[syzbot] [kernel?] KMSAN: uninit-value in futex_hash

[syzbot <syzbot+37668eee60869ca40d13@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    cee73b1e840c Merge tag 'riscv-for-linus-7.0-mw1' of git://..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1638be5a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=50148b563a4d5941
dashboard link: https://syzkaller.appspot.com/bug?extid=37668eee60869ca40d13
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/baba834beb3d/disk-cee73b1e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d7073a8426d0/vmlinux-cee73b1e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/38609bc4ef50/bzImage-cee73b1e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+37668eee60869ca40d13@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in futex_hash+0x5d2/0x630 kernel/futex/core.c:312
 futex_hash+0x5d2/0x630 kernel/futex/core.c:312
 class_hb_constructor kernel/futex/futex.h:240 [inline]
 futex_wake+0x1b9/0x920 kernel/futex/waitwake.c:172
 do_futex+0x419/0x480 kernel/futex/syscalls.c:135
 __do_sys_futex_time32 kernel/futex/syscalls.c:515 [inline]
 __se_sys_futex_time32+0x557/0x6c0 kernel/futex/syscalls.c:498
 __ia32_sys_futex_time32+0x112/0x1a0 kernel/futex/syscalls.c:498
 ia32_sys_call+0x11ea/0x4360 arch/x86/include/generated/asm/syscalls_32.h:241
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x17f/0x3f0 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 __alloc_frozen_pages_noprof+0x6df/0xf50 mm/page_alloc.c:5267
 __alloc_pages_noprof mm/page_alloc.c:5278 [inline]
 __alloc_pages_node_noprof include/linux/gfp.h:285 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:312 [inline]
 alloc_pages_exact_nid_noprof+0xd3/0x6c0 mm/page_alloc.c:5462
 futex_init+0x191/0x550 kernel/futex/core.c:1996
 do_one_initcall+0x22e/0xad0 init/main.c:1382
 do_initcall_level+0x157/0x2e0 init/main.c:1444
 do_initcalls+0x176/0x310 init/main.c:1460
 do_basic_setup+0x1d/0x30 init/main.c:1479
 kernel_init_freeable+0x213/0x460 init/main.c:1692
 kernel_init+0x2f/0x5e0 init/main.c:1582
 ret_from_fork+0x20f/0x910 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

CPU: 1 UID: 0 PID: 22760 Comm: syz.3.5416 Tainted: G      D W    L      syzkaller #0 PREEMPT(full) 
Tainted: [D]=DIE, [W]=WARN, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup