From: syzbot <syzbot+4b1bd55fba6260160779@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
wangqing7171@gmail.com
Subject: Re: [syzbot] [kernel?] KMSAN: uninit-value in __flush_smp_call_function_queue
Date: Tue, 10 Mar 2026 00:17:02 -0700 [thread overview]
Message-ID: <69afc56e.a00a0220.d013.0003.GAE@google.com> (raw)
In-Reply-To: <20260310064845.3659772-1-wangqing7171@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __flush_smp_call_function_queue
=====================================================
BUG: KMSAN: uninit-value in __flush_smp_call_function_queue+0x362/0x18e0 kernel/smp.c:535
__flush_smp_call_function_queue+0x362/0x18e0 kernel/smp.c:535
generic_smp_call_function_single_interrupt+0x1c/0x30 kernel/smp.c:463
__sysvec_call_function_single+0x4b/0x3e0 arch/x86/kernel/smp.c:271
instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
sysvec_call_function_single+0x7c/0x90 arch/x86/kernel/smp.c:266
asm_sysvec_call_function_single+0x1f/0x30 arch/x86/include/asm/idtentry.h:704
native_irq_enable arch/x86/include/asm/irqflags.h:42 [inline]
arch_local_irq_enable arch/x86/include/asm/irqflags.h:119 [inline]
raw_spin_rq_unlock_irq kernel/sched/sched.h:1629 [inline]
finish_lock_switch kernel/sched/core.c:5032 [inline]
finish_task_switch+0x11b/0x8b0 kernel/sched/core.c:5150
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x2607/0x8640 kernel/sched/core.c:6908
preempt_schedule_common+0x33/0x80 kernel/sched/core.c:7092
preempt_schedule+0x30/0x40 kernel/sched/core.c:7116
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
_raw_spin_unlock_irqrestore+0x57/0x60 kernel/locking/spinlock.c:194
unlock_hrtimer_base kernel/time/hrtimer.c:1021 [inline]
hrtimer_try_to_cancel+0x8b0/0xae0 kernel/time/hrtimer.c:1368
hrtimer_cancel+0x33/0xf0 kernel/time/hrtimer.c:1489
schedule_hrtimeout_range_clock+0x16d/0x2f0 kernel/time/sleep_timeout.c:218
schedule_hrtimeout_range+0x42/0x50 kernel/time/sleep_timeout.c:263
poll_schedule_timeout fs/select.c:241 [inline]
do_select+0x282b/0x2aa0 fs/select.c:603
core_sys_select+0xa5a/0x10e0 fs/select.c:677
do_pselect fs/select.c:759 [inline]
__do_sys_pselect6 fs/select.c:798 [inline]
__se_sys_pselect6+0x554/0x6b0 fs/select.c:789
__x64_sys_pselect6+0x114/0x1a0 fs/select.c:789
x64_sys_call+0xa5d/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:271
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable mmap_event created at:
perf_event_mmap+0x47/0x2fe0 kernel/events/core.c:9894
__mmap_complete mm/vma.c:2585 [inline]
__mmap_region mm/vma.c:2768 [inline]
mmap_region+0x4a79/0x6220 mm/vma.c:2837
CPU: 1 UID: 0 PID: 6279 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
=====================================================
Tested on:
commit: 1f318b96 Linux 7.0-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14d4694a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=242f02fcd3fbc8f3
dashboard link: https://syzkaller.appspot.com/bug?extid=4b1bd55fba6260160779
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1227175a580000
prev parent reply other threads:[~2026-03-10 7:17 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-15 8:48 [syzbot] [kernel?] KMSAN: uninit-value in __flush_smp_call_function_queue syzbot
2026-02-15 19:05 ` syzbot
2026-03-10 6:48 ` Qing Wang
2026-03-10 7:17 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69afc56e.a00a0220.d013.0003.GAE@google.com \
--to=syzbot+4b1bd55fba6260160779@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=wangqing7171@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox