syzbot


KMSAN: uninit-value in fd_install

Status: moderation: reported on 2026/02/09 18:15
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+fba7ca39b0dc05c3c43a@syzkaller.appspotmail.com
First crash: 51d, last: 51d
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
e44bd8e9-a601-4e4b-9443-bd6a886590cc repro 💥 KMSAN: uninit-value in fd_install 2026/03/10 13:48 2026/03/11 13:04 2026/03/11 14:11 86914af9098a80da53c3c5d46be980c572ee29f8 Error 503, Message: This model is currently experiencing high demand. Spikes in demand are usually temporary. Please try again later., Status: UNAVAILABLE, Details: [map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::unavailable: Overloaded prefill queue.; Failed while executing Op 'Prefill'; Failed to close the streaming context; status = UNAVAILABLE: Overloaded prefill queue.; Failed while executing Op 'Prefill' [type.googleapis.com/stairways.orch.ErrorLoc='learning/serving/servables/wiz/orch_wiz_servable.cc:976'] === Source Location Trace: === learning/brain/research/stairways/orchestrator/leaf/chain_stub.cc:125 learning/serving/servables/wiz/orch_wiz_servable.cc:1008 ; Failed to run inference for model: go/debugproto name: "prod-common-global__/aistudio/gemini-v4p1m-rev24-snowball-lc__main__/aistudio/gemini-v4p1m-rev24-snowball-lc__2026022700__prefill__variant__d76be967-e50b-41c8-931e-6559b02591d8" version { value: 1 } signature_name: "serving_default" [google.rpc.error_details_ext] { message: "This model is currently experiencing high demand. Spikes in demand are usually temporary. Please try again later." details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "\212\001\241\006\n\353\005Overloaded prefill queue.; Failed while executing Op \'Prefill\'; Failed to close the streaming context; status = UNAVAILABLE: Overloaded prefill queue.; Failed while executing Op \'Prefill\' [type.googleapis.com/stairways.orch.ErrorLoc=\'learning/serving/servables/wiz/orch_wiz_servable.cc:976\']\n=== Source Location Trace: ===\nlearning/brain/research/stairways/orchestrator/leaf/chain_stub.cc:125\nlearning/serving/servables/wiz/orch_wiz_servable.cc:1008\n; Failed to run inference for model: go/debugproto \nname: \"prod-common-global__/aistudio/gemini-v4p1m-rev24-snowball-lc__main__/aistudio/gemini-v4p1m-rev24-snowball-lc__2026022700__prefill__variant__d76be967-e50b-41c8-931e-6559b02591d8\"\nversion {\n value: 1\n}\nsignature_name: \"serving_default\"\n\0221labs/language/genai/common/error_handler.cc:290:0" } }]]
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in fd_install fs 2 C 64 116d 118d 29/29 fixed on 2026/01/07 12:29

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in fd_install+0x233/0x2f0 fs/file.c:689
 fd_install+0x233/0x2f0 fs/file.c:689
 do_sys_openat2+0x259/0x430 fs/open.c:1430
 do_sys_open fs/open.c:1436 [inline]
 __do_sys_openat fs/open.c:1452 [inline]
 __se_sys_openat fs/open.c:1447 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1447
 x64_sys_call+0x3597/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4960 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_noprof+0x967/0x1730 mm/slub.c:5270
 dup_fd+0x66/0x1160 fs/file.c:390
 copy_files+0x10c/0x250 kernel/fork.c:1635
 copy_process+0x25ab/0x5df0 kernel/fork.c:2209
 kernel_clone+0x415/0x1080 kernel/fork.c:2651
 __do_sys_clone kernel/fork.c:2792 [inline]
 __se_sys_clone kernel/fork.c:2776 [inline]
 __x64_sys_clone+0x253/0x360 kernel/fork.c:2776
 x64_sys_call+0x1666/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5136 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/09 14:48 upstream 05f7e89ab973 df949cd9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in fd_install
* Struck through repros no longer work on HEAD.