KMSAN: uninit-value in __schedule (2)

Status: auto-obsoleted due to no activity on 2022/11/24 18:35
Subsystems: kernel
[Documentation on labels]
First crash: 1442d, last: 1442d
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __schedule (4) sctp 17 syz, C error 4 1071d 1067d 0/29 auto-obsoleted due to no activity on 2023/12/10 17:35
upstream KMSAN: uninit-value in __schedule (5) net 22 syz, C 595 155d 849d 0/29 auto-obsoleted due to no activity on 2026/05/28 17:49
upstream KMSAN: uninit-value in __schedule (3) trace net 7 2 1269d 1272d 0/29 auto-obsoleted due to no activity on 2023/05/17 02:32
linux-4.19 KASAN: use-after-free Read in __schedule 19 1 1985d 1985d 0/1 auto-closed as invalid on 2021/06/29 13:25
linux-6.1 KASAN: slab-out-of-bounds Write in __schedule origin:upstream 21 syz 4 403d 409d 0/3 auto-obsoleted due to no activity on 2025/10/09 02:03
linux-4.19 KASAN: use-after-free Read in __schedule (2) 19 1 1662d 1662d 0/1 auto-closed as invalid on 2022/05/18 22:28
android-54 BUG: unable to handle kernel paging request in __schedule 8 syz, C 12 1989d 2146d 0/2 auto-obsoleted due to no activity on 2023/04/17 21:57
upstream WARNING: locking bug in __schedule mm 4 1943 501d 790d 0/29 auto-obsoleted due to no activity on 2025/06/02 23:27
upstream general protection fault in __schedule (3) prio:low sound 2 1649 9d22h 56d 28/29 upstream: reported on 2026/06/12 18:10

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in schedule_debug kernel/sched/core.c:5736 [inline]
BUG: KMSAN: uninit-value in __schedule+0x510/0x21d0 kernel/sched/core.c:6388
 schedule_debug kernel/sched/core.c:5736 [inline]
 __schedule+0x510/0x21d0 kernel/sched/core.c:6388
 schedule+0x136/0x200 kernel/sched/core.c:6570
 freezable_schedule include/linux/freezer.h:172 [inline]
 do_nanosleep+0x14b/0x8c0 kernel/time/hrtimer.c:2044
 hrtimer_nanosleep+0x2bf/0x520 kernel/time/hrtimer.c:2097
 common_nsleep+0x106/0x120 kernel/time/posix-timers.c:1236
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1276 [inline]
 __se_sys_clock_nanosleep kernel/time/posix-timers.c:1254 [inline]
 __x64_sys_clock_nanosleep+0x613/0x6e0 kernel/time/posix-timers.c:1254
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 ops_init+0x30d/0x750 net/core/net_namespace.c:135
 setup_net+0x4fb/0x1320 net/core/net_namespace.c:326
 copy_net_ns+0x51e/0xa80 net/core/net_namespace.c:472
 create_new_namespaces+0x717/0xdb0 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x176/0x2a0 kernel/nsproxy.c:227
 ksys_unshare+0x851/0x1210 kernel/fork.c:3185
 __do_sys_unshare kernel/fork.c:3256 [inline]
 __se_sys_unshare kernel/fork.c:3254 [inline]
 __x64_sys_unshare+0x44/0x70 kernel/fork.c:3254
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 0x0
 0x18a6206d70
 0x59b0118
 kmsan_save_stack_with_flags mm/kmsan/core.c:80 [inline]
 kmsan_internal_poison_memory+0x45/0x90 mm/kmsan/core.c:65
 kmsan_slab_free+0xcd/0x130 mm/kmsan/hooks.c:88
 slab_free_hook mm/slub.c:1739 [inline]
 slab_free_freelist_hook+0x1b8/0x650 mm/slub.c:1795
 slab_free mm/slub.c:3549 [inline]
 kmem_cache_free+0x2cc/0x9c0 mm/slub.c:3566
 __kfree_skb+0x1ed/0x240 net/core/skbuff.c:767
 consume_skb+0x96/0x290 net/core/skbuff.c:930
 netlink_broadcast+0x1f4b/0x21d0 net/netlink/af_netlink.c:1518
 uevent_net_broadcast_tagged lib/kobject_uevent.c:372 [inline]
 kobject_uevent_net_broadcast+0xbf9/0xd50 lib/kobject_uevent.c:412
 kobject_uevent_env+0xd35/0x1230 lib/kobject_uevent.c:593
 kobject_uevent+0x33/0x40 lib/kobject_uevent.c:642
 device_add+0x1b03/0x26c0 drivers/base/core.c:3498
 netdev_register_kobject+0x1eb/0x520 net/core/net-sysfs.c:2015
 register_netdevice+0x19c0/0x2240 net/core/dev.c:10070

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/08/26 18:24 https://github.com/google/kmsan.git master ac3859c02d7f e5a303f1 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in __schedule
* Struck through repros no longer work on HEAD.