KMSAN: uninit-value in new_skb

Status: closed as invalid on 2026/02/23 16:41
Subsystems: block
[Documentation on labels]
First crash: 200d, last: 200d

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in memcg_slab_post_alloc_hook mm/slub.c:2335 [inline]
BUG: KMSAN: uninit-value in slab_post_alloc_hook mm/slub.c:4964 [inline]
BUG: KMSAN: uninit-value in slab_alloc_node mm/slub.c:5263 [inline]
BUG: KMSAN: uninit-value in kmem_cache_alloc_node_noprof+0xb47/0x1780 mm/slub.c:5315
 memcg_slab_post_alloc_hook mm/slub.c:2335 [inline]
 slab_post_alloc_hook mm/slub.c:4964 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_node_noprof+0xb47/0x1780 mm/slub.c:5315
 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586
 __alloc_skb+0x805/0x1030 net/core/skbuff.c:690
 alloc_skb include/linux/skbuff.h:1383 [inline]
 new_skb+0x4a/0x550 drivers/block/aoe/aoecmd.c:66
 aoecmd_cfg_pkts drivers/block/aoe/aoecmd.c:430 [inline]
 aoecmd_cfg+0x2c2/0xb60 drivers/block/aoe/aoecmd.c:1374
 discover_timer+0x64/0x80 drivers/block/aoe/aoemain.c:25
 call_timer_fn+0x4c/0x4b0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2373 [inline]
 __run_timer_base+0x80f/0xd90 kernel/time/timer.c:2385
 run_timer_base kernel/time/timer.c:2394 [inline]
 run_timer_softirq+0x3a/0x70 kernel/time/timer.c:2404
 handle_softirqs+0x168/0x6e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x65/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x12/0x20 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
 smap_save mm/kmsan/instrumentation.c:93 [inline]
 get_shadow_origin_ptr mm/kmsan/instrumentation.c:35 [inline]
 __msan_metadata_ptr_for_load_4+0x14/0x40 mm/kmsan/instrumentation.c:93
 stack_trace_consume_entry+0x36/0x220 kernel/stacktrace.c:86
 arch_stack_walk+0x18e/0x280 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0xc2/0x100 kernel/stacktrace.c:122
 kmsan_save_stack_with_flags mm/kmsan/core.c:73 [inline]
 kmsan_internal_poison_memory+0x4a/0x90 mm/kmsan/core.c:57
 kmsan_slab_alloc+0xdc/0x160 mm/kmsan/hooks.c:66
 slab_post_alloc_hook mm/slub.c:4960 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_node_noprof+0x9de/0x1780 mm/slub.c:5315
 __alloc_skb+0x799/0x1030 net/core/skbuff.c:679
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:818 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:875 [inline]
 nsim_dev_trap_report_work+0x3f2/0x1440 drivers/net/netdevsim/dev.c:921
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xb03/0x1da0 kernel/workqueue.c:3340
 worker_thread+0xede/0x1590 kernel/workqueue.c:3421
 kthread+0xd5a/0xf00 kernel/kthread.c:463
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Uninit was created at:
 slab_free_hook mm/slub.c:2466 [inline]
 slab_free mm/slub.c:6670 [inline]
 kmem_cache_free+0x2c5/0x13a0 mm/slub.c:6781
 acpi_os_release_object+0x2b/0x50 drivers/acpi/osl.c:1644
 acpi_ps_free_op+0x1a6/0x2a0 drivers/acpi/acpica/psutils.c:-1
 acpi_ps_delete_parse_tree+0x762/0x910 drivers/acpi/acpica/pswalk.c:88
 acpi_ps_complete_this_op+0xc0c/0xf20 drivers/acpi/acpica/psparse.c:277
 acpi_ps_complete_op+0x3cb/0x1220 drivers/acpi/acpica/psobject.c:486
 acpi_ps_parse_loop+0x1d43/0x36a0 drivers/acpi/acpica/psloop.c:552
 acpi_ps_parse_aml+0x58f/0x20b0 drivers/acpi/acpica/psparse.c:475
 acpi_ps_execute_table+0x7d0/0x870 drivers/acpi/acpica/psxface.c:295
 acpi_ns_execute_table+0xae2/0xd30 drivers/acpi/acpica/nsparse.c:116
 acpi_ns_parse_table+0x179/0x1e0 drivers/acpi/acpica/nsparse.c:268
 acpi_ns_load_table+0x287/0x610 drivers/acpi/acpica/nsload.c:71
 acpi_tb_load_namespace+0x885/0xd90 drivers/acpi/acpica/tbxfload.c:186
 acpi_load_tables+0xb4/0x230 drivers/acpi/acpica/tbxfload.c:59
 acpi_bus_init+0x34/0xd40 drivers/acpi/bus.c:1343
 acpi_init+0x123/0x290 drivers/acpi/bus.c:1456
 do_one_initcall+0x22b/0xad0 init/main.c:1378
 do_initcall_level+0x157/0x2e0 init/main.c:1440
 do_initcalls+0x176/0x310 init/main.c:1456
 do_basic_setup+0x1d/0x30 init/main.c:1475
 kernel_init_freeable+0x213/0x430 init/main.c:1688
 kernel_init+0x2f/0x5e0 init/main.c:1578
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/20 18:00 upstream 24d479d26b25 572effc1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in new_skb
* Struck through repros no longer work on HEAD.