x142/0x240
 __msan_warning_32+0x6c/0xb0
 ip_route_output_key_hash_rcu+0x31f0/0x3940
 ip_route_output_flow+0x1eb/0x3c0
 raw_sendmsg+0x1861/0x3ed0
 inet_sendmsg+0x48d/0x740
 SYSC_sendto+0x6c3/0x7e0
 SyS_sendto+0x8a/0xb0
 do_syscall_64+0x309/0x430
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x455259
RSP: 002b:00007fdc0625dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fdc0625e6d4 RCX: 0000000000455259
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000020000080 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000004f7 R14: 00000000006fa7c8 R15: 0000000000000000

Local variable description: ----res.i.i@ip_route_output_flow
Variable was created at:
 ip_route_output_flow+0x75/0x3c0
 raw_sendmsg+0x1861/0x3ed0
==================================================================