syzbot


KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user (2)

Status: upstream: reported C repro on 2023/10/21 18:49
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+cfc08744435c4cf94a40@syzkaller.appspotmail.com
First crash: 642d, last: 12m
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] [kernel?] KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user (2) 1 (5) 2024/03/24 09:13
[PATCH] ptrace: fix kernel-infoleak-after-free in copy_siginfo_to_user 1 (1) 2023/12/31 02:41
Re: [syzbot] [kernel?] KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user (2) 1 (1) 2023/12/25 07:16
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user kernel 18 6 1066d 1110d 0/29 auto-obsoleted due to no activity on 2022/11/12 22:39
upstream KMSAN: kernel-infoleak in copy_siginfo_to_user (2) kernel 9 C 15 2227d 2257d 12/29 fixed on 2019/07/10 21:40
upstream KMSAN: kernel-infoleak in copy_siginfo_to_user kernel 9 C 779 2269d 2563d 0/29 closed as invalid on 2019/05/03 14:05
Last patch testing requests (11)
Created Duration User Patch Repo Result
2025/01/15 22:04 24m retest repro upstream report log
2025/01/15 22:04 29m retest repro upstream OK log
2025/01/15 22:04 25m retest repro upstream report log
2025/01/15 22:04 20m retest repro upstream report log
2025/01/15 22:04 28m retest repro upstream OK log
2024/07/05 06:13 22m retest repro upstream error
2024/07/05 06:13 22m retest repro upstream error
2024/07/05 06:13 22m retest repro upstream error
2024/07/05 06:13 22m retest repro upstream error
2024/07/05 06:13 22m retest repro upstream error
2023/12/31 01:51 22m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 861deac3b092 OK log

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _copy_to_user+0xbc/0x110 lib/usercopy.c:40
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 _copy_to_user+0xbc/0x110 lib/usercopy.c:40
 copy_to_user include/linux/uaccess.h:191 [inline]
 copy_siginfo_to_user+0x40/0x130 kernel/signal.c:3380
 ptrace_request+0xfa7/0x36e0 kernel/ptrace.c:1046
 arch_ptrace+0x43b/0x680 arch/x86/kernel/ptrace.c:848
 __do_sys_ptrace kernel/ptrace.c:1285 [inline]
 __se_sys_ptrace+0x2d8/0x760 kernel/ptrace.c:1258
 __x64_sys_ptrace+0xbd/0x110 kernel/ptrace.c:1258
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was stored to memory at:
 copy_siginfo include/linux/signal.h:18 [inline]
 ptrace_getsiginfo kernel/ptrace.c:685 [inline]
 ptrace_request+0xf33/0x36e0 kernel/ptrace.c:1044
 arch_ptrace+0x43b/0x680 arch/x86/kernel/ptrace.c:848
 __do_sys_ptrace kernel/ptrace.c:1285 [inline]
 __se_sys_ptrace+0x2d8/0x760 kernel/ptrace.c:1258
 __x64_sys_ptrace+0xbd/0x110 kernel/ptrace.c:1258
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was stored to memory at:
 copy_siginfo include/linux/signal.h:18 [inline]
 collect_signal kernel/signal.c:587 [inline]
 __dequeue_signal+0x501/0xad0 kernel/signal.c:616
 dequeue_signal+0x14b/0xb20 kernel/signal.c:639
 get_signal+0xb46/0x2d00 kernel/signal.c:2790
 arch_do_signal_or_restart+0x53/0xcb0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x5d/0x160 kernel/entry/common.c:218
 do_syscall_64+0xe4/0x1f0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was created at:
 slab_free_hook mm/slub.c:2073 [inline]
 slab_free mm/slub.c:4280 [inline]
 kmem_cache_free+0x257/0xa80 mm/slub.c:4344
 __sigqueue_free kernel/signal.c:451 [inline]
 collect_signal kernel/signal.c:594 [inline]
 __dequeue_signal+0xa58/0xad0 kernel/signal.c:616
 dequeue_signal+0x14b/0xb20 kernel/signal.c:639
 get_signal+0xb46/0x2d00 kernel/signal.c:2790
 arch_do_signal_or_restart+0x53/0xcb0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x5d/0x160 kernel/entry/common.c:218
 do_syscall_64+0xe4/0x1f0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Bytes 12-15 of 48 are uninitialized
Memory access of size 48 starts at ffff8881240cfc60
Data copied to user address 0000000014dcf540

CPU: 1 PID: 5012 Comm: strace-static-x Not tainted 6.8.0-syzkaller-13213-g70293240c5ce #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================

Crashes (3374):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/24 09:12 upstream 70293240c5ce 0ea90952 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/10/19 11:47 upstream 3d5ad2d4eca3 cd6fc0a3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/25 18:06 upstream e88c4cfcb7b8 8bdc0f22 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/16 20:25 upstream 66a27abac311 d615901c .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/12 04:02 upstream 8ede842f669b 6ee49f2e .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/11 15:10 upstream e8f897f4afef 6ee49f2e .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/02/25 06:07 upstream f2e367d6ad3b 8d446f15 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/22 18:22 upstream 9f8413c4a66f 9bd8dcda .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/16 01:26 upstream 9f8413c4a66f 2a7bcc7f .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/11 20:22 upstream 9f8413c4a66f 00f3cc59 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/10 11:25 upstream 9f8413c4a66f b438bd66 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/08 05:03 upstream 0dd3ee311255 d0304e9c .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/05 18:06 upstream 1f874787ed9a 28c42cff .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/03 14:13 upstream 610a9b8f49fb fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/03 00:51 upstream 610a9b8f49fb fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/02 16:13 upstream 610a9b8f49fb fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/28 00:59 upstream fbafc3e621c3 fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/27 16:54 upstream fbafc3e621c3 fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/25 22:15 upstream 861deac3b092 fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/11 17:52 upstream e8f897f4afef 6ee49f2e .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/30 11:52 upstream 9f8413c4a66f 991a98f4 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/16 12:55 upstream 155a3c003e55 c118d736 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/16 11:01 upstream 155a3c003e55 c118d736 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/16 05:45 upstream 155a3c003e55 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/15 23:58 upstream 155a3c003e55 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/15 09:53 upstream 155a3c003e55 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/14 20:28 upstream 347e9f5043c8 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/14 02:37 upstream 5d5d62298b8b 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/13 13:05 upstream 3f31a806a62e 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/12 23:59 upstream 379f604cc3dc 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/11 09:56 upstream bc9ff192a6c9 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/11 00:16 upstream bc9ff192a6c9 19d4829f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/09 16:43 upstream 733923397fd9 f4e5e155 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/08 07:00 upstream d7b8f8e20813 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/08 03:41 upstream d7b8f8e20813 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/07 18:58 upstream d7b8f8e20813 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/07 14:52 upstream d7b8f8e20813 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/07 05:25 upstream d7b8f8e20813 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/06 19:40 upstream 1f988d0788f5 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/06 17:12 upstream 1f988d0788f5 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/06 08:10 upstream 05df91921da6 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/06 02:01 upstream 05df91921da6 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/05 21:55 upstream a79a588fc176 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/05 11:08 upstream a79a588fc176 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/04 07:29 upstream 17bbde2e1716 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/04 03:46 upstream 17bbde2e1716 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/03 21:44 upstream 17bbde2e1716 115ceea7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/03 20:25 upstream 17bbde2e1716 115ceea7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/03 07:24 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/03 06:18 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/03 01:39 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/02 23:35 upstream b4911fb0b060 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/02 14:48 upstream 66701750d556 0cd59a8f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/02 05:25 upstream 66701750d556 ffe4b334 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/02 03:19 upstream 66701750d556 ffe4b334 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/01 19:39 upstream 66701750d556 ffe4b334 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/01 15:50 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/01 13:20 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/01 07:20 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/01 04:25 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/06/30 22:39 upstream d0b3b7b22dfa 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/06/30 19:58 upstream d0b3b7b22dfa fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/06/04 02:31 upstream 614da38e2f7a 0aba2352 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/21 00:20 upstream a4145ce1e7bc 5b7d42ae .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/06/14 13:10 upstream 101b7a97143a a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/19 21:48 upstream 2cf4f94d8e86 3ad490ea .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/10/19 22:11 upstream dd72f9c7e512 42e1d524 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/10/13 09:10 upstream ce583d5fb9d3 6388bc36 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2025/07/09 00:51 upstream d006330be3f7 abade794 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in copy_siginfo_to_user
2025/07/05 22:04 upstream a79a588fc176 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in copy_siginfo_to_user
2025/07/03 11:51 upstream b4911fb0b060 115ceea7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in copy_siginfo_to_user
* Struck through repros no longer work on HEAD.