syzbot


KMSAN: uninit-value in task_tick_fair

Status: upstream: reported on 2026/01/28 10:40
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+f840ef7a3be3a331093f@syzkaller.appspotmail.com
First crash: 8d00h, last: 8d00h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernel?] KMSAN: uninit-value in task_tick_fair 0 (1) 2026/01/28 10:40

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in entity_tick kernel/sched/fair.c:5526 [inline]
BUG: KMSAN: uninit-value in task_tick_fair+0x46e/0xbe0 kernel/sched/fair.c:13374
 entity_tick kernel/sched/fair.c:5526 [inline]
 task_tick_fair+0x46e/0xbe0 kernel/sched/fair.c:13374
 sched_tick+0x270/0xdf0 kernel/sched/core.c:5535
 update_process_times+0x27e/0x2d0 kernel/time/timer.c:2479
 tick_sched_handle kernel/time/tick-sched.c:298 [inline]
 tick_nohz_handler+0x5a0/0x7f0 kernel/time/tick-sched.c:319
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x559/0xd70 kernel/time/hrtimer.c:1841
 hrtimer_interrupt+0x456/0xb70 kernel/time/hrtimer.c:1903
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0xaa/0x420 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x7f/0x90 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
 memmove+0x28/0x1b0 arch/x86/lib/memmove_64.S:45

Uninit was created at:
 __alloc_frozen_pages_noprof+0x41c/0xaa0 mm/page_alloc.c:5263
 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof+0xf6/0x200 mm/mempolicy.c:2557
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab+0x1ea/0x1700 mm/slub.c:3248
 new_slab mm/slub.c:3302 [inline]
 ___slab_alloc+0x1048/0x38c0 mm/slub.c:4656
 __slab_alloc+0xa3/0x180 mm/slub.c:4779
 __slab_alloc_node mm/slub.c:4855 [inline]
 slab_alloc_node mm/slub.c:5251 [inline]
 __kmalloc_cache_noprof+0x9e0/0x1710 mm/slub.c:5775
 kmalloc_noprof include/linux/slab.h:957 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 device_private_init drivers/base/core.c:3534 [inline]
 device_add+0x101/0x1c10 drivers/base/core.c:3585
 usb_add_gadget+0x72e/0xe70 drivers/usb/gadget/udc/core.c:1434
 usb_add_gadget_udc_release drivers/usb/gadget/udc/core.c:1484 [inline]
 usb_add_gadget_udc+0x11f/0x1a0 drivers/usb/gadget/udc/core.c:1531
 dummy_udc_probe+0xbe6/0x10f0 drivers/usb/gadget/udc/dummy_hcd.c:1099
 platform_probe+0x213/0x370 drivers/base/platform.c:1446
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d4/0xdc0 drivers/base/dd.c:659
 __driver_probe_device+0x25e/0x370 drivers/base/dd.c:801
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:831
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:959
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1031
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1086
 bus_probe_device+0x287/0x550 drivers/base/bus.c:574
 device_add+0x12a9/0x1c10 drivers/base/core.c:3689
 platform_device_add+0x7ee/0xab0 drivers/base/platform.c:757
 dummy_hcd_init+0xb2f/0x11b0 drivers/usb/gadget/udc/dummy_hcd.c:2866
 do_one_initcall+0x22b/0xad0 init/main.c:1378
 do_initcall_level+0x157/0x2e0 init/main.c:1440
 do_initcalls+0x176/0x310 init/main.c:1456
 do_basic_setup+0x1d/0x30 init/main.c:1475
 kernel_init_freeable+0x213/0x430 init/main.c:1688
 kernel_init+0x2f/0x5e0 init/main.c:1578
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 0 UID: 0 PID: 7329 Comm: syz.7.249 Tainted: G             L      syzkaller #0 PREEMPT(voluntary) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/24 10:33 upstream c133687c2eae 4f25b9b4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in task_tick_fair
* Struck through repros no longer work on HEAD.