===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _inline_copy_to_user include/linux/uaccess.h:196 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:225 [inline] copy_siginfo_to_user+0x3f/0x140 kernel/signal.c:3503 x64_setup_rt_frame+0x1392/0x2590 arch/x86/kernel/signal_64.c:194 setup_rt_frame arch/x86/kernel/signal.c:250 [inline] handle_signal arch/x86/kernel/signal.c:294 [inline] arch_do_signal_or_restart+0x63c/0xbf0 arch/x86/kernel/signal.c:339 exit_to_user_mode_loop+0xec/0x330 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x1e3/0x210 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: copy_siginfo include/linux/signal.h:18 [inline] collect_signal kernel/signal.c:575 [inline] __dequeue_signal+0x4d6/0x970 kernel/signal.c:609 dequeue_signal+0x1c0/0x840 kernel/signal.c:632 get_signal+0xbf8/0x2a20 kernel/signal.c:2914 arch_do_signal_or_restart+0x53/0xbf0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0xec/0x330 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x1e3/0x210 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __alloc_frozen_pages_noprof+0x689/0xf00 mm/page_alloc.c:4982 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2419 alloc_frozen_pages_noprof+0xf7/0x200 mm/mempolicy.c:2490 alloc_slab_page mm/slub.c:2451 [inline] allocate_slab+0x24d/0x1220 mm/slub.c:2619 new_slab mm/slub.c:2673 [inline] ___slab_alloc+0xfec/0x3480 mm/slub.c:3859 __slab_alloc mm/slub.c:3949 [inline] __slab_alloc_node mm/slub.c:4024 [inline] slab_alloc_node mm/slub.c:4185 [inline] kmem_cache_alloc_noprof+0x91b/0xec0 mm/slub.c:4204 sigqueue_alloc kernel/signal.c:455 [inline] __send_signal_locked+0x27d/0x14c0 kernel/signal.c:1087 send_signal_locked+0x738/0xb70 kernel/signal.c:1216 do_send_sig_info+0x1ab/0x260 kernel/signal.c:1269 group_send_sig_info+0xef/0x140 kernel/signal.c:1419 do_bpf_send_signal+0xf8/0x260 kernel/trace/bpf_trace.c:815 irq_work_single kernel/irq_work.c:221 [inline] irq_work_run_list kernel/irq_work.c:252 [inline] irq_work_run+0x1b3/0x780 kernel/irq_work.c:261 __sysvec_irq_work+0x45/0x320 arch/x86/kernel/irq_work.c:22 instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline] sysvec_irq_work+0x7c/0x90 arch/x86/kernel/irq_work.c:17 asm_sysvec_irq_work+0x1f/0x30 arch/x86/include/asm/idtentry.h:738 Bytes 12-15 of 48 are uninitialized Memory access of size 48 starts at ffff888062f6fdf0 Data copied to user address 00007f7847190c70 CPU: 0 UID: 0 PID: 7252 Comm: syz.1.277 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 =====================================================