===================================================== BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_user+0xbc/0x100 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0xbc/0x100 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:169 [inline] vcs_read+0x1ef7/0x23c0 drivers/tty/vt/vc_screen.c:456 vfs_read+0x3a9/0x11b0 fs/read_write.c:480 ksys_read+0x21b/0x4e0 fs/read_write.c:620 __do_sys_read fs/read_write.c:630 [inline] __se_sys_read fs/read_write.c:628 [inline] __x64_sys_read+0x8f/0xd0 fs/read_write.c:628 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: vc_uniscr_copy_line+0x340/0x570 drivers/tty/vt/vt.c:565 vcs_read_buf_uni drivers/tty/vt/vc_screen.c:265 [inline] vcs_read+0x102d/0x23c0 drivers/tty/vt/vc_screen.c:436 vfs_read+0x3a9/0x11b0 fs/read_write.c:480 ksys_read+0x21b/0x4e0 fs/read_write.c:620 __do_sys_read fs/read_write.c:630 [inline] __se_sys_read fs/read_write.c:628 [inline] __x64_sys_read+0x8f/0xd0 fs/read_write.c:628 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: vc_uniscr_copy_area drivers/tty/vt/vt.c:481 [inline] vc_do_resize+0x196c/0x2ba0 drivers/tty/vt/vt.c:1299 vc_resize+0x5a/0x70 drivers/tty/vt/vt.c:1362 fbcon_modechanged+0xb81/0x15a0 drivers/video/fbdev/core/fbcon.c:2679 fbcon_update_vcs+0x36/0x40 drivers/video/fbdev/core/fbcon.c:2735 do_fb_ioctl+0xb7f/0xc50 drivers/video/fbdev/core/fbmem.c:1124 fb_ioctl+0x168/0x1a0 drivers/video/fbdev/core/fbmem.c:1201 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0x222/0x400 fs/ioctl.c:856 __x64_sys_ioctl+0x92/0xd0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: vc_uniscr_copy_area drivers/tty/vt/vt.c:481 [inline] vc_do_resize+0x196c/0x2ba0 drivers/tty/vt/vt.c:1299 vt_resize+0xa2/0x110 drivers/tty/vt/vt.c:1383 tiocswinsz+0x116/0x320 drivers/tty/tty_io.c:2372 tty_ioctl+0x71c/0x1870 drivers/tty/tty_io.c:2696 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0x222/0x400 fs/ioctl.c:856 __x64_sys_ioctl+0x92/0xd0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: free_pages_prepare mm/page_alloc.c:1328 [inline] free_pcp_prepare+0x40/0x680 mm/page_alloc.c:1449 free_unref_page_prepare mm/page_alloc.c:3353 [inline] free_unref_page+0x3e/0x3f0 mm/page_alloc.c:3448 free_the_page mm/page_alloc.c:694 [inline] __free_pages+0x78/0x1c0 mm/page_alloc.c:5534 __free_slab+0x2ab/0x690 mm/slub.c:2068 free_slab mm/slub.c:2083 [inline] discard_slab mm/slub.c:2089 [inline] __unfreeze_partials+0xa00/0xb60 mm/slub.c:2563 put_cpu_partial+0x201/0x270 mm/slub.c:2639 __slab_free+0x590/0x8c0 mm/slub.c:3420 do_slab_free mm/slub.c:3539 [inline] slab_free mm/slub.c:3552 [inline] kmem_cache_free+0x78d/0xa40 mm/slub.c:3568 kernfs_put+0x5e4/0x930 fs/kernfs/dir.c:547 __kernfs_remove+0xe06/0x1240 fs/kernfs/dir.c:1404 kernfs_remove_by_name_ns+0x11b/0x1f0 fs/kernfs/dir.c:1586 kernfs_remove_by_name include/linux/kernfs.h:558 [inline] remove_files fs/sysfs/group.c:28 [inline] sysfs_remove_group+0x1be/0x540 fs/sysfs/group.c:288 sysfs_remove_groups+0x64/0xf0 fs/sysfs/group.c:312 device_remove_groups drivers/base/core.c:2490 [inline] device_remove_attrs+0x1a3/0x2e0 drivers/base/core.c:2704 device_del+0x94f/0x1790 drivers/base/core.c:3614 netdev_unregister_kobject+0x1e1/0x230 net/core/net-sysfs.c:1987 unregister_netdevice_many+0x2515/0x3070 net/core/dev.c:10870 default_device_exit_batch+0xb50/0xc20 net/core/dev.c:11337 ops_exit_list net/core/net_namespace.c:167 [inline] cleanup_net+0xdea/0x18c0 net/core/net_namespace.c:594 process_one_work+0xb27/0x13e0 kernel/workqueue.c:2289 worker_thread+0x1076/0x1d60 kernel/workqueue.c:2436 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Bytes 24-35 of 4096 are uninitialized Memory access of size 4096 starts at ffff888011add000 Data copied to user address 0000000020001100 CPU: 1 PID: 25156 Comm: syz-executor.2 Not tainted 5.19.0-syzkaller-32655-g1b070a5d1a2c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 =====================================================