[syzbot] [cgroups?] [mm?] KMSAN: uninit-value in __sigqueue_free

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ccd1cdca5cd4 Merge tag 'nfsd-6.19-1' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=100e9758580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b3903bdf68407a14
dashboard link: https://syzkaller.appspot.com/bug?extid=6e04171f00f33c0d62fb
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a243709d75f9/disk-ccd1cdca.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8eb4fcf14c57/vmlinux-ccd1cdca.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5bb3fe154e48/bzImage-ccd1cdca.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e0417...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in __memcg_slab_free_hook+0x466/0x5a0 mm/memcontrol.c:3235
__memcg_slab_free_hook+0x466/0x5a0 mm/memcontrol.c:3235
memcg_slab_free_hook mm/slub.c:2364 [inline]
slab_free mm/slub.c:6667 [inline]
kmem_cache_free+0x812/0x13c0 mm/slub.c:6781
__sigqueue_free+0x23a/0x270 kernel/signal.c:475
flush_sigqueue+0x1c5/0x3f0 kernel/signal.c:486
release_task+0x1f33/0x29a0 kernel/exit.c:305
wait_task_zombie kernel/exit.c:1274 [inline]
wait_consider_task+0x28e0/0x3e00 kernel/exit.c:1501
do_wait_thread kernel/exit.c:1564 [inline]
__do_wait+0x206/0xdd0 kernel/exit.c:1682
do_wait+0x10e/0x470 kernel/exit.c:1716
kernel_wait4+0x2b5/0x480 kernel/exit.c:1875
__do_sys_wait4 kernel/exit.c:1903 [inline]
__se_sys_wait4 kernel/exit.c:1899 [inline]
__x64_sys_wait4+0x148/0x340 kernel/exit.c:1899
x64_sys_call+0x31d7/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:62
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
__alloc_frozen_pages_noprof+0x421/0xab0 mm/page_alloc.c:5233
alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
alloc_frozen_pages_noprof+0xf7/0x200 mm/mempolicy.c:2557
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab+0x1ea/0x1710 mm/slub.c:3248
new_slab mm/slub.c:3302 [inline]
___slab_alloc+0x10bf/0x3930 mm/slub.c:4656
__slab_alloc+0xa3/0x180 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
__do_kmalloc_node mm/slub.c:5656 [inline]
__kmalloc_noprof+0xbd5/0x1c20 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
neigh_alloc net/core/neighbour.c:522 [inline]
___neigh_create+0xd55/0x3b90 net/core/neighbour.c:656
__neigh_create+0xa6/0xd0 net/core/neighbour.c:744
ip6_finish_output2+0x160e/0x2d30 net/ipv6/ip6_output.c:128
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x903/0x10d0 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x331/0x600 net/ipv6/ip6_output.c:247
dst_output include/net/dst.h:464 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
mld_sendpack+0xb4a/0x1770 net/ipv6/mcast.c:1855
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x1328/0x19b0 net/ipv6/mcast.c:2693
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xb91/0x1d80 kernel/workqueue.c:3340
worker_thread+0xedf/0x1590 kernel/workqueue.c:3421
kthread+0xd5c/0xf00 kernel/kthread.c:463
ret_from_fork+0x208/0x710 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 0 UID: 0 PID: 1 Comm: init Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup