syzbot


KMSAN: uninit-value in __run_timer_base (2)

Status: upstream: reported on 2025/09/10 12:35
Subsystems: batman mm
[Documentation on labels]
Reported-by: syzbot+7d660d9b8bd5efc7ee6e@syzkaller.appspotmail.com
First crash: 36d, last: 21d
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] net/rose: Fix uninitialized values in rose_add_node 2 (2) 2025/09/13 08:10
[syzbot] [mm?] KMSAN: uninit-value in __run_timer_base (2) 0 (1) 2025/09/10 12:35
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in __run_timer_base batman bcachefs 8 syz 1 254d 250d 0/29 auto-obsoleted due to no activity on 2025/05/11 22:23

Sample crash report:
ffff88813fc04fd8: ffff88813fc04fe8 (0xffff88813fc04fe8)
ffff88813fc04fe0: ffffffff819767b2 (irq_exit_rcu+0x12/0x20 kernel/softirq.c:696)
ffff88813fc04fe8: ffff88802c3ff8b8 (0xffff88802c3ff8b8)
ffff88813fc04ff0: ffffffff90debed4 (instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline])
ffff88813fc04ff0: ffffffff90debed4 (sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1050)
ffff88813fc04ff8: ffff88802c3ff8a8 (0xffff88802c3ff8a8)
BUG: KMSAN: uninit-value in expire_timers kernel/time/timer.c:1791 [inline]
BUG: KMSAN: uninit-value in __run_timers kernel/time/timer.c:2372 [inline]
BUG: KMSAN: uninit-value in __run_timer_base+0x89e/0xd90 kernel/time/timer.c:2384
 expire_timers kernel/time/timer.c:1791 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x89e/0xd90 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0x3a/0x80 kernel/time/timer.c:2403
 handle_softirqs+0x166/0x6e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x66/0x180 kernel/softirq.c:680
 irq_exit_rcu+0x12/0x20 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1050

Uninit was created at:
 __netns_tracker_alloc include/net/net_namespace.h:357 [inline]
 sk_alloc+0x5de/0x8a0 net/core/sock.c:2311
 __netlink_create net/netlink/af_netlink.c:628 [inline]
 __netlink_kernel_create+0x19b/0xcc0 net/netlink/af_netlink.c:2020
 netlink_kernel_create include/linux/netlink.h:62 [inline]
 iscsi_transport_init+0x285/0x4e0 drivers/scsi/scsi_transport_iscsi.c:4983
 do_one_initcall+0x237/0xb60 init/main.c:1269
 do_initcall_level+0x157/0x2e0 init/main.c:1331
 do_initcalls+0x176/0x310 init/main.c:1347
 do_basic_setup+0x1d/0x30 init/main.c:1366
 kernel_init_freeable+0x275/0x4a0 init/main.c:1579
 kernel_init+0x2f/0x5e0 init/main.c:1469
 ret_from_fork+0x233/0x380 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

CPU: 0 UID: 0 PID: 8957 Comm: syz.7.715 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
=====================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/21 17:09 upstream f975f08c2e89 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __run_timer_base
2025/09/21 00:18 upstream 3b08f56fbbb9 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __run_timer_base
2025/09/14 18:26 upstream f83a4f2a4d8c e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __run_timer_base
2025/09/13 10:52 upstream 22f20375f5b7 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __run_timer_base
2025/09/06 12:25 upstream d1d10cea0895 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __run_timer_base
* Struck through repros no longer work on HEAD.