syzbot


KMSAN: uninit-value in sys_close

Status: closed as invalid on 2026/02/04 00:51
Subsystems: fs
[Documentation on labels]
First crash: 27d, last: 27d

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __do_sys_close fs/open.c:1567 [inline]
BUG: KMSAN: uninit-value in __se_sys_close fs/open.c:1558 [inline]
BUG: KMSAN: uninit-value in __x64_sys_close+0x292/0x2c0 fs/open.c:1558
 __do_sys_close fs/open.c:1567 [inline]
 __se_sys_close fs/open.c:1558 [inline]
 __x64_sys_close+0x292/0x2c0 fs/open.c:1558
 x64_sys_call+0x379f/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:4
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4960 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_noprof+0x967/0x1730 mm/slub.c:5270
 dup_fd+0x66/0x1160 fs/file.c:390
 copy_files+0x10c/0x250 kernel/fork.c:1635
 copy_process+0x25ab/0x5df0 kernel/fork.c:2209
 kernel_clone+0x415/0x1080 kernel/fork.c:2651
 __do_sys_clone kernel/fork.c:2792 [inline]
 __se_sys_clone kernel/fork.c:2776 [inline]
 __x64_sys_clone+0x253/0x360 kernel/fork.c:2776
 x64_sys_call+0x1666/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 11418 Comm: sed Tainted: G        W    L      syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/03 05:03 upstream dee65f79364c d78927dd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in sys_close
* Struck through repros no longer work on HEAD.