[syzbot] [bpf?] KMSAN: uninit-value in __arg_track_join

[syzbot] [bpf?] KMSAN: uninit-value in __arg_track_join

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    d60ec36cab33 Merge tag 'mm-hotfixes-stable-2026-05-25-16-2..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=116ac6ec580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=334b75e012487335
dashboard link: https://syzkaller.appspot.com/bug?extid=0098eed2cc898cdd672f
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7e228ea8db12/disk-d60ec36c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/83407360a5fe/vmlinux-d60ec36c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9e10d0866b6f/bzImage-d60ec36c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0098eed2cc898cdd672f@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in __arg_track_join+0x15a/0x810 kernel/bpf/liveness.c:743
 __arg_track_join+0x15a/0x810 kernel/bpf/liveness.c:743
 arg_track_join+0x186/0x870 kernel/bpf/liveness.c:784
 compute_subprog_args kernel/bpf/liveness.c:1623 [inline]
 analyze_subprog+0x3eb0/0xff30 kernel/bpf/liveness.c:1799
 bpf_compute_subprog_arg_access+0x3ee/0x2370 kernel/bpf/liveness.c:1937
 bpf_compute_live_registers+0xfdb/0x3090 kernel/bpf/liveness.c:2149
 bpf_check+0x5bcb/0x9360 kernel/bpf/verifier.c:20065
 bpf_prog_load+0x28d2/0x2d00 kernel/bpf/syscall.c:3082
 __sys_bpf+0x8e0/0xee0 kernel/bpf/syscall.c:6274
 __do_sys_bpf kernel/bpf/syscall.c:6387 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6385 [inline]
 __ia32_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6385
 ia32_sys_call+0x33e7/0x4360 arch/x86/include/generated/asm/syscalls_32.h:358
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x195/0x470 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Local variable old created at:
 arg_track_join+0x86/0x870 kernel/bpf/liveness.c:783
 compute_subprog_args kernel/bpf/liveness.c:1623 [inline]
 analyze_subprog+0x3eb0/0xff30 kernel/bpf/liveness.c:1799

CPU: 0 UID: 0 PID: 18676 Comm: syz.0.5880 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [bpf?] KMSAN: uninit-value in __arg_track_join

[syzbot]

> #syz test: https://github.com/Tejas-MD/linux.git fix-branch

This crash does not have a reproducer. I cannot test it.

> On Saturday, May 30, 2026 at 1:32:23 AM UTC+5:30 syzbot wrote:
>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: d60ec36cab33 Merge tag 'mm-hotfixes-stable-2026-05-25-16-2..
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=116ac6ec580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=334b75e012487335
>> dashboard link: 
>> https://syzkaller.appspot.com/bug?extid=0098eed2cc898cdd672f
>> compiler: Debian clang version 21.1.8 
>> (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
>> userspace arch: i386
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
>> Downloadable assets:
>> disk image: 
>> https://storage.googleapis.com/syzbot-assets/7e228ea8db12/disk-d60ec36c.raw.xz
>> vmlinux: 
>> https://storage.googleapis.com/syzbot-assets/83407360a5fe/vmlinux-d60ec36c.xz
>> kernel image: 
>> https://storage.googleapis.com/syzbot-assets/9e10d0866b6f/bzImage-d60ec36c.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the 
>> commit:
>> Reported-by: syzbot+0098ee...@syzkaller.appspotmail.com
>>
>> =====================================================
>> BUG: KMSAN: uninit-value in __arg_track_join+0x15a/0x810 
>> kernel/bpf/liveness.c:743
>> __arg_track_join+0x15a/0x810 kernel/bpf/liveness.c:743
>> arg_track_join+0x186/0x870 kernel/bpf/liveness.c:784
>> compute_subprog_args kernel/bpf/liveness.c:1623 [inline]
>> analyze_subprog+0x3eb0/0xff30 kernel/bpf/liveness.c:1799
>> bpf_compute_subprog_arg_access+0x3ee/0x2370 kernel/bpf/liveness.c:1937
>> bpf_compute_live_registers+0xfdb/0x3090 kernel/bpf/liveness.c:2149
>> bpf_check+0x5bcb/0x9360 kernel/bpf/verifier.c:20065
>> bpf_prog_load+0x28d2/0x2d00 kernel/bpf/syscall.c:3082
>> __sys_bpf+0x8e0/0xee0 kernel/bpf/syscall.c:6274
>> __do_sys_bpf kernel/bpf/syscall.c:6387 [inline]
>> __se_sys_bpf kernel/bpf/syscall.c:6385 [inline]
>> __ia32_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6385
>> ia32_sys_call+0x33e7/0x4360 
>> arch/x86/include/generated/asm/syscalls_32.h:358
>> do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
>> __do_fast_syscall_32+0x195/0x470 arch/x86/entry/syscall_32.c:307
>> do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332
>> do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
>> entry_SYSENTER_compat_after_hwframe+0x84/0x8e
>>
>> Local variable old created at:
>> arg_track_join+0x86/0x870 kernel/bpf/liveness.c:783
>> compute_subprog_args kernel/bpf/liveness.c:1623 [inline]
>> analyze_subprog+0x3eb0/0xff30 kernel/bpf/liveness.c:1799
>>
>> CPU: 0 UID: 0 PID: 18676 Comm: syz.0.5880 Tainted: G W syzkaller #0 
>> PREEMPT(lazy) 
>> Tainted: [W]=WARN
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS 
>> Google 04/18/2026
>> =====================================================
>>
>>
>> ---
>> This report is generated by a bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for more information about syzbot.
>> syzbot engineers can be reached at syzk...@googlegroups.com.
>>
>> syzbot will keep track of this issue. See:
>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>>
>> If the report is already addressed, let syzbot know by replying with:
>> #syz fix: exact-commit-title
>>
>> If you want to overwrite report's subsystems, reply with:
>> #syz set subsystems: new-subsystem
>> (See the list of subsystem names on the web dashboard)
>>
>> If the report is a duplicate of another one, reply with:
>> #syz dup: exact-subject-of-another-report
>>
>> If you want to undo deduplication, reply with:
>> #syz undup
>>
>
> -- 
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/6485c75e-8ce6-4de5-aed7-7ada081bbc1en%40googlegroups.com.