syzbot


KMSAN: uninit-value in swap_writeout

Status: upstream: reported on 2025/12/22 12:18
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+178fff6149127421c2cc@syzkaller.appspotmail.com
First crash: 4d21h, last: 9h30m
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KMSAN: uninit-value in swap_writeout 0 (1) 2025/12/22 12:18

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in is_folio_zero_filled mm/page_io.c:188 [inline]
BUG: KMSAN: uninit-value in swap_writeout+0x468/0x1390 mm/page_io.c:263
 is_folio_zero_filled mm/page_io.c:188 [inline]
 swap_writeout+0x468/0x1390 mm/page_io.c:263
 shmem_writeout+0x1abb/0x1f60 mm/shmem.c:1662
 writeout mm/vmscan.c:649 [inline]
 pageout mm/vmscan.c:698 [inline]
 shrink_folio_list+0x5920/0x7fc0 mm/vmscan.c:1418
 evict_folios+0x999d/0xbf30 mm/vmscan.c:4711
 try_to_shrink_lruvec+0x12b6/0x17e0 mm/vmscan.c:4874
 lru_gen_shrink_lruvec mm/vmscan.c:5023 [inline]
 shrink_lruvec+0x46f/0x4f10 mm/vmscan.c:5784
 shrink_node_memcgs mm/vmscan.c:6020 [inline]
 shrink_node+0xf1e/0x51e0 mm/vmscan.c:6061
 shrink_zones mm/vmscan.c:6300 [inline]
 do_try_to_free_pages+0x849/0x26b0 mm/vmscan.c:6362
 try_to_free_mem_cgroup_pages+0x3ae/0x950 mm/vmscan.c:6690
 try_charge_memcg+0x80f/0x1c50 mm/memcontrol.c:2388
 try_charge mm/memcontrol.c:2530 [inline]
 charge_memcg+0xd8/0x2b0 mm/memcontrol.c:4728
 __mem_cgroup_charge+0x71/0x2e0 mm/memcontrol.c:4745
 mem_cgroup_charge include/linux/memcontrol.h:663 [inline]
 shmem_alloc_and_add_folio+0xe4f/0x1bd0 mm/shmem.c:1942
 shmem_get_folio_gfp+0xad3/0x1fc0 mm/shmem.c:2556
 shmem_get_folio mm/shmem.c:2662 [inline]
 shmem_write_begin+0x230/0x570 mm/shmem.c:3315
 generic_perform_write+0x365/0x1050 mm/filemap.c:4314
 shmem_file_write_iter+0x2b7/0x2f0 mm/shmem.c:3490
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0xbe2/0x15d0 fs/read_write.c:686
 ksys_write fs/read_write.c:738 [inline]
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_frozen_pages_noprof+0x421/0xab0 mm/page_alloc.c:5233
 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
 folio_alloc_mpol_noprof+0x56/0x1d0 mm/mempolicy.c:2505
 shmem_alloc_folio mm/shmem.c:1890 [inline]
 shmem_alloc_and_add_folio+0xc56/0x1bd0 mm/shmem.c:1932
 shmem_get_folio_gfp+0xad3/0x1fc0 mm/shmem.c:2556
 shmem_get_folio mm/shmem.c:2662 [inline]
 shmem_symlink+0x562/0xad0 mm/shmem.c:4129
 vfs_symlink+0x42f/0x4c0 fs/namei.c:5514
 do_symlinkat+0x2ae/0xbb0 fs/namei.c:5541
 __do_sys_symlinkat fs/namei.c:5562 [inline]
 __se_sys_symlinkat fs/namei.c:5559 [inline]
 __x64_sys_symlinkat+0xf5/0x180 fs/namei.c:5559
 x64_sys_call+0x342f/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:267
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 24577 Comm: syz.2.5360 Tainted: G             L      syzkaller #0 PREEMPT(none) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/23 00:16 upstream 9448598b22c5 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in swap_writeout
2025/12/18 12:15 upstream ea1013c15392 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in swap_writeout
* Struck through repros no longer work on HEAD.