[syzbot] [kernel?] KMSAN: uninit-value in pick_task_fair

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 63804fed149a Linux 6.19-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17b10a44580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9682a42d8ec8b05c
dashboard link: https://syzkaller.appspot.com/bug?extid=edaa9ae65c490cb55bf2
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/68dae8bb75e6/disk-63804fed.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1990ce72fe38/vmlinux-63804fed.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c2c358d127c9/bzImage-63804fed.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+edaa9a...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in pick_task_fair+0x29d/0x510 kernel/sched/fair.c:8890
pick_task_fair+0x29d/0x510 kernel/sched/fair.c:8890
pick_next_task_fair+0x120/0x2550 kernel/sched/fair.c:8918
__pick_next_task+0x108/0x6e0 kernel/sched/core.c:5890
pick_next_task kernel/sched/core.c:5983 [inline]
__schedule+0xee5/0x8180 kernel/sched/core.c:6809
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0x17c/0x3c0 kernel/sched/core.c:6964
worker_thread+0x1b45/0x1de0 kernel/workqueue.c:3436
kthread+0xd5a/0xf00 kernel/kthread.c:463
ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Uninit was created at:
slab_free_hook mm/slub.c:2466 [inline]
slab_free mm/slub.c:6674 [inline]
kfree+0x32b/0x1400 mm/slub.c:6882
kobject_uevent_env+0x879/0x12a0 lib/kobject_uevent.c:639
kobject_uevent+0x36/0x50 lib/kobject_uevent.c:656
driver_register+0x60d/0x6a0 drivers/base/driver.c:257
usb_register_driver+0x206/0x620 drivers/usb/core/driver.c:1078
__usb_serial_register_drivers+0x319/0x16a0 drivers/usb/serial/usb-serial.c:1505
usb_serial_module_init+0x33/0x40 drivers/usb/serial/aircable.c:156
do_one_initcall+0x22b/0xad0 init/main.c:1378
do_initcall_level+0x157/0x2e0 init/main.c:1440
do_initcalls+0x176/0x310 init/main.c:1456
do_basic_setup+0x1d/0x30 init/main.c:1475
kernel_init_freeable+0x213/0x430 init/main.c:1688
kernel_init+0x2f/0x5e0 init/main.c:1578
ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 1 UID: 0 PID: 3516 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
Workqueue: 0x0 (events_unbound)
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup