===================================================== BUG: KMSAN: uninit-value in __skb_checksum_complete+0x371/0x480 net/core/skbuff.c:3806 __skb_checksum_complete+0x371/0x480 net/core/skbuff.c:3806 nf_ip_checksum+0x2d6/0x6e0 net/netfilter/utils.c:36 nf_nat_icmp_reply_translation+0x210/0x830 net/netfilter/nf_nat_proto.c:536 nf_nat_ipv4_fn net/netfilter/nf_nat_proto.c:595 [inline] nf_nat_ipv4_local_fn+0x1ec/0x8a0 net/netfilter/nf_nat_proto.c:758 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] __ip_local_out+0x73b/0x7d0 net/ipv4/ip_output.c:120 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x6a/0x410 net/ipv4/ip_output.c:1508 ip_push_pending_frames+0xad/0x110 net/ipv4/ip_output.c:1528 icmp_push_reply+0x625/0x760 net/ipv4/icmp.c:400 __icmp_send+0x1b43/0x1cc0 net/ipv4/icmp.c:993 ipv4_send_dest_unreach net/ipv4/route.c:1255 [inline] ipv4_link_failure+0x8c1/0xbe0 net/ipv4/route.c:1262 dst_link_failure include/net/dst.h:438 [inline] arp_error_report+0xe5/0x160 net/ipv4/arp.c:297 neigh_invalidate+0x2aa/0x700 net/core/neighbour.c:1080 neigh_timer_handler+0x1036/0x14d0 net/core/neighbour.c:1172 call_timer_fn+0x4c/0x590 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x82f/0xdf0 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0x3a/0x70 kernel/time/timer.c:2404 handle_softirqs+0x171/0x7e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x65/0x170 kernel/softirq.c:723 irq_exit_rcu+0x12/0x20 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697 native_irq_enable arch/x86/include/asm/irqflags.h:42 [inline] arch_local_irq_enable arch/x86/include/asm/irqflags.h:119 [inline] raw_spin_rq_unlock_irq kernel/sched/sched.h:1629 [inline] finish_lock_switch kernel/sched/core.c:5032 [inline] finish_task_switch+0x11b/0x8b0 kernel/sched/core.c:5150 context_switch kernel/sched/core.c:5298 [inline] __schedule+0x273e/0x8650 kernel/sched/core.c:6907 preempt_schedule_common+0x33/0x80 kernel/sched/core.c:7091 preempt_schedule+0x30/0x40 kernel/sched/core.c:7115 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline] _raw_spin_unlock+0x46/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:389 [inline] io_cq_unlock_post io_uring/io_uring.c:517 [inline] __io_cqring_overflow_flush+0xb10/0x1190 io_uring/io_uring.c:564 io_cqring_overflow_kill io_uring/io_uring.c:582 [inline] io_ring_exit_work+0x16d/0xd90 io_uring/io_uring.c:2316 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb21/0x1e30 kernel/workqueue.c:3358 worker_thread+0xede/0x1580 kernel/workqueue.c:3439 kthread+0x53f/0x600 kernel/kthread.c:467 ret_from_fork+0x20f/0x910 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Uninit was stored to memory at: csum_partial_copy_nocheck include/net/checksum.h:53 [inline] skb_copy_and_csum_bits+0x844/0x1580 net/core/skbuff.c:3650 icmp_glue_bits+0x8e/0x2f0 net/ipv4/icmp.c:364 __ip_append_data+0x60ed/0x7030 net/ipv4/ip_output.c:1172 ip_append_data+0x144/0x220 net/ipv4/ip_output.c:1378 icmp_push_reply+0xb7/0x760 net/ipv4/icmp.c:381 __icmp_send+0x1b43/0x1cc0 net/ipv4/icmp.c:993 ipv4_send_dest_unreach net/ipv4/route.c:1255 [inline] ipv4_link_failure+0x8c1/0xbe0 net/ipv4/route.c:1262 dst_link_failure include/net/dst.h:438 [inline] arp_error_report+0xe5/0x160 net/ipv4/arp.c:297 neigh_invalidate+0x2aa/0x700 net/core/neighbour.c:1080 neigh_timer_handler+0x1036/0x14d0 net/core/neighbour.c:1172 call_timer_fn+0x4c/0x590 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x82f/0xdf0 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0x3a/0x70 kernel/time/timer.c:2404 handle_softirqs+0x171/0x7e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x65/0x170 kernel/softirq.c:723 irq_exit_rcu+0x12/0x20 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697 Uninit was created at: __alloc_frozen_pages_noprof+0x6f7/0x1020 mm/page_alloc.c:5272 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2485 alloc_frozen_pages_noprof mm/mempolicy.c:2556 [inline] alloc_pages_noprof+0x101/0x280 mm/mempolicy.c:2576 skb_page_frag_refill+0x34e/0x730 net/core/sock.c:3146 sk_page_frag_refill+0x59/0x190 net/core/sock.c:3166 tcp_sendmsg_locked+0x319a/0x7d30 net/ipv4/tcp.c:1299 tcp_sendmsg+0x4b/0x90 net/ipv4/tcp.c:1464 inet_sendmsg+0x134/0x290 net/ipv4/af_inet.c:859 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x8ea/0xb90 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2209 x64_sys_call+0x39a0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 8768 Comm: kworker/u8:26 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: iou_exit io_ring_exit_work =====================================================