general protection fault in pick_next

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
a619874a-d303-44a2-96e6-10347692cd66	assessment-security		💥	general protection fault in pick_next_entity	2026/05/14 11:31	2026/05/14 11:31	2026/05/14 11:33	6ccb967e465e832a7bfd7a116ad00d52a0923a5d	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/33890f607d3bc0f0ad1e6ea6826d459694954000" "-s" "bzImage" "compile_commands.json"]: exit status 2 Root cause: error: unable to open output file 'security/integrity/ima/ima_fs.o': 'No such file or directory' /app/workdir/cache/src/190fdeafad346ca29155c808bb38a4427cd79c09/lib/maple_tree.c:3514:20: warning: stack frame size (2424) exceeds limit (2048) in 'mas_wr_store_entry' [-Wframe-larger-than] 3514 \| static inline void mas_wr_store_entry(struct ma_wr_state wr_mas) \| ^ 1 warning generated. /app/workdir/cache/src/190fdeafad346ca29155c808bb38a4427cd79c09/security/apparmor/apparmorfs.c:177:28: warning: unused function 'get_loaddata_common_ref' [-Wunused-function] 177 \| static struct aa_loaddata get_loaddata_common_ref(struct aa_common_ref ref) \| ^~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. /app/workdir/cache/src/190fdeafad346ca29155c808bb38a4427cd79c09/sound/usb/mixer_s1810c.c:634:5: warning: stack frame size (2360) exceeds limit (2048) in 'snd_sc1810_init_mixer' [-Wframe-larger-than] 634 \| int snd_sc1810_init_mixer(struct usb_mixer_interface mixer) \| ^ 1 warning generated. /app/workdir/cache/src/190fdeafad346ca29155c808bb38a4427cd79c09/security/apparmor/policy_unpack.c:1727:5: warning: stack frame size (2872) exceeds limit (2048) in 'aa_unpack' [-Wframe-larger-than] 1727 \| int aa_unpack(struct aa_loaddata udata, struct list_head lh, \| ^ 1 warning generated. fixdep: not all data was written to the output make[5]: * [/app/workdir/cache/src/190fdeafad346ca29155c808bb38a4427cd79c09/scripts/Makefile.build:289: net/ipv6/af_inet6.o] Error 1 make[5]: * Deleting file 'net/ipv6/af_inet6.o' make[4]: * [/app/workdir/cache/src/190fdeafad346ca29155c808bb38a4427cd79c09/scripts/Makefile.build:548: net/ipv6] Error 2 make[4]: * Waiting for unfinished jobs.... fatal error: error in backend: IO failure on output stream: No space left on device PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script. Stack dump: 0. Program arguments: /usr/bin/clang --target=x86_64-linux-gnu -fintegrated-as -Werror=unknown-warning-option -Werror=ignored-optimization-argument -Werror=option-ignored -Werror=unused-command-line-argument -fmacro-prefix-map=/app/workdir/cache/src/190fdeafad346ca29155c808bb38a4427cd79c09/= -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-extensions -Wno-gnu -Wno-microsoft-anon-tag -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mstack-alignment=8 -mskip-rax-setup -march=x86-64 -mtune=generic -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mretpoline-external-thunk -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -fpatchable-function-entry=16,16 -fno-delete-null-pointer-checks -O2 -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -fno-stack-clash-protection -falign-functions=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-format-overflow-non-kprintf -Wno-format-truncation-non-kprintf -Wno-default-const-init-unsafe -Wno-type-limits -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wimplicit-fallthrough -Werror=date-time -Werror=incompatible-pointer-types -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-vari

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KMSAN: uninit-value in enqueue_entity kernel	7				3	1551d	1592d	0/29	auto-closed as invalid on 2022/05/17 04:41

Kernel

Title

Rank 🛈

upstream

KMSAN: uninit-value in enqueue_entity kernel

1551d

1592d

0/29

auto-closed as invalid on 2022/05/17 04:41

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] CPU: 0 UID: 0 PID: 7450 Comm: syz.3.519 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:pick_next_entity+0xca8/0xe90 kernel/sched/fair.c:5757 Code: 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 bd ea 97 00 4c 3b 33 79 05 48 8b 6c 24 40 48 8d 5d 59 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 75 61 80 3b 00 74 14 48 8b 7c 24 70 48 89 ee RSP: 0018:ffffc9000594f1d0 EFLAGS: 00010002 RAX: 000000000000000b RBX: 0000000000000059 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff8880b863af00 RDI: ffff8880b863af50 RBP: 0000000000000000 R08: ffff88807c081ec7 R09: 1ffff1100f8103d8 R10: dffffc0000000000 R11: ffffed100f8103d9 R12: dffffc0000000000 R13: ffff8880b863af00 R14: 0000000000000000 R15: ffff8880b863af01 FS: 0000555594831500(0000) GS:ffff888125290000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001e80 CR3: 0000000075766000 CR4: 00000000003526f0 Call Trace: <TASK> wakeup_preempt_fair+0x7a4/0xb60 kernel/sched/fair.c:9141 wakeup_preempt+0x162/0x300 kernel/sched/core.c:2248 attach_task kernel/sched/sched.h:3035 [inline] attach_tasks kernel/sched/fair.c:10026 [inline] sched_balance_rq+0x42c4/0x5a60 kernel/sched/fair.c:12164 sched_balance_newidle kernel/sched/fair.c:13239 [inline] pick_next_task_fair+0xb3f/0x1ab0 kernel/sched/fair.c:9267 __pick_next_task+0xe6/0x480 kernel/sched/core.c:6019 pick_next_task kernel/sched/core.c:-1 [inline] __schedule+0x974/0x5680 kernel/sched/core.c:7105 __schedule_loop kernel/sched/core.c:7268 [inline] schedule+0x164/0x360 kernel/sched/core.c:7283 do_nanosleep+0x1c2/0x620 kernel/time/hrtimer.c:2293 hrtimer_nanosleep+0x18f/0x3a0 kernel/time/hrtimer.c:2339 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1391 [inline] __se_sys_clock_nanosleep+0x35b/0x3b0 kernel/time/posix-timers.c:1368 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb2cc15d60e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007fb2cc53fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000555594831500 RCX: 00007fb2cc15d60e RDX: 00007fb2cc53fb80 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fb2cc417da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000002fa01 R13: 00007fb2cc415fac R14: 000000000002ee7a R15: 00007fb2cc415fa0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:pick_next_entity+0xca8/0xe90 kernel/sched/fair.c:5757 Code: 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 bd ea 97 00 4c 3b 33 79 05 48 8b 6c 24 40 48 8d 5d 59 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 75 61 80 3b 00 74 14 48 8b 7c 24 70 48 89 ee RSP: 0018:ffffc9000594f1d0 EFLAGS: 00010002 RAX: 000000000000000b RBX: 0000000000000059 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff8880b863af00 RDI: ffff8880b863af50 RBP: 0000000000000000 R08: ffff88807c081ec7 R09: 1ffff1100f8103d8 R10: dffffc0000000000 R11: ffffed100f8103d9 R12: dffffc0000000000 R13: ffff8880b863af00 R14: 0000000000000000 R15: ffff8880b863af01 FS: 0000555594831500(0000) GS:ffff888125290000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001e80 CR3: 0000000075766000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 89 d8 mov %ebx,%eax 2: 48 c1 e8 03 shr $0x3,%rax 6: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) b: 74 08 je 0x15 d: 48 89 df mov %rbx,%rdi 10: e8 bd ea 97 00 call 0x97ead2 15: 4c 3b 33 cmp (%rbx),%r14 18: 79 05 jns 0x1f 1a: 48 8b 6c 24 40 mov 0x40(%rsp),%rbp 1f: 48 8d 5d 59 lea 0x59(%rbp),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 75 61 jne 0x94 33: 80 3b 00 cmpb $0x0,(%rbx) 36: 74 14 je 0x4c 38: 48 8b 7c 24 70 mov 0x70(%rsp),%rdi 3d: 48 89 ee mov %rbp,%rsi

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/05/06 20:35	upstream	74fe02ce122a	cbcd9ea0	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	general protection fault in pick_next_entity

Crashes (1):

Assets (help?)