[syzbot] [kernel?] KMSAN: uninit-value in pick_task_fair

[syzbot <syzbot+edaa9ae65c490cb55bf2@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    63804fed149a Linux 6.19-rc7
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17b10a44580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=9682a42d8ec8b05c
dashboard link: https://syzkaller.appspot.com/bug?extid=edaa9ae65c490cb55bf2
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/68dae8bb75e6/disk-63804fed.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1990ce72fe38/vmlinux-63804fed.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c2c358d127c9/bzImage-63804fed.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+edaa9ae65c490cb55bf2@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in pick_task_fair+0x29d/0x510 kernel/sched/fair.c:8890
 pick_task_fair+0x29d/0x510 kernel/sched/fair.c:8890
 pick_next_task_fair+0x120/0x2550 kernel/sched/fair.c:8918
 __pick_next_task+0x108/0x6e0 kernel/sched/core.c:5890
 pick_next_task kernel/sched/core.c:5983 [inline]
 __schedule+0xee5/0x8180 kernel/sched/core.c:6809
 __schedule_loop kernel/sched/core.c:6949 [inline]
 schedule+0x17c/0x3c0 kernel/sched/core.c:6964
 worker_thread+0x1b45/0x1de0 kernel/workqueue.c:3436
 kthread+0xd5a/0xf00 kernel/kthread.c:463
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Uninit was created at:
 slab_free_hook mm/slub.c:2466 [inline]
 slab_free mm/slub.c:6674 [inline]
 kfree+0x32b/0x1400 mm/slub.c:6882
 kobject_uevent_env+0x879/0x12a0 lib/kobject_uevent.c:639
 kobject_uevent+0x36/0x50 lib/kobject_uevent.c:656
 driver_register+0x60d/0x6a0 drivers/base/driver.c:257
 usb_register_driver+0x206/0x620 drivers/usb/core/driver.c:1078
 __usb_serial_register_drivers+0x319/0x16a0 drivers/usb/serial/usb-serial.c:1505
 usb_serial_module_init+0x33/0x40 drivers/usb/serial/aircable.c:156
 do_one_initcall+0x22b/0xad0 init/main.c:1378
 do_initcall_level+0x157/0x2e0 init/main.c:1440
 do_initcalls+0x176/0x310 init/main.c:1456
 do_basic_setup+0x1d/0x30 init/main.c:1475
 kernel_init_freeable+0x213/0x430 init/main.c:1688
 kernel_init+0x2f/0x5e0 init/main.c:1578
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 1 UID: 0 PID: 3516 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
Workqueue:  0x0 (events_unbound)
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup