KMSAN: uninit-value in hci_event_packet

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit:    c10a026b kmsan: use __free_pages() in kmsan_iounmap_page_r..
git tree:       kmsan
console output: https://syzkaller.appspot.com/x/log.txt?x=11c903a3200000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a5675814e8eae69e
dashboard link: https://syzkaller.appspot.com/bug?extid=4918ee47ac82d51de00d
compiler:       clang version 8.0.0 (trunk 350509)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13b4634d200000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=150657ef200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4918ee47ac82d51de00d@xxxxxxxxxxxxxxxxxxxxxxxxx

IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KMSAN: uninit-value in hci_conn_complete_evt  
net/bluetooth/hci_event.c:2440 [inline]
BUG: KMSAN: uninit-value in hci_event_packet+0x126e8/0x35290  
net/bluetooth/hci_event.c:5781
CPU: 1 PID: 10735 Comm: kworker/u5:1 Not tainted 5.0.0+ #16
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x173/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x131/0x2a0 mm/kmsan/kmsan.c:636
 __msan_warning+0x7a/0xf0 mm/kmsan/kmsan_instr.c:310
 hci_conn_complete_evt net/bluetooth/hci_event.c:2440 [inline]
 hci_event_packet+0x126e8/0x35290 net/bluetooth/hci_event.c:5781
 hci_rx_work+0x478/0xcc0 net/bluetooth/hci_core.c:4412
 process_one_work+0x1607/0x2010 kernel/workqueue.c:2173
 worker_thread+0x111c/0x2460 kernel/workqueue.c:2319
 kthread+0x4a1/0x4e0 kernel/kthread.c:247
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline]
 kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:159
 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:173
 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:182
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc_node mm/slub.c:2773 [inline]
 __kmalloc_node_track_caller+0xe9e/0xff0 mm/slub.c:4398
 __kmalloc_reserve net/core/skbuff.c:140 [inline]
 __alloc_skb+0x309/0xa20 net/core/skbuff.c:208
 alloc_skb include/linux/skbuff.h:1012 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
 bcsp_recv+0x1437/0x2050 drivers/bluetooth/hci_bcsp.c:685
 hci_uart_tty_receive+0x35c/0x5d0 drivers/bluetooth/hci_ldisc.c:607
 tty_ldisc_receive_buf+0x2ea/0x350 drivers/tty/tty_buffer.c:465
 tty_port_default_receive_buf+0x14f/0x1e0 drivers/tty/tty_port.c:38
 receive_buf drivers/tty/tty_buffer.c:481 [inline]
 flush_to_ldisc+0x30c/0x7f0 drivers/tty/tty_buffer.c:533
 process_one_work+0x1607/0x2010 kernel/workqueue.c:2173
 worker_thread+0x111c/0x2460 kernel/workqueue.c:2319
 kthread+0x4a1/0x4e0 kernel/kthread.c:247
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxxx

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches