===================================================== BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in _inline_copy_to_user include/linux/uaccess.h:196 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _inline_copy_to_user include/linux/uaccess.h:196 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:225 [inline] copy_siginfo_to_user+0x3f/0x140 kernel/signal.c:3503 x64_setup_rt_frame+0x1392/0x2590 arch/x86/kernel/signal_64.c:194 setup_rt_frame arch/x86/kernel/signal.c:250 [inline] handle_signal arch/x86/kernel/signal.c:294 [inline] arch_do_signal_or_restart+0x63c/0xbf0 arch/x86/kernel/signal.c:339 exit_to_user_mode_loop+0xec/0x330 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x1e3/0x210 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_free_hook mm/slub.c:2307 [inline] slab_free mm/slub.c:4643 [inline] kmem_cache_free+0x2a1/0xec0 mm/slub.c:4745 __sigqueue_free+0x23a/0x270 kernel/signal.c:475 collect_signal kernel/signal.c:587 [inline] __dequeue_signal+0x66b/0x970 kernel/signal.c:609 dequeue_signal+0x1c0/0x840 kernel/signal.c:632 do_sigtimedwait+0x6f9/0xae0 kernel/signal.c:3787 __do_sys_rt_sigtimedwait kernel/signal.c:3826 [inline] __se_sys_rt_sigtimedwait+0x1f1/0x3d0 kernel/signal.c:3804 __x64_sys_rt_sigtimedwait+0xbd/0x120 kernel/signal.c:3804 x64_sys_call+0xb84/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:129 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 12-15 of 48 are uninitialized Memory access of size 48 starts at ffff88803ef53df0 Data copied to user address 00007ffd55fe1330 CPU: 0 UID: 0 PID: 5807 Comm: syz-executor Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 =====================================================