===================================================== BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:30 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:302 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:330 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:197 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0xef3/0x33f0 lib/iov_iter.c:197 copy_to_iter include/linux/uio.h:220 [inline] simple_copy_to_iter net/core/datagram.c:521 [inline] __skb_datagram_iter+0x196/0x12c0 net/core/datagram.c:402 skb_copy_datagram_iter+0x5b/0x1e0 net/core/datagram.c:535 skb_copy_datagram_msg include/linux/skbuff.h:4217 [inline] netlink_recvmsg+0x4bb/0xfe0 net/netlink/af_netlink.c:1951 sock_recvmsg_nosec net/socket.c:1078 [inline] sock_recvmsg+0x2df/0x390 net/socket.c:1100 __sys_recvfrom+0x282/0x550 net/socket.c:2256 __do_sys_recvfrom net/socket.c:2271 [inline] __se_sys_recvfrom net/socket.c:2267 [inline] __x64_sys_recvfrom+0x130/0x200 net/socket.c:2267 x64_sys_call+0x3227/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:46 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: pskb_expand_head+0x310/0x15d0 net/core/skbuff.c:2290 netlink_trim+0x3a3/0x450 net/netlink/af_netlink.c:1299 netlink_broadcast_filtered+0x80/0x28f0 net/netlink/af_netlink.c:1512 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline] nlmsg_multicast include/net/netlink.h:1184 [inline] nlmsg_notify+0x15b/0x2f0 net/netlink/af_netlink.c:2593 rtnetlink_send+0x73/0xa0 net/core/rtnetlink.c:942 tc_chain_notify_delete net/sched/cls_api.c:3052 [inline] __tcf_chain_put+0x50b/0xd40 net/sched/cls_api.c:717 tcf_chain_put net/sched/cls_api.c:735 [inline] tcf_get_next_chain net/sched/cls_api.c:1102 [inline] tcf_block_flush_all_chains net/sched/cls_api.c:1170 [inline] __tcf_block_put+0xa96/0xc80 net/sched/cls_api.c:1334 tcf_block_put_ext+0x516/0x6e0 net/sched/cls_api.c:1562 clsact_destroy+0x177/0xd80 net/sched/sch_ingress.c:302 __qdisc_destroy+0xe2/0x410 net/sched/sch_generic.c:1077 qdisc_put net/sched/sch_generic.c:1105 [inline] shutdown_scheduler_queue net/sched/sch_generic.c:1158 [inline] dev_shutdown+0x4e3/0x840 net/sched/sch_generic.c:1492 unregister_netdevice_many_notify+0x203a/0x4c20 net/core/dev.c:12369 rtnl_delete_link net/core/rtnetlink.c:3528 [inline] rtnl_dellink+0x86b/0x13f0 net/core/rtnetlink.c:3570 rtnetlink_rcv_msg+0x106f/0x14b0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x54d/0x680 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6985 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x333/0x3d0 net/socket.c:742 ____sys_sendmsg+0x7f5/0xcf0 net/socket.c:2592 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681 x64_sys_call+0x1c60/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] __do_kmalloc_node mm/slub.c:5656 [inline] __kmalloc_node_track_caller_noprof+0xb77/0x1c90 mm/slub.c:5764 kmalloc_reserve+0x22f/0x4b0 net/core/skbuff.c:608 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] tc_chain_notify_delete net/sched/cls_api.c:3042 [inline] __tcf_chain_put+0x3aa/0xd40 net/sched/cls_api.c:717 tcf_chain_put net/sched/cls_api.c:735 [inline] tcf_get_next_chain net/sched/cls_api.c:1102 [inline] tcf_block_flush_all_chains net/sched/cls_api.c:1170 [inline] __tcf_block_put+0xa96/0xc80 net/sched/cls_api.c:1334 tcf_block_put_ext+0x516/0x6e0 net/sched/cls_api.c:1562 clsact_destroy+0x177/0xd80 net/sched/sch_ingress.c:302 __qdisc_destroy+0xe2/0x410 net/sched/sch_generic.c:1077 qdisc_put net/sched/sch_generic.c:1105 [inline] shutdown_scheduler_queue net/sched/sch_generic.c:1158 [inline] dev_shutdown+0x4e3/0x840 net/sched/sch_generic.c:1492 unregister_netdevice_many_notify+0x203a/0x4c20 net/core/dev.c:12369 rtnl_delete_link net/core/rtnetlink.c:3528 [inline] rtnl_dellink+0x86b/0x13f0 net/core/rtnetlink.c:3570 rtnetlink_rcv_msg+0x106f/0x14b0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x54d/0x680 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6985 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x333/0x3d0 net/socket.c:742 ____sys_sendmsg+0x7f5/0xcf0 net/socket.c:2592 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681 x64_sys_call+0x1c60/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 32-35 of 76 are uninitialized Memory access of size 76 starts at ffff888025cc5b80 Data copied to user address 00007f1e6539d010 CPU: 0 UID: 0 PID: 9921 Comm: syz.9.1075 Tainted: G W syzkaller #0 PREEMPT(none) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 =====================================================