=====================================================
BUG: KMSAN: use-after-free in calc_group_shares kernel/sched/fair.c:3926 [inline]
BUG: KMSAN: use-after-free in update_cfs_group kernel/sched/fair.c:3960 [inline]
BUG: KMSAN: use-after-free in entity_tick kernel/sched/fair.c:5573 [inline]
BUG: KMSAN: use-after-free in task_tick_fair+0x50e/0xbf0 kernel/sched/fair.c:13121
calc_group_shares kernel/sched/fair.c:3926 [inline]
update_cfs_group kernel/sched/fair.c:3960 [inline]
entity_tick kernel/sched/fair.c:5573 [inline]
task_tick_fair+0x50e/0xbf0 kernel/sched/fair.c:13121
sched_tick+0x275/0x1070 kernel/sched/core.c:5600
update_process_times+0x27f/0x2e0 kernel/time/timer.c:2478
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x558/0x670 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x559/0xd80 kernel/time/hrtimer.c:1841
hrtimer_interrupt+0x456/0xb80 kernel/time/hrtimer.c:1903
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1041 [inline]
__sysvec_apic_timer_interrupt+0xaa/0x420 arch/x86/kernel/apic/apic.c:1058
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0x7f/0x90 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
tsk_fork_get_node+0x24/0xb0 kernel/kthread.c:472
dup_task_struct+0x6c/0xb50 kernel/fork.c:872
copy_process+0x927/0x5eb0 kernel/fork.c:2012
kernel_clone+0x416/0x1080 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x253/0x360 kernel/fork.c:2734
x64_sys_call+0x14f4/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:57
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
pool index 12077 out of bounds (637) for stack id 69662f2e
WARNING: CPU: 0 PID: 14020 at lib/stackdepot.c:501 depot_fetch_stack+0x53/0x80 lib/stackdepot.c:500
Modules linked in:
CPU: 0 UID: 0 PID: 14020 Comm: syz-executor Tainted: G W syzkaller #0 PREEMPT(none)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:depot_fetch_stack+0x53/0x80 lib/stackdepot.c:500
Code: e9 0d 81 e1 f0 3f 00 00 83 7c 08 1c 00 74 34 48 01 c8 e9 90 d9 ed 09 cc 55 48 89 e5 90 48 c7 c7 b8 62 a8 91 e8 ae d5 82 fa 90 <0f> 0b 90 90 31 c0 5d c3 cc cc cc cc cc 90 0f 0b 90 31 c0 c3 cc cc
RSP: 0018:ffff88813fc04800 EFLAGS: 00010006
RAX: ffffffff81208325 RBX: ffff88813fc04830 RCX: ffff88802ecfc200
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffff88813fc04800 R08: ffffea000000000f R09: 0000000000000000
R10: ffff888237aba028 R11: 000000000003de48 R12: 0000000000000011
R13: ffff88802ecfc200 R14: 0000000069662f2e R15: ffff88813fc04918
FS: 000055559234a500(0000) GS:ffff8881aad51000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8a19b156c0 CR3: 0000000051700000 CR4: 00000000003526f0
Call Trace:
stack_depot_fetch+0x3d/0x70 lib/stackdepot.c:767
kmsan_print_origin+0x4c/0x340 mm/kmsan/report.c:100
kmsan_report+0x1d3/0x320 mm/kmsan/report.c:196
__msan_warning+0x1b/0x30 mm/kmsan/instrumentation.c:315
calc_group_shares kernel/sched/fair.c:3926 [inline]
update_cfs_group kernel/sched/fair.c:3960 [inline]
entity_tick kernel/sched/fair.c:5573 [inline]
task_tick_fair+0x50e/0xbf0 kernel/sched/fair.c:13121
sched_tick+0x275/0x1070 kernel/sched/core.c:5600
update_process_times+0x27f/0x2e0 kernel/time/timer.c:2478
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x558/0x670 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x559/0xd80 kernel/time/hrtimer.c:1841
hrtimer_interrupt+0x456/0xb80 kernel/time/hrtimer.c:1903
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1041 [inline]
__sysvec_apic_timer_interrupt+0xaa/0x420 arch/x86/kernel/apic/apic.c:1058
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0x7f/0x90 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
RIP: 0010:tsk_fork_get_node+0x24/0xb0 kernel/kthread.c:472
Code: 90 90 90 90 90 90 0f 1f 40 d6 55 48 89 e5 41 57 41 56 53 49 89 fe e8 ab 7d f7 00 48 89 c3 e8 43 a1 51 00 4c 8b 3d c4 b2 53 13 <48> c7 c7 88 39 f9 94 e8 30 72 f7 00 48 8b 00 48 85 c0 74 0e 4c 89
RSP: 0018:ffff8880372cbaa0 EFLAGS: 00000293
RAX: ffffffff81a586bd RBX: ffff88802ecfcda0 RCX: ffff88802ecfc200
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff88802ecfc200
RBP: ffff8880372cbab8 R08: ffffea000000000f R09: 0000000000000000
R10: ffff888237aba028 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88802ecfc200 R14: ffff88802ecfc200 R15: ffff88814048a100
dup_task_struct+0x6c/0xb50 kernel/fork.c:872
copy_process+0x927/0x5eb0 kernel/fork.c:2012
kernel_clone+0x416/0x1080 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x253/0x360 kernel/fork.c:2734
x64_sys_call+0x14f4/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:57
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8a18d85e13
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007fffbd1c2dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8a18d85e13
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 000055559234a7d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 00000000001503b2 R15: 00007fffbd1c2f60
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
corrupt handle or use after stack_depot_put()
WARNING: CPU: 0 PID: 14020 at lib/stackdepot.c:772 stack_depot_fetch+0x67/0x70 lib/stackdepot.c:772
Modules linked in:
CPU: 0 UID: 0 PID: 14020 Comm: syz-executor Tainted: G W syzkaller #0 PREEMPT(none)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:stack_depot_fetch+0x67/0x70 lib/stackdepot.c:772
Code: 48 85 c0 74 17 48 89 c1 48 83 c1 20 48 89 0b 8b 40 14 5b 41 5e 5d c3 cc cc cc cc cc 90 48 c7 c7 64 ef bf 91 e8 0a d5 82 fa 90 <0f> 0b 90 90 31 c0 eb e0 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffff88813fc04810 EFLAGS: 00010006
RAX: ffffffff81208325 RBX: ffff88813fc04830 RCX: ffff88802ecfc200
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffff88813fc04820 R08: ffffea000000000f R09: 0000000000000000
R10: ffff888237aba028 R11: 000000000003fe70 R12: 0000000000000011
R13: ffff88802ecfc200 R14: 0000000069662f2e R15: ffff88813fc04918
FS: 000055559234a500(0000) GS:ffff8881aad51000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8a19b156c0 CR3: 0000000051700000 CR4: 00000000003526f0
Call Trace:
kmsan_print_origin+0x4c/0x340 mm/kmsan/report.c:100
kmsan_report+0x1d3/0x320 mm/kmsan/report.c:196
__msan_warning+0x1b/0x30 mm/kmsan/instrumentation.c:315
calc_group_shares kernel/sched/fair.c:3926 [inline]
update_cfs_group kernel/sched/fair.c:3960 [inline]
entity_tick kernel/sched/fair.c:5573 [inline]
task_tick_fair+0x50e/0xbf0 kernel/sched/fair.c:13121
sched_tick+0x275/0x1070 kernel/sched/core.c:5600
update_process_times+0x27f/0x2e0 kernel/time/timer.c:2478
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x558/0x670 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x559/0xd80 kernel/time/hrtimer.c:1841
hrtimer_interrupt+0x456/0xb80 kernel/time/hrtimer.c:1903
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1041 [inline]
__sysvec_apic_timer_interrupt+0xaa/0x420 arch/x86/kernel/apic/apic.c:1058
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0x7f/0x90 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
RIP: 0010:tsk_fork_get_node+0x24/0xb0 kernel/kthread.c:472
Code: 90 90 90 90 90 90 0f 1f 40 d6 55 48 89 e5 41 57 41 56 53 49 89 fe e8 ab 7d f7 00 48 89 c3 e8 43 a1 51 00 4c 8b 3d c4 b2 53 13 <48> c7 c7 88 39 f9 94 e8 30 72 f7 00 48 8b 00 48 85 c0 74 0e 4c 89
RSP: 0018:ffff8880372cbaa0 EFLAGS: 00000293
RAX: ffffffff81a586bd RBX: ffff88802ecfcda0 RCX: ffff88802ecfc200
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff88802ecfc200
RBP: ffff8880372cbab8 R08: ffffea000000000f R09: 0000000000000000
R10: ffff888237aba028 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88802ecfc200 R14: ffff88802ecfc200 R15: ffff88814048a100
dup_task_struct+0x6c/0xb50 kernel/fork.c:872
copy_process+0x927/0x5eb0 kernel/fork.c:2012
kernel_clone+0x416/0x1080 kernel/fork.c:2609
__do_sys_clone kernel/fork.c:2750 [inline]
__se_sys_clone kernel/fork.c:2734 [inline]
__x64_sys_clone+0x253/0x360 kernel/fork.c:2734
x64_sys_call+0x14f4/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:57
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8a18d85e13
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007fffbd1c2dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8a18d85e13
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 000055559234a7d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 00000000001503b2 R15: 00007fffbd1c2f60
---[ end trace 0000000000000000 ]---
Uninit was created at:
(stack is not available)
CPU: 0 UID: 0 PID: 14020 Comm: syz-executor Tainted: G W syzkaller #0 PREEMPT(none)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
=====================================================
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 0f 1f 40 d6 nopl -0x2a(%rax)
a: 55 push %rbp
b: 48 89 e5 mov %rsp,%rbp
e: 41 57 push %r15
10: 41 56 push %r14
12: 53 push %rbx
13: 49 89 fe mov %rdi,%r14
16: e8 ab 7d f7 00 call 0xf77dc6
1b: 48 89 c3 mov %rax,%rbx
1e: e8 43 a1 51 00 call 0x51a166
23: 4c 8b 3d c4 b2 53 13 mov 0x1353b2c4(%rip),%r15 # 0x1353b2ee
* 2a: 48 c7 c7 88 39 f9 94 mov $0xffffffff94f93988,%rdi <-- trapping instruction
31: e8 30 72 f7 00 call 0xf77266
36: 48 8b 00 mov (%rax),%rax
39: 48 85 c0 test %rax,%rax
3c: 74 0e je 0x4c
3e: 4c rex.WR
3f: 89 .byte 0x89