===================================================== BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:30 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:302 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:330 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185 copy_page_to_iter+0x482/0x910 lib/iov_iter.c:362 copy_folio_to_iter include/linux/uio.h:204 [inline] filemap_read+0xcfd/0x2300 mm/filemap.c:2799 blkdev_read_iter+0x89f/0xb00 block/fops.c:859 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x8ed/0xf90 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 11876 at kernel/stacktrace.c:29 stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29 Modules linked in: CPU: 1 UID: 0 PID: 11876 Comm: udevd Tainted: G W syzkaller #0 PREEMPT(none) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:stack_trace_print+0xd4/0xf0 kernel/stacktrace.c:29 Code: 58 0d c1 91 89 de ba 20 00 00 00 4c 89 e1 e8 b3 90 4b ff 49 83 c6 08 49 ff cd 0f 85 6e ff ff ff eb 0b e8 df 2a c7 00 eb d4 90 <0f> 0b 90 5b 41 5c 41 5d 41 5e 41 5f 5d e9 da a0 b5 0e cc 66 0f 1f RSP: 0018:ffff88812d2eb388 EFLAGS: 00010246 RAX: ffff888056912ca0 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88812d2eb3b0 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88812caeb3c8 R11: ffffffffffff2f30 R12: 0000000000000000 R13: 00000000abcd0100 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fd23c662880(0000) GS:ffff8881aae51000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd23c648000 CR3: 0000000116b10000 CR4: 00000000003526f0 Call Trace: kmsan_print_origin+0xb0/0x340 mm/kmsan/report.c:133 kmsan_report+0x1d3/0x320 mm/kmsan/report.c:196 kmsan_internal_check_memory+0x16c/0x230 mm/kmsan/core.c:297 kmsan_copy_to_user+0xf1/0x190 mm/kmsan/hooks.c:269 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:185 copy_page_to_iter+0x482/0x910 lib/iov_iter.c:362 copy_folio_to_iter include/linux/uio.h:204 [inline] filemap_read+0xcfd/0x2300 mm/filemap.c:2799 blkdev_read_iter+0x89f/0xb00 block/fops.c:859 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x8ed/0xf90 fs/read_write.c:572 ksys_read fs/read_write.c:715 [inline] __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x1fb/0x4d0 fs/read_write.c:722 x64_sys_call+0x2f9c/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd23bea7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffca5f2aee0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fd23c662880 RCX: 00007fd23bea7407 RDX: 0000000000000200 RSI: 00007fd23c647000 RDI: 0000000000000009 RBP: 000055ff44451090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000004000 R14: 000055ff44454b28 R15: 00007fd23c78939c ---[ end trace 0000000000000000 ]--- Uninit was created at: slab_free_hook mm/slub.c:2456 [inline] slab_free mm/slub.c:6619 [inline] kfree+0x254/0x1460 mm/slub.c:6826 ieee80211_inform_bss+0x1415/0x1540 net/mac80211/scan.c:160 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline] cfg80211_inform_single_bss_data+0x1858/0x2870 net/wireless/scan.c:2385 cfg80211_inform_bss_data+0x29b/0x7e60 net/wireless/scan.c:3240 cfg80211_inform_bss_frame_data+0x6cd/0xaa0 net/wireless/scan.c:3331 ieee80211_bss_info_update+0x8aa/0xab0 net/mac80211/scan.c:226 ieee80211_scan_rx+0xa23/0xd70 net/mac80211/scan.c:355 __ieee80211_rx_handle_packet net/mac80211/rx.c:5194 [inline] ieee80211_rx_list+0x4880/0x69e0 net/mac80211/rx.c:5447 ieee80211_rx_napi+0x84/0x400 net/mac80211/rx.c:5470 ieee80211_rx include/net/mac80211.h:5214 [inline] ieee80211_handle_queued_frames+0x14f/0x350 net/mac80211/main.c:453 ieee80211_tasklet_handler+0x25/0x30 net/mac80211/main.c:472 tasklet_action_common+0x362/0xd70 kernel/softirq.c:925 tasklet_action+0x2d/0x40 kernel/softirq.c:953 handle_softirqs+0x169/0x6e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x66/0x180 kernel/softirq.c:723 irq_exit_rcu+0x12/0x20 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1052 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697 Bytes 202-207 of 512 are uninitialized Memory access of size 512 starts at ffff88811a7f1000 Data copied to user address 00007fd23c647000 CPU: 1 UID: 0 PID: 11876 Comm: udevd Tainted: G W syzkaller #0 PREEMPT(none) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 =====================================================