Re: [PATCH] sched/psi: initialize *flags in psi_memstall_enter when PSI is disabled
From: Mashiro Chen
Date: Wed Apr 08 2026 - 12:15:48 EST
Hi Johannes,
Good question. You're right that KMSAN's stack tracking persisting
across page reuse boundaries is arguably a tool limitation. That said,
I think fixing it on the PSI side is still reasonable:
psi_memstall_enter() takes a pointer parameter with an implicit contract:
if the caller passes &flags, they expect *flags to be initialized upon
return. The current early-return silently violates that contract by
leaving *flags uninitialized, even though the value is never actually used
functionally.
The fix is essentially free (we're already in the early-return path) and
makes the contract explicit. You're right that the original patch lacked
a comment explaining this, I should have added:
/* Initialize to 0 even in psi_disabled case to honor the
* implicit API contract that *flags is initialized on return.
* psi_memstall_leave() also returns early when psi_disabled
* and does not read *flags, so this is zero-cost. */
*flags = 0;
return;
That said, if you prefer this stays in KMSAN (e.g., treating stack
variables as out-of-scope once their frame returns), I'm happy to drop
the patch and redirect the effort there instead.
Thanks for the thoughtful review feedback.
Best,
Mashiro Chen
On 4/8/26 23:10, Johannes Weiner wrote:
On Sun, Apr 05, 2026 at 01:50:44PM +0800, Mashiro Chen wrote:
When PSI is disabled, psi_memstall_enter() returns early withoutHow is this not a kmsan bug?
writing to *flags, leaving the caller's local variable uninitialized.
psi_memstall_leave() also returns early when PSI is disabled and does
not read *flags, so the uninitialized value is never used functionally.
However, KMSAN tracks the shadow and origin metadata per physical
address. When a kernel stack page is subsequently reused, a new object
at the same address inherits the stale KMSAN shadow from the old
uninitialized pflags, causing spurious uninit-value reports in
unrelated code paths such as __flush_smp_call_function_queue().
Initialize *flags to 0 in the psi_disabled early-return path to
prevent the stale shadow from escaping the callers' stack frames.
I don't think putting an unexpected init into unrelated code with no
comment is an appropriate fix for what seems like a false positive in
this tool.