===================================================== BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:30 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:302 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:330 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185 copy_page_to_iter+0x482/0x910 lib/iov_iter.c:362 copy_folio_to_iter include/linux/uio.h:204 [inline] filemap_read+0xcfd/0x2300 mm/filemap.c:2763 blkdev_read_iter+0x89f/0xb00 block/fops.c:852 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x8ea/0xf90 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6884 at kernel/stacktrace.c:29 stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29 Modules linked in: CPU: 0 UID: 0 PID: 6884 Comm: udevd Tainted: G W syzkaller #0 PREEMPT(none) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29 Code: 08 36 24 92 89 de ba 20 00 00 00 4c 89 e1 e8 33 13 4d ff 49 83 c6 08 49 ff cd 0f 85 6e ff ff ff eb 0b e8 1f 87 c3 00 eb d4 90 <0f> 0b 90 5b 41 5c 41 5d 41 5e 41 5f 5d e9 0a 3f 0e 0f cc 66 0f 1f RSP: 0018:ffff88806c803398 EFLAGS: 00010246 RAX: ffff88804eb82c20 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88806c8033c0 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88806c0033d8 R11: 0000000000000001 R12: 0000000000000000 R13: 00000000abcd0100 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f1fbe94a880(0000) GS:ffff8881aa690000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1fbe214000 CR3: 000000002004c000 CR4: 00000000003526f0 Call Trace: kmsan_print_origin+0xb0/0x340 mm/kmsan/report.c:133 kmsan_report+0x1d3/0x320 mm/kmsan/report.c:196 kmsan_internal_check_memory+0x16c/0x230 mm/kmsan/core.c:293 kmsan_copy_to_user+0xf1/0x190 mm/kmsan/hooks.c:269 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185 copy_page_to_iter+0x482/0x910 lib/iov_iter.c:362 copy_folio_to_iter include/linux/uio.h:204 [inline] filemap_read+0xcfd/0x2300 mm/filemap.c:2763 blkdev_read_iter+0x89f/0xb00 block/fops.c:852 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x8ea/0xf90 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1fbe2a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007fffb69bb4d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f1fbe94a880 RCX: 00007f1fbe2a7407 RDX: 0000000000000400 RSI: 00007f1fbe210000 RDI: 0000000000000009 RBP: 00005612a70e6090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000004000 R14: 00005612a70f3798 R15: 00007f1fbea7139c ---[ end trace 0000000000000000 ]--- Uninit was created at: slab_free_hook mm/slub.c:2348 [inline] slab_free mm/slub.c:4695 [inline] kfree+0x252/0xec0 mm/slub.c:4894 ieee80211_ibss_rx_queued_mgmt+0x2f83/0x3f60 net/mac80211/ibss.c:-1 ieee80211_iface_process_skb net/mac80211/iface.c:1699 [inline] ieee80211_iface_work+0x11c7/0x1e70 net/mac80211/iface.c:1753 cfg80211_wiphy_work+0x344/0x850 net/wireless/core.c:435 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xb8e/0x1d80 kernel/workqueue.c:3319 worker_thread+0xedf/0x1590 kernel/workqueue.c:3400 kthread+0xd59/0xf00 kernel/kthread.c:463 ret_from_fork+0x233/0x380 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Bytes 202-207 of 1024 are uninitialized Memory access of size 1024 starts at ffff88807707a000 Data copied to user address 00007f1fbe210000 CPU: 0 UID: 0 PID: 6884 Comm: udevd Tainted: G W syzkaller #0 PREEMPT(none) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 =====================================================