==================================================================
BUG: KMSAN: uninit-value in rcu_segcblist_pend_cbs+0xa9/0xf0 kernel/rcu/rcu_segcblist.c:104
CPU: 1 PID: 10139 Comm: syz-executor0 Not tainted 4.17.0+ #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
 __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620
 rcu_segcblist_pend_cbs+0xa9/0xf0 kernel/rcu/rcu_segcblist.c:104
 rcu_accelerate_cbs+0x7e/0xca0 kernel/rcu/tree.c:1810
 rcu_report_qs_rdp kernel/rcu/tree.c:2514 [inline]
 rcu_check_quiescent_state kernel/rcu/tree.c:2553 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2881 [inline]
 rcu_process_callbacks+0x84b/0x2060 kernel/rcu/tree.c:2914
 __do_softirq+0x592/0x979 kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x202/0x240 kernel/softirq.c:405
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:525
 smp_apic_timer_interrupt+0x64/0x90 arch/x86/kernel/apic/apic.c:1055
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 </IRQ>
RIP: 0010:finish_lock_switch+0x38/0x50 kernel/sched/core.c:2626
RSP: 0018:ffff8801092af350 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff88021f2dac40 RBX: 0000000000000001 RCX: ffff880000000000
RDX: ffff88021f2dbc40 RSI: aaaaaaaaaaaab000 RDI: ffffea0000000000
RBP: ffff8801092af368 R08: 0000000001080020 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff813553c0 R12: ffff88021fd3ec40
R13: ffff88011a8f4358 R14: 0000000000000000 R15: ffff88021f2dac40
 finish_task_switch+0xde/0x270 kernel/sched/core.c:2725
 context_switch kernel/sched/core.c:2883 [inline]
 __schedule+0x66b/0x770 kernel/sched/core.c:3524
 preempt_schedule_common kernel/sched/core.c:3648 [inline]
 _cond_resched+0x5e/0xd0 kernel/sched/core.c:4999
 lock_page include/linux/pagemap.h:481 [inline]
 find_lock_entry+0x157/0x720 mm/filemap.c:1497
 shmem_getpage_gfp+0x61f/0x5980 mm/shmem.c:1628
 shmem_getpage mm/shmem.c:131 [inline]
 shmem_file_read_iter+0x508/0x1180 mm/shmem.c:2470
 call_read_iter include/linux/fs.h:1778 [inline]
 generic_file_splice_read+0x5d7/0x900 fs/splice.c:307
 do_splice_to fs/splice.c:880 [inline]
 splice_direct_to_actor+0x4cb/0x1040 fs/splice.c:952
 do_splice_direct+0x335/0x540 fs/splice.c:1061
 do_sendfile+0x107b/0x1e40 fs/read_write.c:1440
 __do_sys_sendfile64 fs/read_write.c:1495 [inline]
 __se_sys_sendfile64 fs/read_write.c:1487 [inline]
 __x64_sys_sendfile64+0x218/0x390 fs/read_write.c:1487
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x455b29
RSP: 002b:00007fccdb0a1c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007fccdb0a26d4 RCX: 0000000000455b29
RDX: 00000000200000c0 RSI: 0000000000000013 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000007f8 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004c0acd R14: 00000000004d0480 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:464
 rcu_segcblist_enqueue+0x275/0x2d0 kernel/rcu/rcu_segcblist.c:151
 __call_rcu+0x227/0xef0 kernel/rcu/tree.c:3057
 call_rcu_sched+0x32/0x40 kernel/rcu/tree.c:3097
 release_task+0x24b9/0x2530 kernel/exit.c:223
 exit_notify kernel/exit.c:736 [inline]
 do_exit+0x2e11/0x3930 kernel/exit.c:887
 do_group_exit+0x1a0/0x360 kernel/exit.c:970
 get_signal+0x1405/0x1ec0 kernel/signal.c:2482
 do_signal+0xb8/0x1d20 arch/x86/kernel/signal.c:810
 exit_to_usermode_loop arch/x86/entry/common.c:162 [inline]
 prepare_exit_to_usermode+0x271/0x3a0 arch/x86/entry/common.c:196
 syscall_return_slowpath+0xe9/0x710 arch/x86/entry/common.c:265
 do_syscall_64+0x1ad/0x230 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Local variable description: ----ac@__alloc_pages_nodemask
Variable was created at:
 __alloc_pages_nodemask+0x196/0x5cc0 mm/page_alloc.c:4355
 alloc_pages_current+0x6b1/0x970 mm/mempolicy.c:2093
==================================================================