syzbot

1965979 pages RAM
0 pages HighMem/MovableOnly
285200 pages reserved
0 pages cma reserved
==================================================================
BUG: KMSAN: uninit-value in _ion_heap_freelist_drain+0x7ce/0x840 drivers/staging/android/ion/ion_heap.c:190
CPU: 0 PID: 10744 Comm: syz-executor968 Not tainted 5.1.0-rc2+ #21
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x173/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x131/0x2a0 mm/kmsan/kmsan.c:624
 __msan_warning+0x7a/0xf0 mm/kmsan/kmsan_instr.c:310
 _ion_heap_freelist_drain+0x7ce/0x840 drivers/staging/android/ion/ion_heap.c:190
 ion_heap_freelist_shrink drivers/staging/android/ion/ion_heap.c:216 [inline]
 ion_heap_shrink_scan+0x13e/0x350 drivers/staging/android/ion/ion_heap.c:294
 do_shrink_slab+0xb63/0x1240 mm/vmscan.c:551
 shrink_slab+0x307/0xe30 mm/vmscan.c:700
 shrink_node+0x87c/0x2140 mm/vmscan.c:2724
 shrink_zones mm/vmscan.c:2953 [inline]
 do_try_to_free_pages+0x55e/0x20b0 mm/vmscan.c:3015
 try_to_free_pages+0xc58/0x1720 mm/vmscan.c:3231
 __perform_reclaim mm/page_alloc.c:4004 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:4026 [inline]
 __alloc_pages_slowpath mm/page_alloc.c:4419 [inline]
 __alloc_pages_nodemask+0x2ff8/0x5e90 mm/page_alloc.c:4633
 alloc_pages_current+0x6a4/0x9c0 mm/mempolicy.c:2106
 alloc_pages include/linux/gfp.h:511 [inline]
 ion_page_pool_alloc_pages drivers/staging/android/ion/ion_page_pool.c:16 [inline]
 ion_page_pool_alloc+0x7d2/0x8d0 drivers/staging/android/ion/ion_page_pool.c:75
 alloc_buffer_page drivers/staging/android/ion/ion_system_heap.c:53 [inline]
 alloc_largest_available drivers/staging/android/ion/ion_system_heap.c:87 [inline]
 ion_system_heap_allocate+0x47f/0x1400 drivers/staging/android/ion/ion_system_heap.c:118
 ion_buffer_create drivers/staging/android/ion/ion.c:76 [inline]
 ion_alloc drivers/staging/android/ion/ion.c:417 [inline]
 ion_ioctl+0x796/0x2270 drivers/staging/android/ion/ion.c:543
 do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46
 ksys_ioctl fs/ioctl.c:713 [inline]
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718
 __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x44bc39
Code: e8 fc e5 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b ca fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f93fde33ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000006f0028 RCX: 000000000044bc39
RDX: 0000000020000000 RSI: 00000000c0184900 RDI: 0000000000000008
RBP: 00000000006f0020 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006f002c
R13: 00000000007ffcdf R14: 00007f93fde349c0 R15: 20c49ba5e353f7cf

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:220 [inline]
 kmsan_internal_chain_origin+0x134/0x230 mm/kmsan/kmsan.c:426
 __msan_chain_origin+0x70/0xe0 mm/kmsan/kmsan_instr.c:200
 __write_once_size include/linux/compiler.h:229 [inline]
 __list_add include/linux/list.h:66 [inline]
 list_add include/linux/list.h:79 [inline]
 ion_heap_freelist_add+0x3ac/0x3c0 drivers/staging/android/ion/ion_heap.c:160
 _ion_buffer_destroy drivers/staging/android/ion/ion.c:141 [inline]
 ion_dma_buf_release+0x18b/0x1e0 drivers/staging/android/ion/ion.c:308
 dma_buf_release+0x194/0x820 drivers/dma-buf/dma-buf.c:70
 __fput+0x4d2/0xbb0 fs/file_table.c:278
 ____fput+0x37/0x40 fs/file_table.c:309
 task_work_run+0x22e/0x2a0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x109e/0x3bb0 kernel/exit.c:878
 do_group_exit+0x185/0x320 kernel/exit.c:982
 get_signal+0x9a4/0x2ea0 kernel/signal.c:2577
 do_signal+0x1d5/0x2cc0 arch/x86/kernel/signal.c:816
 exit_to_usermode_loop arch/x86/entry/common.c:162 [inline]
 prepare_exit_to_usermode+0x245/0x420 arch/x86/entry/common.c:197
 syscall_return_slowpath+0xb2/0x650 arch/x86/entry/common.c:268
 do_syscall_64+0xe2/0xf0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline]
 kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:159
 kmsan_kmalloc+0xa9/0x130 mm/kmsan/kmsan_hooks.c:173
 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:182
 slab_post_alloc_hook mm/slab.h:441 [inline]
 slab_alloc_node mm/slub.c:2771 [inline]
 __kmalloc_node_track_caller+0xead/0x1000 mm/slub.c:4396
 __kmalloc_reserve net/core/skbuff.c:140 [inline]
 __alloc_skb+0x309/0xa20 net/core/skbuff.c:208
 alloc_skb include/linux/skbuff.h:1059 [inline]
 nlmsg_new include/net/netlink.h:658 [inline]
 netlink_ack+0x58e/0x1190 net/netlink/af_netlink.c:2419
 netlink_rcv_skb+0x316/0x620 net/netlink/af_netlink.c:2491
 genl_rcv+0x63/0x80 net/netlink/genetlink.c:637
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1925
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg net/socket.c:632 [inline]
 ___sys_sendmsg+0xdb3/0x1220 net/socket.c:2137
 __sys_sendmsg net/socket.c:2175 [inline]
 __do_sys_sendmsg net/socket.c:2184 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2182
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2182
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
==================================================================