[syzbot] [bpf?] KMSAN: uninit-value in __arg_track_join

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    d60ec36cab33 Merge tag 'mm-hotfixes-stable-2026-05-25-16-2..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=116ac6ec580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=334b75e012487335
dashboard link: https://syzkaller.appspot.com/bug?extid=0098eed2cc898cdd672f
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7e228ea8db12/disk-d60ec36c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/83407360a5fe/vmlinux-d60ec36c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9e10d0866b6f/bzImage-d60ec36c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0098eed2cc898cdd672f@xxxxxxxxxxxxxxxxxxxxxxxxx

=====================================================
BUG: KMSAN: uninit-value in __arg_track_join+0x15a/0x810 kernel/bpf/liveness.c:743
 __arg_track_join+0x15a/0x810 kernel/bpf/liveness.c:743
 arg_track_join+0x186/0x870 kernel/bpf/liveness.c:784
 compute_subprog_args kernel/bpf/liveness.c:1623 [inline]
 analyze_subprog+0x3eb0/0xff30 kernel/bpf/liveness.c:1799
 bpf_compute_subprog_arg_access+0x3ee/0x2370 kernel/bpf/liveness.c:1937
 bpf_compute_live_registers+0xfdb/0x3090 kernel/bpf/liveness.c:2149
 bpf_check+0x5bcb/0x9360 kernel/bpf/verifier.c:20065
 bpf_prog_load+0x28d2/0x2d00 kernel/bpf/syscall.c:3082
 __sys_bpf+0x8e0/0xee0 kernel/bpf/syscall.c:6274
 __do_sys_bpf kernel/bpf/syscall.c:6387 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6385 [inline]
 __ia32_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6385
 ia32_sys_call+0x33e7/0x4360 arch/x86/include/generated/asm/syscalls_32.h:358
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x195/0x470 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Local variable old created at:
 arg_track_join+0x86/0x870 kernel/bpf/liveness.c:783
 compute_subprog_args kernel/bpf/liveness.c:1623 [inline]
 analyze_subprog+0x3eb0/0xff30 kernel/bpf/liveness.c:1799

CPU: 0 UID: 0 PID: 18676 Comm: syz.0.5880 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup