Extracting prog: 8m3.705266215s Minimizing prog: 28m51.580051729s Simplifying prog options: 0s Extracting C: 1m11.933164526s Simplifying C: 19m49.465963775s extracting reproducer from 9 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_ENUM_ENTITIES-socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) read$alg(r2, &(0x7f00000001c0)=""/24, 0x18) program did not crash single: failed to extract reproducer bisect: bisecting 9 programs with base timeout 30s testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 7, 14, 8, 4, 6, 4, 6, 26] detailed listing: executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(0xffffffffffffffff, 0xc0305602, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f0000000000)={r4, 0x9}, 0x8) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000001000010029bd7000ffdbdf2500000000", @ANYRES32=r2, @ANYBLOB="120804002010000024001280110001006272696467655f736c618c65000000000c0005800500194003"], 0x44}, 0x1, 0x0, 0x0, 0x404c1}, 0x40040d4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setresuid(0xffffffffffffffff, 0xffffffffffffffff, 0xee01) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x24044040) executing program 3: mlockall(0x2) fchdir(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x60000, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8000) r1 = shmget(0x1, 0x2000, 0x200, &(0x7f0000ffc000/0x2000)=nil) shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x6000) shmctl$SHM_LOCK(r1, 0xb) mount$bpf(0x0, &(0x7f0000000ac0)='.\x00', 0x0, 0x400008, &(0x7f0000000080)=ANY=[]) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000540)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000003c0)='./file0\x00', 0xa) executing program 0: syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7736, 0x0, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') preadv(r1, &(0x7f0000000bc0)=[{&(0x7f0000000140)=""/171, 0xab}], 0x1, 0x0, 0x0) executing program 2: syz_mount_image$udf(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', 0x4084, &(0x7f00000001c0)=ANY=[@ANYBLOB='lastblock=00000000000000000000,umask=00000000000000000000002,dmode=00000000000000000077777,novrs,shortad,shortad,undelete,iocharset=cp437,shortad,umask=00000000000000000000006,dmode=00000000000000000000002,nostrict,uid=', @ANYRESOCT=0x0, @ANYRES16, @ANYRESOCT=0x0, @ANYRESHEX, @ANYRES16=0x0], 0x2, 0xc3b, &(0x7f0000000c80)="$eJzs3U1sHNd9APD/G+6KS7utmNhRnDQuNm2Ryorl6iumYhXuqqbZBpBlIRRzC8CVSKkLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBcgoYzOxbcUWRjiKSEmX9ftLyv/PmvZn3sZqhCL55AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABE/MGr50+cTA+7FgDAg3Rx/MsnTrn/A8Bj5bL//wMAAAAAAAAAAAAAwEGXooinIsX8xfU0WW13NS506jdvTYyObV9sKFUlB6r85atx8tTpM194ceRsL17ozH5I+b326Xh9/PL55itzN+YXphcXp6eaE7Odq3NT0/d8hN2W3+pY1QHNG2/cnLp2bbF56oXTd+y+NfzB4JNHhs+NPHf82V7eidGxsfHNLI3+/LX7rkjXTjM8DkURxyPF89/5cWpHRBG774vGgx37rYaqRhyrGjExOlY1ZKbTnl0qd17qdUQR0ewr1Or10fZjEbX6A23DzloRy2X1ywofK5s3Pt9eaF+ZmW5eai8sdZY6c7OXUre2ZXuaUcTZFLESEWuDdx+uHkXUIsW3Dq+nKxEx0OuHz1cTg3euR7GPbbwHZT2b9YiV4hEYswNsMIp4LVL85N2jcTVfZ6przeciXivj9yLeLuPLEan8YJyJeH+bzxGPploU8Zfl+J9bT1PV9aB3XbnwleaXZq/N9eXtXVd+yfvDXVeKh3R/GNoSH4wDfm1qRBHt6oq/nu7/mx0AAAAAAAAAAAAAAAAA9tpQFPGpSPHqf/xJN6Gal3743MgfDv9q/5zxZ37Bccq8L0TEcnFvc3IP5YmBl9KllB7yXOLHWSOK+NM8/+8bD7syAAAAAAAAAAAAAAAAAAAAj7UifhQpXnrvaFqJ/jXFO7PXm5fbV2a6q8L21v7trZm+sbGx0Uzd2MpxMsflHFdyXM1xLccocvkcWzlO5ric40qOqzmu5RgDuXyOrRwnc1zOcSXH1RzXcoxaLp9jK8fJHJfL2Nhs6GpOX8sxDsjavQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHyVFFPGzSPHNr62nSBHRipiMblwdfNi1AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKg6mI70aK5h+1bqfVIiJVf7uOll/OROtQGT8erZEyvhyt8zm2q1hrfeMh1J/dqacifhgpBhvv3B7wPP717tbtj0G8/fXNrU/XunGgt3P4g8Enjxw+NzL2G8/s9D5tV4FjFzqzN281J0bHxsb7kmv17qE/3pc2nM9b7FXjicU333qjPTMzvXD/b8px2kXxR+hNqu1BS4f2rucf/JvymrCfp1g+WN0StQNRjYfTdh4D5f3//Ujxu+/9Z++G373/N+JXulu37/Dx0z/bvP+/tPVA93j/r20tl+//5T19y/2/8lRf2kv5u5F6LaKxdGO+fiSisfjmW8c7N9rXp69Pz545ceKLIyNfPH2ifiiica0zM933bk+6CwAAAAAAAAAAAAAAAODBSUX8fqRo/3A9NSPiVjVfa/jcyHPHnx2IgWq+VfnaqETE6+OXzzdfmbsxvzC9uDg91ZyY7Vydm5q+19M1quleE6Nj+9uqnQztc/2HGq/Mzb+50Ln+x0vb7n+icf7K4tJC++r2u2MoiohWf8qxqsITo2NVpWc67dmq6KVtJ9P/8uqpiP+KFFfPNNNnc1qe/791hv8d8/+Xtx5o7+f/Vz7Wl1aeM6UifhopfuevnonPVvV8Iu7qs5zv7yLFsbOfyfniUJmvV4fucwW6MwPLvP8XKf7pZ3fm7c2HfGoz78l77thHRDn+hyPFd//i2/GbOe3O5z9sP/5PbD3QPo3/031pT9wxa37XTSeP//FI8fJT78Rv5bQPe/5H79kbR3Pm28/n2Kfx/0Rf2nA+72/vTdMBAAAAAAAAAAAeafVUxN9Hiu+P1dKLOe1efv9vauuB9un3vz7Zlzb1gFbN2XWnAgAAAMABUU9F/ChSXF965/Yc6jvnf/fN//y9zfmfo2nL3urnfL9WPTdgL3/+1284n3dy980GAAAAAAAAAAAAAAAAAACAAyWlIl7M66lPVvP5p3ZcT301Urz6P8/nfOlIma+3Dvxw9bVxcW72+PmZmbmr7aX2lZnp5vh8++p0WfbpSLH+t5/JZYtqffXeevPdNd4312JfiBRj/9DL212Lvbc2+dObeU+WeT8WKf77H+/M21vH+hObeU+Vef8mUnz1X7bPe2Qz7+ky77cjxQ++2uzlfaLM23s+6ic3875wda7Yh1EBAAAAAAAAAAAAAAAAAADgcVNPRfx5pPjfGyu35/Ln9f/rfZuVt7/et97/Freqdf6Hq/X/d3p/P+v/V88VWN7prAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8NGUooi3IsX8xfW0OlhudzUudGZv3poYHdu+2FCqSg5U+ctX4+Sp02e+8OLI2V788PJ77VPx+vjl881X5m7ML0wvLk5PNSdmO1fnpqbv+Qi7Lb/VsaoDmjfeuDl17dpi89QLp+/YfWv4g8EnjwyfG3nu+LO9vBOjY2PjfXlq9fs++13SDumHooi/jhTPf+fH6fuDEUXsvi9+wWdnvw1VjThWNWJidKxqyEynPbtU7rzU64giotlXqNXrowcwFrvSilguq19W+FjZvPH59kL7ysx081J7Yamz1JmbvZS6tS3b04wizqaIlYhYG7z7cPUo4o1I8a3D6+lfByMGev3w+YvjXz5xaud6FPvYxntQ1rNZj1gpHoExO8AGo4h/jhQ/efdo/NtgRC26r/hcxGtl/F7E29Ed71R+MM5EvL/N54hHUy2K+P9y/M+tp3cHy+tB77py4SvNL81em+vL27uuPPL3hwfpgF+bGlHED6or/nr6d/+uAQAAAAAAAAAAAAAAAA6QIn49Urz03tFUzQ++Pae4M3u9ebl9ZaY7ra839683Z3pjY2OjmbqxleNkjss5ruS4muNajlHk8jm2ytjY2JjM28s5ruS4muNajjGQy+fYynEyx+WBLeXz9lqOUcvlc2zlOJnjco4rOa7muJZjHJC5ewAAAAAAAAAAAAAAAAAAwEdLUf1J8c2vraeNwe760pPRjavWA/3I+3kAAAD//9t79Bk=") unlinkat(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_usb_connect(0x5, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120110017a953210ac0504c777620102030109022d0001080540040904270102fffd01000921e700070122b30409050c0200020103400905df02"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0003040900000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500000000000000000002000000300003802c00038014000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a3000000000"], 0x84}, 0x1, 0x0, 0x0, 0x24040089}, 0x20008000) executing program 1: r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) read$alg(r2, &(0x7f00000001c0)=""/24, 0x18) executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendto$inet6(r1, &(0x7f0000000240), 0x0, 0x51, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002abd7000000000000000000000000000006d7af9fb55799c0ddcaf21af2774a067ff00000000000001", @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0xfc}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = semget$private(0x0, 0x1, 0x81) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) semctl$SETVAL(r3, 0x1, 0x10, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x9, 0x101, 0x0, 0x0, {}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x3}}, @NFCTH_TUPLE={0x24, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x2, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @dev}}}]}, @NFCTH_PRIV_DATA_LEN={0x8}]}, 0x4c}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) getpid() pipe(0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r6, 0x0, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_ENUM_ENTITIES-socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) read$alg(r2, &(0x7f00000001c0)=""/24, 0x18) program crashed: KMSAN: kernel-infoleak in rng_recvmsg single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_ENUM_ENTITIES-socket$alg-bind$alg-accept4$alg detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) accept4$alg(r1, 0x0, 0x0, 0x0) program did not crash testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_ENUM_ENTITIES-socket$alg-bind$alg-read$alg detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) read$alg(0xffffffffffffffff, &(0x7f00000001c0)=""/24, 0x18) program did not crash testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_ENUM_ENTITIES-socket$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) read$alg(r2, &(0x7f00000001c0)=""/24, 0x18) program did not crash testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_ENUM_ENTITIES-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r1 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) read$alg(r1, &(0x7f00000001c0)=""/24, 0x18) program did not crash testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) read$alg(r1, &(0x7f00000001c0)=""/24, 0x18) program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) read$alg(r1, &(0x7f00000001c0)=""/24, 0x18) program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) read$alg(r1, &(0x7f00000001c0)=""/24, 0x18) program did not crash testing program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) read$alg(r1, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30.028428705s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program crashed: KMSAN: kernel-infoleak in rng_recvmsg simplifying C reproducer testing compiled C program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing compiled C program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing compiled C program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing compiled C program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program did not crash testing compiled C program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing compiled C program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing compiled C program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg program crashed: KMSAN: kernel-infoleak in rng_recvmsg testing program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) read$alg(r1, &(0x7f00000001c0)=""/24, 0x18) program crashed: KMSAN: kernel-infoleak in rng_recvmsg validation run: crashed=true testing program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) read$alg(r1, &(0x7f00000001c0)=""/24, 0x18) program crashed: KMSAN: kernel-infoleak in rng_recvmsg validation run: crashed=true testing program (duration=2m30.028428705s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-bind$alg-accept4$alg-read$alg detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) read$alg(r1, &(0x7f00000001c0)=""/24, 0x18) program crashed: KMSAN: kernel-infoleak in rng_recvmsg validation run: crashed=true reproducing took 1h5m49.957037364s repro crashed as (corrupted=false): ===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:30 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:300 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:328 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0xf0e/0x33f0 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:300 [inline] iterate_and_advance include/linux/iov_iter.h:328 [inline] _copy_to_iter+0xf0e/0x33f0 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:220 [inline] memcpy_to_msg include/linux/skbuff.h:4202 [inline] _rng_recvmsg crypto/algif_rng.c:101 [inline] rng_recvmsg+0x1af/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_sha3_finup+0x136/0xe00 crypto/sha3_generic.c:202 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_shash_finup+0xc5a/0xe80 crypto/shash.c:162 crypto_shash_update include/crypto/hash.h:994 [inline] jent_hash_time+0x1de/0x590 crypto/jitterentropy-kcapi.c:136 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: put_unaligned_le64 include/linux/unaligned.h:43 [inline] crypto_sha3_finup+0xc98/0xe00 crypto/sha3_generic.c:213 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: keccakf_round crypto/sha3_generic.c:-1 [inline] keccakf+0x1efb/0x2110 crypto/sha3_generic.c:155 crypto_sha3_finup+0x772/0xe00 crypto/sha3_generic.c:210 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_sha3_finup+0x5be/0xe00 crypto/sha3_generic.c:207 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_sha3_finup+0x136/0xe00 crypto/sha3_generic.c:202 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_shash_finup+0xc5a/0xe80 crypto/shash.c:162 crypto_shash_update include/crypto/hash.h:994 [inline] jent_hash_time+0x1de/0x590 crypto/jitterentropy-kcapi.c:136 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable intermediary created at: jent_hash_time+0x9b/0x590 crypto/jitterentropy-kcapi.c:110 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 Bytes 0-23 of 24 are uninitialized Memory access of size 24 starts at ffff8880466dbb70 Data copied to user address 00002000000001c0 CPU: 0 UID: 0 PID: 6067 Comm: syz.0.18 Not tainted 6.16.0-syzkaller-11952-g6e64f4580381 #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 ===================================================== final repro crashed as (corrupted=false): ===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:30 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:300 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:328 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0xf0e/0x33f0 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:300 [inline] iterate_and_advance include/linux/iov_iter.h:328 [inline] _copy_to_iter+0xf0e/0x33f0 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:220 [inline] memcpy_to_msg include/linux/skbuff.h:4202 [inline] _rng_recvmsg crypto/algif_rng.c:101 [inline] rng_recvmsg+0x1af/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_sha3_finup+0x136/0xe00 crypto/sha3_generic.c:202 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_shash_finup+0xc5a/0xe80 crypto/shash.c:162 crypto_shash_update include/crypto/hash.h:994 [inline] jent_hash_time+0x1de/0x590 crypto/jitterentropy-kcapi.c:136 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: put_unaligned_le64 include/linux/unaligned.h:43 [inline] crypto_sha3_finup+0xc98/0xe00 crypto/sha3_generic.c:213 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: keccakf_round crypto/sha3_generic.c:-1 [inline] keccakf+0x1efb/0x2110 crypto/sha3_generic.c:155 crypto_sha3_finup+0x772/0xe00 crypto/sha3_generic.c:210 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_sha3_finup+0x5be/0xe00 crypto/sha3_generic.c:207 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_sha3_finup+0x136/0xe00 crypto/sha3_generic.c:202 crypto_shash_op_and_zero crypto/shash.c:105 [inline] crypto_shash_finup+0x327/0xe80 crypto/shash.c:171 jent_hash_time+0x247/0x590 crypto/jitterentropy-kcapi.c:138 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: crypto_shash_finup+0xc5a/0xe80 crypto/shash.c:162 crypto_shash_update include/crypto/hash.h:994 [inline] jent_hash_time+0x1de/0x590 crypto/jitterentropy-kcapi.c:136 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 jent_measure_jitter+0x547/0x770 crypto/jitterentropy.c:541 jent_gen_entropy+0x209/0x450 crypto/jitterentropy.c:569 jent_read_entropy+0x353/0xeb0 crypto/jitterentropy.c:615 jent_kcapi_random+0x6c/0x250 crypto/jitterentropy-kcapi.c:284 crypto_rng_generate include/crypto/rng.h:144 [inline] _rng_recvmsg crypto/algif_rng.c:97 [inline] rng_recvmsg+0x149/0x2d0 crypto/algif_rng.c:114 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1087 sock_read_iter+0x2c8/0x360 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x857/0xf00 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable intermediary created at: jent_hash_time+0x9b/0x590 crypto/jitterentropy-kcapi.c:110 jent_condition_data+0x4f0/0x510 crypto/jitterentropy.c:438 Bytes 0-23 of 24 are uninitialized Memory access of size 24 starts at ffff8880466dbb70 Data copied to user address 00002000000001c0 CPU: 0 UID: 0 PID: 6067 Comm: syz.0.18 Not tainted 6.16.0-syzkaller-11952-g6e64f4580381 #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 =====================================================