KMSAN: uninit-value in rwsem_mark_wake

Status: auto-closed as invalid on 2022/01/08 10:49
Subsystems: mm
[Documentation on labels]
First crash: 1876d, last: 1771d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in rwsem_mark_wake mm prio:high 2 syz, C error 9235 149d 152d 29/29 fixed on 2026/05/21 07:49

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in arch_atomic_fetch_add arch/x86/include/asm/atomic.h:184 [inline]
BUG: KMSAN: uninit-value in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:112 [inline]
BUG: KMSAN: uninit-value in __refcount_add include/linux/refcount.h:193 [inline]
BUG: KMSAN: uninit-value in __refcount_inc include/linux/refcount.h:250 [inline]
BUG: KMSAN: uninit-value in refcount_inc include/linux/refcount.h:267 [inline]
BUG: KMSAN: uninit-value in get_task_struct include/linux/sched/task.h:104 [inline]
BUG: KMSAN: uninit-value in rwsem_mark_wake+0xb25/0xd60 kernel/locking/rwsem.c:514
 arch_atomic_fetch_add arch/x86/include/asm/atomic.h:184 [inline]
 atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:112 [inline]
 __refcount_add include/linux/refcount.h:193 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 get_task_struct include/linux/sched/task.h:104 [inline]
 rwsem_mark_wake+0xb25/0xd60 kernel/locking/rwsem.c:514
 rwsem_wake kernel/locking/rwsem.c:1177 [inline]
 __up_write kernel/locking/rwsem.c:1323 [inline]
 up_write+0x1b0/0x220 kernel/locking/rwsem.c:1570
 anon_vma_unlock_write include/linux/rmap.h:121 [inline]
 split_huge_page_to_list+0x2165/0x2430 mm/huge_memory.c:2725
 shrink_page_list+0x3538/0x8680 mm/vmscan.c:1587
 shrink_inactive_list+0xb3d/0x17b0 mm/vmscan.c:2281
 shrink_list mm/vmscan.c:2508 [inline]
 shrink_lruvec+0x7bc/0x17f0 mm/vmscan.c:2827
 shrink_node_memcgs+0x5d3/0xc70 mm/vmscan.c:3016
 shrink_node+0x176b/0x3590 mm/vmscan.c:3139
 kswapd_shrink_node mm/vmscan.c:3878 [inline]
 balance_pgdat+0x15a0/0x2790 mm/vmscan.c:4069
 kswapd+0x515/0x8b0 mm/vmscan.c:4328
 kthread+0x66b/0x780 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30

Local variable ----pmde.sroa.0@page_vma_mapped_walk created at:
 page_vma_mapped_walk+0xcf/0x35a0 mm/page_vma_mapped.c:164
 page_referenced_one+0x771/0xda0 mm/rmap.c:783
=====================================================
Kernel panic - not syncing: panic_on_kmsan set ...
CPU: 1 PID: 180 Comm: kswapd0 Tainted: G    B             5.15.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106
 dump_stack+0x25/0x28 lib/dump_stack.c:113
 panic+0x44f/0xdeb kernel/panic.c:232
 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:168
 __msan_warning+0xa9/0xf0 mm/kmsan/instrumentation.c:199
 arch_atomic_fetch_add arch/x86/include/asm/atomic.h:184 [inline]
 atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:112 [inline]
 __refcount_add include/linux/refcount.h:193 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 get_task_struct include/linux/sched/task.h:104 [inline]
 rwsem_mark_wake+0xb25/0xd60 kernel/locking/rwsem.c:514
 rwsem_wake kernel/locking/rwsem.c:1177 [inline]
 __up_write kernel/locking/rwsem.c:1323 [inline]
 up_write+0x1b0/0x220 kernel/locking/rwsem.c:1570
 anon_vma_unlock_write include/linux/rmap.h:121 [inline]
 split_huge_page_to_list+0x2165/0x2430 mm/huge_memory.c:2725
 shrink_page_list+0x3538/0x8680 mm/vmscan.c:1587
 shrink_inactive_list+0xb3d/0x17b0 mm/vmscan.c:2281
 shrink_list mm/vmscan.c:2508 [inline]
 shrink_lruvec+0x7bc/0x17f0 mm/vmscan.c:2827
 shrink_node_memcgs+0x5d3/0xc70 mm/vmscan.c:3016
 shrink_node+0x176b/0x3590 mm/vmscan.c:3139
 kswapd_shrink_node mm/vmscan.c:3878 [inline]
 balance_pgdat+0x15a0/0x2790 mm/vmscan.c:4069
 kswapd+0x515/0x8b0 mm/vmscan.c:4328
 kthread+0x66b/0x780 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/10/06 21:24 https://github.com/google/kmsan.git master c7f84f4e1147 62ee0987 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rwsem_mark_wake
2021/10/01 21:00 https://github.com/google/kmsan.git master 90f502f5d016 cc80db95 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rwsem_mark_wake
2021/09/27 12:39 https://github.com/google/kmsan.git master cd2c05533838 78494d16 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rwsem_mark_wake
2021/09/12 02:05 https://github.com/google/kmsan.git master 43b4682e8b8e 5ae8508a .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rwsem_mark_wake
2021/09/07 00:10 https://github.com/google/kmsan.git master 43b4682e8b8e 6ca60148 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rwsem_mark_wake
2021/09/03 17:27 https://github.com/google/kmsan.git master 43b4682e8b8e f62a5829 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rwsem_mark_wake
2021/07/09 14:31 https://github.com/google/kmsan.git master 57b5797c8013 281e815f .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rwsem_mark_wake
2021/10/10 10:40 https://github.com/google/kmsan.git master c7f84f4e1147 838e7e2c .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/10/06 18:13 https://github.com/google/kmsan.git master c7f84f4e1147 0a63fd36 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/10/03 01:45 https://github.com/google/kmsan.git master 90f502f5d016 db0f5787 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/09/21 10:00 https://github.com/google/kmsan.git master be0f0dd6a24b af796c18 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/09/21 00:46 https://github.com/google/kmsan.git master be0f0dd6a24b af796c18 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/09/07 13:41 https://github.com/google/kmsan.git master 43b4682e8b8e 6ca60148 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/07/14 10:13 https://github.com/google/kmsan.git master 57b5797c8013 484502bd .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/07/11 21:57 https://github.com/google/kmsan.git master 57b5797c8013 8f5a7b8c .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/07/10 19:20 https://github.com/google/kmsan.git master 57b5797c8013 8f5a7b8c .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
2021/06/27 06:40 https://github.com/google/kmsan.git master 57b5797c8013 9d2ab5df .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in rwsem_mark_wake
* Struck through repros no longer work on HEAD.