================================================================== BUG: KMSAN: uninit-value in __list_add_valid+0x1a2/0x450 lib/list_debug.c:23 CPU: 1 PID: 4515 Comm: syzkaller062385 Not tainted 4.16.0+ #86 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683 __list_add_valid+0x1a2/0x450 lib/list_debug.c:23 __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] account_entity_enqueue kernel/sched/fair.c:2667 [inline] enqueue_entity kernel/sched/fair.c:4036 [inline] enqueue_task_fair+0xe06/0x43a0 kernel/sched/fair.c:5219 enqueue_task kernel/sched/core.c:774 [inline] activate_task kernel/sched/core.c:793 [inline] ttwu_activate kernel/sched/core.c:1664 [inline] ttwu_do_activate kernel/sched/core.c:1723 [inline] ttwu_queue kernel/sched/core.c:1868 [inline] try_to_wake_up+0x13cc/0x20a0 kernel/sched/core.c:2081 wake_up_process+0x34/0x40 kernel/sched/core.c:2154 hrtimer_wakeup+0xac/0x100 kernel/time/hrtimer.c:1598 __run_hrtimer kernel/time/hrtimer.c:1349 [inline] __hrtimer_run_queues+0xc03/0x15d0 kernel/time/hrtimer.c:1411 hrtimer_interrupt+0x426/0xaf0 kernel/time/hrtimer.c:1469 local_apic_timer_interrupt+0x66/0x230 arch/x86/kernel/apic/apic.c:1025 smp_apic_timer_interrupt+0x5a/0x90 arch/x86/kernel/apic/apic.c:1053 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857 RIP: 0010:finish_lock_switch+0x38/0x50 kernel/sched/core.c:2632 RSP: 0018:ffff8801979afbe8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff12 RAX: ffff88021f2dab00 RBX: ffff8801ce490918 RCX: ffff880000000000 RDX: ffff88021f2dbb00 RSI: aaaaaaaaaaaab000 RDI: ffffea0000000000 RBP: ffff8801979afc00 R08: 0000000001080020 R09: 0000000000000002 R10: ffffffff7fffffff R11: ffff8801b6220000 R12: ffff88021fd3eb00 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88021f2dab00 finish_task_switch+0xdb/0x230 kernel/sched/core.c:2719 context_switch kernel/sched/core.c:2869 [inline] __schedule+0x68e/0x730 kernel/sched/core.c:3446 schedule+0x1cc/0x2f0 kernel/sched/core.c:3505 freezable_schedule include/linux/freezer.h:172 [inline] do_nanosleep+0x2c3/0x9b0 kernel/time/hrtimer.c:1640 hrtimer_nanosleep kernel/time/hrtimer.c:1694 [inline] SYSC_nanosleep+0x420/0x6a0 kernel/time/hrtimer.c:1726 SyS_nanosleep+0x46/0x70 kernel/time/hrtimer.c:1713 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x4425d0 RSP: 002b:00000000007eef38 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 RAX: ffffffffffffffda RBX: 0000000000000256 RCX: 00000000004425d0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000007eef40 RBP: 00000000007ef070 R08: 0000000000000001 R09: 0000000001690880 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000005aa R13: 00000000000005aa R14: 0000000000152dd5 R15: 00000000007ef098 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_save_stack mm/kmsan/kmsan.c:293 [inline] kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:528 __write_once_size include/linux/compiler.h:224 [inline] __list_add include/linux/list.h:66 [inline] list_add include/linux/list.h:79 [inline] list_move include/linux/list.h:171 [inline] pick_next_task_fair+0x1edc/0x1f70 kernel/sched/fair.c:6748 pick_next_task+0x1b4/0x410 kernel/sched/core.c:3290 __schedule+0x211/0x730 kernel/sched/core.c:3420 preempt_schedule_common kernel/sched/core.c:3585 [inline] _cond_resched+0x5e/0xd0 kernel/sched/core.c:4932 anon_vma_free mm/rmap.c:117 [inline] __put_anon_vma+0x77/0x3e0 mm/rmap.c:1708 put_anon_vma include/linux/rmap.h:115 [inline] unlink_anon_vmas+0x8dd/0xc20 mm/rmap.c:415 free_pgtables+0x2c9/0x650 mm/memory.c:641 exit_mmap+0x46c/0x950 mm/mmap.c:3039 __mmput+0x16c/0x610 kernel/fork.c:961 mmput+0xab/0xf0 kernel/fork.c:982 exit_mm+0x6ed/0x7a0 kernel/exit.c:545 do_exit+0xc01/0x38d0 kernel/exit.c:854 do_group_exit+0x1a0/0x360 kernel/exit.c:970 SYSC_exit_group+0x21/0x30 kernel/exit.c:981 SyS_exit_group+0x25/0x30 kernel/exit.c:979 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_save_stack mm/kmsan/kmsan.c:293 [inline] kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:528 __rb_insert lib/rbtree.c:104 [inline] rb_insert_color_cached+0xddf/0x1370 lib/rbtree.c:469 __enqueue_entity kernel/sched/fair.c:576 [inline] enqueue_entity kernel/sched/fair.c:4045 [inline] enqueue_task_fair+0x17f6/0x43a0 kernel/sched/fair.c:5219 enqueue_task kernel/sched/core.c:774 [inline] activate_task kernel/sched/core.c:793 [inline] ttwu_activate kernel/sched/core.c:1664 [inline] ttwu_do_activate kernel/sched/core.c:1723 [inline] ttwu_queue kernel/sched/core.c:1868 [inline] try_to_wake_up+0x13cc/0x20a0 kernel/sched/core.c:2081 wake_up_process+0x34/0x40 kernel/sched/core.c:2154 hrtimer_wakeup+0xac/0x100 kernel/time/hrtimer.c:1598 __run_hrtimer kernel/time/hrtimer.c:1349 [inline] __hrtimer_run_queues+0xc03/0x15d0 kernel/time/hrtimer.c:1411 hrtimer_interrupt+0x426/0xaf0 kernel/time/hrtimer.c:1469 local_apic_timer_interrupt+0x66/0x230 arch/x86/kernel/apic/apic.c:1025 smp_apic_timer_interrupt+0x5a/0x90 arch/x86/kernel/apic/apic.c:1053 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314 kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756 anon_vma_chain_alloc mm/rmap.c:128 [inline] anon_vma_fork+0x347/0xb20 mm/rmap.c:343 dup_mmap kernel/fork.c:468 [inline] dup_mm kernel/fork.c:1234 [inline] copy_mm kernel/fork.c:1288 [inline] copy_process+0x65cf/0x9bb0 kernel/fork.c:1794 _do_fork+0x311/0xf00 kernel/fork.c:2088 SYSC_clone+0xf6/0x110 kernel/fork.c:2195 SyS_clone+0x77/0xa0 kernel/fork.c:2189 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 ==================================================================