syzbot

IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
==================================================================
BUG: KMSAN: uninit-value in entity_before kernel/sched/fair.c:497 [inline]
BUG: KMSAN: uninit-value in __enqueue_entity kernel/sched/fair.c:552 [inline]
BUG: KMSAN: uninit-value in put_prev_entity+0x185/0x700 kernel/sched/fair.c:4445
CPU: 0 PID: 5759 Comm: syz-executor2 Not tainted 4.17.0-rc5+ #103
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x149/0x260 mm/kmsan/kmsan.c:1084
 __msan_warning_32+0x6e/0xc0 mm/kmsan/kmsan_instr.c:686
 entity_before kernel/sched/fair.c:497 [inline]
 __enqueue_entity kernel/sched/fair.c:552 [inline]
 put_prev_entity+0x185/0x700 kernel/sched/fair.c:4445
 put_prev_task_fair+0x75/0xe0 kernel/sched/fair.c:7003
 put_prev_task kernel/sched/sched.h:1529 [inline]
 pick_next_task_stop+0x132/0x250 kernel/sched/stop_task.c:34
 pick_next_task+0x381/0x410 kernel/sched/core.c:3364
 __schedule+0x20b/0x730 kernel/sched/core.c:3481
 preempt_schedule_common kernel/sched/core.c:3631 [inline]
 _cond_resched+0x5e/0xd0 kernel/sched/core.c:4982
 stop_one_cpu+0x591/0x660 kernel/stop_machine.c:133
 sched_exec+0x270/0x2c0 kernel/sched/core.c:2996
 do_execveat_common+0xb5a/0x2da0 fs/exec.c:1760
 do_execve fs/exec.c:1862 [inline]
 __do_sys_execve fs/exec.c:1943 [inline]
 __se_sys_execve fs/exec.c:1938 [inline]
 __x64_sys_execve+0x127/0x180 fs/exec.c:1938
 do_syscall_64+0x152/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x454397
RSP: 002b:0000000000a3fac8 EFLAGS: 00000207 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000454397
RDX: 00007ffd9e8aba98 RSI: 0000000000a3fb00 RDI: 00000000004c9068
RBP: 0000000000a3fc80 R08: 0000000000000000 R09: 000000000000001b
R10: 0000000000000008 R11: 0000000000000207 R12: 0000000000a3fea8
R13: 0000000000a3fe28 R14: 0000000000000000 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:529
 __write_once_size include/linux/compiler.h:224 [inline]
 __rb_change_child include/linux/rbtree_augmented.h:144 [inline]
 __rb_rotate_set_parents lib/rbtree.c:93 [inline]
 ____rb_erase_color lib/rbtree.c:364 [inline]
 rb_erase_cached+0x2839/0x2ed0 lib/rbtree.c:480
 __dequeue_entity kernel/sched/fair.c:567 [inline]
 set_next_entity+0xf4/0xb60 kernel/sched/fair.c:4344
 pick_next_task_fair+0x2088/0x2520 kernel/sched/fair.c:6944
 pick_next_task+0x1b1/0x410 kernel/sched/core.c:3351
 __schedule+0x20b/0x730 kernel/sched/core.c:3481
 preempt_schedule_common kernel/sched/core.c:3631 [inline]
 _cond_resched+0x5e/0xd0 kernel/sched/core.c:4982
 zap_pmd_range mm/memory.c:1443 [inline]
 zap_pud_range mm/memory.c:1470 [inline]
 zap_p4d_range mm/memory.c:1491 [inline]
 unmap_page_range+0x35e0/0x3be0 mm/memory.c:1512
 unmap_single_vma+0x445/0x5e0 mm/memory.c:1557
 unmap_vmas+0x1f4/0x360 mm/memory.c:1587
 exit_mmap+0x4bb/0x970 mm/mmap.c:3105
 __mmput+0x158/0x600 kernel/fork.c:962
 mmput+0xab/0xf0 kernel/fork.c:983
 exit_mm+0x6ed/0x7a0 kernel/exit.c:545
 do_exit+0xc01/0x38d0 kernel/exit.c:854
 do_group_exit+0x1a0/0x360 kernel/exit.c:970
 __do_sys_exit_group+0x21/0x30 kernel/exit.c:981
 __se_sys_exit_group+0x14/0x20 kernel/exit.c:979
 __x64_sys_exit_group+0x4c/0x50 kernel/exit.c:979
 do_syscall_64+0x152/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:529
 __write_once_size include/linux/compiler.h:224 [inline]
 __rb_change_child include/linux/rbtree_augmented.h:142 [inline]
 __rb_rotate_set_parents lib/rbtree.c:93 [inline]
 __rb_insert lib/rbtree.c:196 [inline]
 rb_insert_color_cached+0xf71/0x1370 lib/rbtree.c:469
 __enqueue_entity kernel/sched/fair.c:561 [inline]
 put_prev_entity+0x426/0x700 kernel/sched/fair.c:4445
 pick_next_task_fair+0x2062/0x2520 kernel/sched/fair.c:6943
 pick_next_task+0x1b1/0x410 kernel/sched/core.c:3351
 __schedule+0x20b/0x730 kernel/sched/core.c:3481
 preempt_schedule_common kernel/sched/core.c:3631 [inline]
 _cond_resched+0x5e/0xd0 kernel/sched/core.c:4982
 zap_pmd_range mm/memory.c:1443 [inline]
 zap_pud_range mm/memory.c:1470 [inline]
 zap_p4d_range mm/memory.c:1491 [inline]
 unmap_page_range+0x35e0/0x3be0 mm/memory.c:1512
 unmap_single_vma+0x445/0x5e0 mm/memory.c:1557
 unmap_vmas+0x1f4/0x360 mm/memory.c:1587
 exit_mmap+0x4bb/0x970 mm/mmap.c:3105
 __mmput+0x158/0x600 kernel/fork.c:962
 mmput+0xab/0xf0 kernel/fork.c:983
 exit_mm+0x6ed/0x7a0 kernel/exit.c:545
 do_exit+0xc01/0x38d0 kernel/exit.c:854
 do_group_exit+0x1a0/0x360 kernel/exit.c:970
 __do_sys_exit_group+0x21/0x30 kernel/exit.c:981
 __se_sys_exit_group+0x14/0x20 kernel/exit.c:979
 __x64_sys_exit_group+0x4c/0x50 kernel/exit.c:979
 do_syscall_64+0x152/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Local variable description: ----flags.i.i.i.i@_raw_spin_lock_irqsave
Variable was created at:
 _raw_spin_lock_irqsave+0x45/0xf0 kernel/locking/spinlock.c:150
 hrtimer_interrupt+0x107/0x13c0 kernel/time/hrtimer.c:1499
==================================================================