syzbot


KMSAN: uninit-value in __sigqueue_free

Status: upstream: reported on 2025/12/29 09:29
Subsystems: cgroups mm
[Documentation on labels]
Reported-by: syzbot+6e04171f00f33c0d62fb@syzkaller.appspotmail.com
First crash: 8d04h, last: 8d04h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [cgroups?] [mm?] KMSAN: uninit-value in __sigqueue_free 0 (1) 2025/12/29 09:29

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __memcg_slab_free_hook+0x466/0x5a0 mm/memcontrol.c:3235
 __memcg_slab_free_hook+0x466/0x5a0 mm/memcontrol.c:3235
 memcg_slab_free_hook mm/slub.c:2364 [inline]
 slab_free mm/slub.c:6667 [inline]
 kmem_cache_free+0x812/0x13c0 mm/slub.c:6781
 __sigqueue_free+0x23a/0x270 kernel/signal.c:475
 flush_sigqueue+0x1c5/0x3f0 kernel/signal.c:486
 release_task+0x1f33/0x29a0 kernel/exit.c:305
 wait_task_zombie kernel/exit.c:1274 [inline]
 wait_consider_task+0x28e0/0x3e00 kernel/exit.c:1501
 do_wait_thread kernel/exit.c:1564 [inline]
 __do_wait+0x206/0xdd0 kernel/exit.c:1682
 do_wait+0x10e/0x470 kernel/exit.c:1716
 kernel_wait4+0x2b5/0x480 kernel/exit.c:1875
 __do_sys_wait4 kernel/exit.c:1903 [inline]
 __se_sys_wait4 kernel/exit.c:1899 [inline]
 __x64_sys_wait4+0x148/0x340 kernel/exit.c:1899
 x64_sys_call+0x31d7/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:62
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_frozen_pages_noprof+0x421/0xab0 mm/page_alloc.c:5233
 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof+0xf7/0x200 mm/mempolicy.c:2557
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab+0x1ea/0x1710 mm/slub.c:3248
 new_slab mm/slub.c:3302 [inline]
 ___slab_alloc+0x10bf/0x3930 mm/slub.c:4656
 __slab_alloc+0xa3/0x180 mm/slub.c:4779
 __slab_alloc_node mm/slub.c:4855 [inline]
 slab_alloc_node mm/slub.c:5251 [inline]
 __do_kmalloc_node mm/slub.c:5656 [inline]
 __kmalloc_noprof+0xbd5/0x1c20 mm/slub.c:5669
 kmalloc_noprof include/linux/slab.h:961 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 neigh_alloc net/core/neighbour.c:522 [inline]
 ___neigh_create+0xd55/0x3b90 net/core/neighbour.c:656
 __neigh_create+0xa6/0xd0 net/core/neighbour.c:744
 ip6_finish_output2+0x160e/0x2d30 net/ipv6/ip6_output.c:128
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x903/0x10d0 net/ipv6/ip6_output.c:220
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x331/0x600 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:464 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 mld_sendpack+0xb4a/0x1770 net/ipv6/mcast.c:1855
 mld_send_cr net/ipv6/mcast.c:2154 [inline]
 mld_ifc_work+0x1328/0x19b0 net/ipv6/mcast.c:2693
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xb91/0x1d80 kernel/workqueue.c:3340
 worker_thread+0xedf/0x1590 kernel/workqueue.c:3421
 kthread+0xd5c/0xf00 kernel/kthread.c:463
 ret_from_fork+0x208/0x710 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 0 UID: 0 PID: 1 Comm: init Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/25 09:19 upstream ccd1cdca5cd4 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sigqueue_free
* Struck through repros no longer work on HEAD.