syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1342]
≡ Subsystems
🐞 Fixed [7091]
🐞 Invalid [18719]
⬇ Missing Backports [220]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

KMSAN: uninit-value in copy_from_kernel_nofault

Status: upstream: reported on 2026/03/16 10:22
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+c18de0ad13d62f18469d@syzkaller.appspotmail.com
First crash: 65d, last: 1d12h
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KMSAN: uninit-value in copy_from_kernel_nofault 3 (4) 2026/03/16 14:36
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: out-of-bounds Read in copy_from_kernel_nofault mm 17 C done 1628 416d 593d 28/29 fixed on 2025/05/06 15:33
upstream KASAN: out-of-bounds Write in copy_from_kernel_nofault mm 21 1 633d 632d 0/29 closed as invalid on 2024/09/13 11:13
linux-5.15 Internal error in copy_from_kernel_nofault origin:lts-only 2 C error 33 65d 280d 0/3 upstream: reported C repro on 2025/08/09 00:00
upstream BUG: unable to handle kernel paging request in copy_from_kernel_nofault (2) mm 8 C 2 764d 774d 25/29 fixed on 2024/05/22 23:36
upstream BUG: unable to handle kernel paging request in copy_from_kernel_nofault mm 8 C done 5 809d 908d 25/29 fixed on 2024/03/29 01:33
linux-5.15 BUG: unable to handle kernel paging request in copy_from_kernel_nofault origin:upstream 8 C done 2 809d 912d 3/3 fixed on 2024/03/28 13:37
linux-6.1 KASAN: stack-out-of-bounds Write in copy_from_kernel_nofault origin:lts-only 21 C unreliable 3 809d 1139d 0/3 upstream: reported C repro on 2023/04/02 16:05
android-5-15 BUG: unable to handle kernel paging request in copy_from_kernel_nofault missing-backport 8 C done 231 643d 912d 0/2 auto-obsoleted due to no activity on 2024/10/20 13:25
android-6-1 BUG: unable to handle kernel paging request in copy_from_kernel_nofault origin:upstream missing-backport 8 C done inconclusive 127 696d 912d 0/2 auto-obsoleted due to no activity on 2024/08/28 01:00

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in copy_from_kernel_nofault+0x15f/0x570 mm/maccess.c:41
 copy_from_kernel_nofault+0x15f/0x570 mm/maccess.c:41
 prepend_copy fs/d_path.c:50 [inline]
 prepend fs/d_path.c:76 [inline]
 prepend_name fs/d_path.c:101 [inline]
 __prepend_path fs/d_path.c:133 [inline]
 prepend_path+0x64e/0x1090 fs/d_path.c:172
 d_absolute_path+0x11b/0x240 fs/d_path.c:234
 tomoyo_get_absolute_path security/tomoyo/realpath.c:101 [inline]
 tomoyo_realpath_from_path+0x4bd/0x9f0 security/tomoyo/realpath.c:271
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_check_open_permission+0x1ff/0xc60 security/tomoyo/file.c:776
 tomoyo_file_open+0x29a/0x320 security/tomoyo/tomoyo.c:334
 security_file_open+0x116/0x4d0 security/security.c:2739
 do_dentry_open+0x5fe/0x1fc0 fs/open.c:924
 vfs_open+0x52/0x5f0 fs/open.c:1079
 do_open fs/namei.c:4699 [inline]
 path_openat+0x5733/0x64c0 fs/namei.c:4858
 do_file_open+0x2aa/0x680 fs/namei.c:4887
 do_sys_openat2+0x163/0x370 fs/open.c:1364
 do_sys_open fs/open.c:1370 [inline]
 __do_sys_openat fs/open.c:1386 [inline]
 __se_sys_openat fs/open.c:1381 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1381
 x64_sys_call+0x2445/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

<Zero or more stacks not recorded to save memory>

Uninit was stored to memory at:
 copy_name fs/dcache.c:2928 [inline]
 __d_move+0xf72/0x2aa0 fs/dcache.c:2997
 d_move+0x71/0xf0 fs/dcache.c:3044
 vfs_rename+0x2510/0x2650 fs/namei.c:6069
 filename_renameat2+0xb7f/0x1260 fs/namei.c:6172
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 copy_name fs/dcache.c:2928 [inline]
 __d_move+0xf72/0x2aa0 fs/dcache.c:2997
 d_move+0x71/0xf0 fs/dcache.c:3044
 vfs_rename+0x2510/0x2650 fs/namei.c:6069
 filename_renameat2+0xb7f/0x1260 fs/namei.c:6172
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 copy_name fs/dcache.c:2928 [inline]
 __d_move+0xf72/0x2aa0 fs/dcache.c:2997
 d_move+0x71/0xf0 fs/dcache.c:3044
 vfs_rename+0x2510/0x2650 fs/namei.c:6069
 filename_renameat2+0xb7f/0x1260 fs/namei.c:6172
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 copy_name fs/dcache.c:2928 [inline]
 __d_move+0xf72/0x2aa0 fs/dcache.c:2997
 d_move+0x71/0xf0 fs/dcache.c:3044
 vfs_rename+0x2510/0x2650 fs/namei.c:6069
 filename_renameat2+0xb7f/0x1260 fs/namei.c:6172
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 copy_name fs/dcache.c:2928 [inline]
 __d_move+0xf72/0x2aa0 fs/dcache.c:2997
 d_move+0x71/0xf0 fs/dcache.c:3044
 vfs_rename+0x2510/0x2650 fs/namei.c:6069
 filename_renameat2+0xb7f/0x1260 fs/namei.c:6172
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 copy_name fs/dcache.c:2928 [inline]
 __d_move+0xf72/0x2aa0 fs/dcache.c:2997
 d_move+0x71/0xf0 fs/dcache.c:3044
 vfs_rename+0x2510/0x2650 fs/namei.c:6069
 filename_renameat2+0xb7f/0x1260 fs/namei.c:6172
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 copy_name fs/dcache.c:2928 [inline]
 __d_move+0xf72/0x2aa0 fs/dcache.c:2997
 d_move+0x71/0xf0 fs/dcache.c:3044
 vfs_rename+0x2510/0x2650 fs/namei.c:6069
 filename_renameat2+0xb7f/0x1260 fs/namei.c:6172
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4576 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 kmem_cache_alloc_lru_noprof+0x37a/0x1260 mm/slub.c:4917
 __d_alloc+0x55/0xa00 fs/dcache.c:1807
 d_alloc+0x57/0x300 fs/dcache.c:1886
 lookup_one_qstr_excl+0x19d/0x7b0 fs/namei.c:1801
 __start_renaming+0x38e/0x870 fs/namei.c:3890
 filename_renameat2+0x735/0x1260 fs/namei.c:6147
 __do_sys_rename fs/namei.c:6216 [inline]
 __se_sys_rename+0xc5/0x5d0 fs/namei.c:6212
 __x64_sys_rename+0x78/0xb0 fs/namei.c:6212
 x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Bytes 5-7 of 8 are uninitialized
Memory access of size 8 starts at ffff8880140f7338

CPU: 0 UID: 0 PID: 5808 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/13 06:41 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/05/06 03:51 upstream 9207d47f966b 26da2c66 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/05/04 09:15 upstream 6d35786de281 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/04/22 04:34 upstream e2683c8868d0 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/04/19 17:07 upstream faeab166167f 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/04/13 22:39 upstream 0f0013213293 1a086e7c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/05/15 01:38 upstream 66182ca873a4 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/04/10 10:40 upstream 9a9c8ce300cd 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/03/28 22:39 upstream be762d8b6dd7 356bdfc9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in copy_from_kernel_nofault
2026/03/12 10:17 upstream 80234b5ab240 4efadf07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in copy_from_kernel_nofault
* Struck through repros no longer work on HEAD.