===================================================== BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:30 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:300 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:328 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0xf0e/0x32f0 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:300 [inline] iterate_and_advance include/linux/iov_iter.h:328 [inline] _copy_to_iter+0xf0e/0x32f0 lib/iov_iter.c:185 copy_page_to_iter+0x43c/0x8b0 lib/iov_iter.c:362 copy_folio_to_iter include/linux/uio.h:198 [inline] filemap_read+0xced/0x2190 mm/filemap.c:2753 blkdev_read_iter+0x89d/0xa70 block/fops.c:796 new_sync_read fs/read_write.c:489 [inline] vfs_read+0x845/0xef0 fs/read_write.c:570 ksys_read fs/read_write.c:713 [inline] __do_sys_read fs/read_write.c:722 [inline] __se_sys_read fs/read_write.c:720 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:720 x64_sys_call+0x39db/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: ntfs_write_bh+0x6ae/0xe90 fs/ntfs3/fsntfs.c:1426 mi_write+0xb4/0x2f0 fs/ntfs3/record.c:402 ni_write_inode+0xd1c/0x1c40 fs/ntfs3/frecord.c:3312 ntfs3_write_inode+0x94/0xb0 fs/ntfs3/inode.c:1019 write_inode fs/fs-writeback.c:1525 [inline] __writeback_single_inode+0x88f/0x1190 fs/fs-writeback.c:1745 writeback_sb_inodes+0xaa9/0x1c90 fs/fs-writeback.c:1976 wb_writeback+0x4ce/0xc00 fs/fs-writeback.c:2156 wb_do_writeback fs/fs-writeback.c:2303 [inline] wb_workfn+0x397/0x1910 fs/fs-writeback.c:2343 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xb97/0x1d90 kernel/workqueue.c:3319 worker_thread+0xedf/0x1590 kernel/workqueue.c:3400 kthread+0xd59/0xf00 kernel/kthread.c:464 ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Uninit was stored to memory at: al_update+0x3a9/0x570 fs/ntfs3/attrlist.c:404 ni_write_inode+0x1a75/0x1c40 fs/ntfs3/frecord.c:3280 ntfs3_write_inode+0x94/0xb0 fs/ntfs3/inode.c:1019 write_inode fs/fs-writeback.c:1525 [inline] __writeback_single_inode+0x88f/0x1190 fs/fs-writeback.c:1745 writeback_sb_inodes+0xaa9/0x1c90 fs/fs-writeback.c:1976 wb_writeback+0x4ce/0xc00 fs/fs-writeback.c:2156 wb_do_writeback fs/fs-writeback.c:2303 [inline] wb_workfn+0x397/0x1910 fs/fs-writeback.c:2343 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xb97/0x1d90 kernel/workqueue.c:3319 worker_thread+0xedf/0x1590 kernel/workqueue.c:3400 kthread+0xd59/0xf00 kernel/kthread.c:464 ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Uninit was created at: slab_free_hook mm/slub.c:2324 [inline] slab_free mm/slub.c:4656 [inline] kfree+0x236/0xea0 mm/slub.c:4855 skb_kfree_head net/core/skbuff.c:1058 [inline] skb_free_head net/core/skbuff.c:1070 [inline] skb_release_data+0xe72/0x1110 net/core/skbuff.c:1097 skb_release_all net/core/skbuff.c:1162 [inline] __kfree_skb+0x6b/0x260 net/core/skbuff.c:1176 sk_skb_reason_drop+0x126/0x440 net/core/skbuff.c:1214 kfree_skb_reason include/linux/skbuff.h:1279 [inline] __netif_receive_skb_core+0x6771/0x70c0 net/core/dev.c:5861 __netif_receive_skb_one_core net/core/dev.c:5885 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6000 process_backlog+0x485/0xa00 net/core/dev.c:6352 __napi_poll+0xda/0x9c0 net/core/dev.c:7324 napi_poll net/core/dev.c:7388 [inline] net_rx_action+0xa0a/0x18f0 net/core/dev.c:7510 handle_softirqs+0x166/0x6e0 kernel/softirq.c:579 __do_softirq+0x14/0x1b kernel/softirq.c:613 Bytes 202-207 of 512 are uninitialized Memory access of size 512 starts at ffff88804c14e000 Data copied to user address 000055bdab9f8128 CPU: 0 UID: 0 PID: 6044 Comm: udevd Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 =====================================================