From: Thomas Gleixner <tglx@linutronix.de>
To: syzbot <syzbot+28bdcfc1dab2ffa279a5@syzkaller.appspotmail.com>,
bp@alien8.de, dave.hansen@linux.intel.com, davem@davemloft.net,
dsahern@kernel.org, edumazet@google.com, horms@kernel.org,
hpa@zytor.com, kuba@kernel.org, linux-kernel@vger.kernel.org,
mingo@redhat.com, netdev@vger.kernel.org, pabeni@redhat.com,
syzkaller-bugs@googlegroups.com, x86@kernel.org
Subject: Re: [syzbot] [net?] KMSAN: uninit-value in __schedule (5)
Date: Tue, 10 Feb 2026 20:05:06 +0100 [thread overview]
Message-ID: <87ldh0a07x.ffs@tglx> (raw)
In-Reply-To: <698a28f5.a00a0220.34fa92.004a.GAE@google.com>
On Mon, Feb 09 2026 at 10:35, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 05f7e89ab973 Linux 6.19
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17daf65a580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=df890e720d1bb80
> dashboard link: https://syzkaller.appspot.com/bug?extid=28bdcfc1dab2ffa279a5
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1029533a580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ea9f39c5175d/disk-05f7e89a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/734edeebfa32/vmlinux-05f7e89a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/a2cb36d849f0/bzImage-05f7e89a.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+28bdcfc1dab2ffa279a5@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> BUG: KASAN: slab-use-after-free in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
> BUG: KASAN: slab-use-after-free in membarrier_switch_mm kernel/sched/sched.h:3666 [inline]
> BUG: KASAN: slab-use-after-free in context_switch kernel/sched/core.c:5230 [inline]
> BUG: KASAN: slab-use-after-free in __schedule+0xc56/0x5fa0 kernel/sched/core.c:6867
> Read of size 4 at addr ffff88801db4e2c0 by task kworker/u8:1/13
That's most likely the same issue as with the futex report. Caused by a
double mmdrop() in do_procmap_query(). The reproducer fiddles with
that...
See https://lore.kernel.org/all/20260129215340.3742283-1-andrii@kernel.org/T/#m5250c5bf0612d19c7991b6454f309e41776982be
Thanks,
tglx
next prev parent reply other threads:[~2026-02-10 19:05 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <00000000000086d83c0615ba6f9a@google.com>
2026-02-09 18:35 ` [syzbot] [net?] KMSAN: uninit-value in __schedule (5) syzbot
2026-02-10 19:05 ` Thomas Gleixner [this message]
2026-02-09 21:19 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ldh0a07x.ffs@tglx \
--to=tglx@linutronix.de \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=hpa@zytor.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+28bdcfc1dab2ffa279a5@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox