===================================================== BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copyout lib/iov_iter.c:167 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x376/0x1c60 lib/iov_iter.c:316 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copyout lib/iov_iter.c:167 [inline] _copy_to_iter+0x376/0x1c60 lib/iov_iter.c:316 copy_page_to_iter+0x420/0x880 lib/iov_iter.c:481 copy_folio_to_iter include/linux/uio.h:185 [inline] filemap_read+0xbcc/0x1470 mm/filemap.c:2709 blkdev_read_iter+0x6c0/0x8e0 block/fops.c:616 call_read_iter include/linux/fs.h:1865 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8fc/0xf50 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x93/0xd0 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: memcpy_from_iter lib/iov_iter.c:380 [inline] copy_page_from_iter_atomic+0x1271/0x26d0 lib/iov_iter.c:581 generic_perform_write+0x4b3/0xc50 mm/filemap.c:3931 __generic_file_write_iter+0x20a/0x460 mm/filemap.c:4018 blkdev_write_iter+0x6dd/0xbf0 block/fops.c:572 do_iter_write+0x60c/0x1420 fs/read_write.c:860 vfs_iter_write+0x8e/0xe0 fs/read_write.c:901 iter_file_splice_write+0xbfd/0x16a0 fs/splice.c:739 do_splice_from fs/splice.c:934 [inline] direct_splice_actor+0x133/0x1e0 fs/splice.c:1143 splice_direct_to_actor+0x502/0xfa0 fs/splice.c:1089 do_splice_direct+0x26a/0x3d0 fs/splice.c:1195 do_sendfile+0xc2c/0x1d80 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64+0x1f5/0x280 fs/read_write.c:1308 __x64_sys_sendfile64+0xbd/0x110 fs/read_write.c:1308 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: free_pages_prepare mm/page_alloc.c:1110 [inline] free_unref_page_prepare+0x4a/0x9a0 mm/page_alloc.c:2348 free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2489 release_pages+0x22eb/0x2320 mm/swap.c:1042 __folio_batch_release+0x150/0x190 mm/swap.c:1062 folio_batch_release include/linux/pagevec.h:83 [inline] shmem_undo_range+0x804/0x2030 mm/shmem.c:954 shmem_truncate_range mm/shmem.c:1049 [inline] shmem_evict_inode+0x22d/0xcd0 mm/shmem.c:1164 evict+0x365/0x9a0 fs/inode.c:665 iput_final fs/inode.c:1791 [inline] iput+0x9c2/0xe00 fs/inode.c:1817 dentry_unlink_inode+0x55b/0x650 fs/dcache.c:401 __dentry_kill+0x75a/0xbc0 fs/dcache.c:607 dentry_kill+0x1ed/0x5e0 fs/dcache.c:733 dput+0x3cb/0x650 fs/dcache.c:913 __fput+0xc5e/0xfc0 fs/file_table.c:392 ____fput+0x1e/0x30 fs/file_table.c:412 task_work_run+0x263/0x300 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xdff/0x3fb0 kernel/exit.c:874 do_group_exit+0x2fd/0x390 kernel/exit.c:1024 get_signal+0x265e/0x2bc0 kernel/signal.c:2877 arch_do_signal_or_restart+0x4f/0x920 arch/x86/kernel/signal.c:308 exit_to_user_mode_loop+0xe8/0x320 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x163/0x220 kernel/entry/common.c:204 irqentry_exit_to_user_mode+0xd/0x20 kernel/entry/common.c:310 irqentry_exit+0x16/0x40 kernel/entry/common.c:413 exc_page_fault+0x494/0x680 arch/x86/mm/fault.c:1545 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:570 Bytes 0-1023 of 1024 are uninitialized Memory access of size 1024 starts at ffff888085df7000 Data copied to user address 0000558080132a08 CPU: 0 PID: 27686 Comm: udevd Tainted: G W 6.5.0-rc1-syzkaller-00033-geb26cbb1a754 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 =====================================================