==================================================================
BUG: KMSAN: uninit-value in rcu_cblist_dequeue+0x1bb/0x290 kernel/rcu/rcu_segcblist.c:54
CPU: 0 PID: 4548 Comm: syz-executor0 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:53
 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
 rcu_cblist_dequeue+0x1bb/0x290 kernel/rcu/rcu_segcblist.c:54
 rcu_do_batch kernel/rcu/tree.c:2672 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
 rcu_process_callbacks+0x17cf/0x2070 kernel/rcu/tree.c:2917
 __do_softirq+0x56d/0x93d kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x202/0x240 kernel/softirq.c:405
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:541
 smp_apic_timer_interrupt+0x64/0x90 arch/x86/kernel/apic/apic.c:1055
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
 </IRQ>
RIP: 0010:native_restore_fl arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:78 [inline]
RIP: 0010:kmsan_alloc_page+0x9f/0xe0 mm/kmsan/kmsan.c:869
RSP: 0018:ffff88016803f350 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff12
RAX: 0000000000000246 RBX: ffff880168010000 RCX: 0000000000000001
RDX: 0000000000000001 RSI: ffffea0007d55ae0 RDI: ffffea0007d55ae0
RBP: ffff88016803f390 R08: 0000000000000000 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000015080c0 R15: ffffea0007d55a20
 __alloc_pages_nodemask+0xf5b/0x5dc0 mm/page_alloc.c:4283
 alloc_pages_current+0x6b5/0x970 mm/mempolicy.c:2055
 alloc_pages include/linux/gfp.h:494 [inline]
 pte_alloc_one+0x56/0x110 arch/x86/mm/pgtable.c:29
 __pte_alloc+0x86/0x410 mm/memory.c:654
 copy_pte_range mm/memory.c:1076 [inline]
 copy_pmd_range mm/memory.c:1152 [inline]
 copy_pud_range mm/memory.c:1186 [inline]
 copy_p4d_range mm/memory.c:1208 [inline]
 copy_page_range+0x2ffd/0x3f10 mm/memory.c:1270
 dup_mmap kernel/fork.c:513 [inline]
 dup_mm kernel/fork.c:1234 [inline]
 copy_mm kernel/fork.c:1288 [inline]
 copy_process+0x6d87/0x9bb0 kernel/fork.c:1794
 _do_fork+0x311/0xf00 kernel/fork.c:2088
 SYSC_clone+0xf6/0x110 kernel/fork.c:2195
 SyS_clone+0x77/0xa0 kernel/fork.c:2189
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x45402a
RSP: 002b:0000000000a3ea70 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000a3ea70 RCX: 000000000045402a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000a3eab0 R08: 0000000000000001 R09: 0000000000db4940
R10: 0000000000db4c10 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000001380

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:528
 rcu_cblist_dequeue+0x1e0/0x290 kernel/rcu/rcu_segcblist.c:54
 rcu_do_batch kernel/rcu/tree.c:2671 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
 rcu_process_callbacks+0x15cd/0x2070 kernel/rcu/tree.c:2917
 __do_softirq+0x56d/0x93d kernel/softirq.c:285
Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:528
 rcu_segcblist_enqueue+0x24c/0x2d0 kernel/rcu/rcu_segcblist.c:150
 __call_rcu+0x227/0xef0 kernel/rcu/tree.c:3060
 call_rcu_sched+0x32/0x40 kernel/rcu/tree.c:3100
 file_free fs/file_table.c:55 [inline]
 __fput+0x90e/0xa10 fs/file_table.c:226
 ____fput+0x37/0x40 fs/file_table.c:243
 task_work_run+0x243/0x2c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x10e1/0x38d0 kernel/exit.c:867
 do_group_exit+0x1a0/0x360 kernel/exit.c:970
 SYSC_exit_group+0x21/0x30 kernel/exit.c:981
 SyS_exit_group+0x25/0x30 kernel/exit.c:979
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Local variable description: ----flags.i.i.i.i@_raw_spin_lock_irqsave
Variable was created at:
 _raw_spin_lock_irqsave+0x45/0xf0 kernel/locking/spinlock.c:150
 __wake_up_common_lock+0x10c/0x370 kernel/sched/wait.c:124
==================================================================