* [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
@ 2026-05-10 16:24 Moksh Panicker
2026-05-10 16:29 ` [PATCH v2] " Moksh Panicker
0 siblings, 1 reply; 5+ messages in thread
From: Moksh Panicker @ 2026-05-10 16:24 UTC (permalink / raw)
To: linux-media; +Cc: mchehab, Moksh Panicker
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 870ac3c8b085..9908675c355e 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
+ if (!d)
+ return -ENODEV;
+
if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH v2] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
2026-05-10 16:24 [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg Moksh Panicker
@ 2026-05-10 16:29 ` Moksh Panicker
2026-05-10 16:29 ` syzbot
2026-05-10 17:24 ` [PATCH v3] " Moksh Panicker
0 siblings, 2 replies; 5+ messages in thread
From: Moksh Panicker @ 2026-05-10 16:29 UTC (permalink / raw)
To: linux-media; +Cc: mchehab, Moksh Panicker, syzbot+f9f333782a8f54509322
When mxl111sf_ctrl_msg() is called during early probe, state->d
may not yet be initialized, causing a null pointer dereference in
dvb_usbv2_generic_write() when it accesses d->usb_mutex.
Add a null check for d before proceeding with the USB transfer.
Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
Reported-by: syzbot+f9f333782a8f54509322@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f9f333782a8f54509322
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 870ac3c8b085..9908675c355e 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
+ if (!d)
+ return -ENODEV;
+
if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
2026-05-10 16:29 ` [PATCH v2] " Moksh Panicker
@ 2026-05-10 16:29 ` syzbot
2026-05-10 17:24 ` [PATCH v3] " Moksh Panicker
1 sibling, 0 replies; 5+ messages in thread
From: syzbot @ 2026-05-10 16:29 UTC (permalink / raw)
To: mokshpanicker.7; +Cc: linux-media, mchehab, mokshpanicker.7
> When mxl111sf_ctrl_msg() is called during early probe, state->d
> may not yet be initialized, causing a null pointer dereference in
> dvb_usbv2_generic_write() when it accesses d->usb_mutex.
>
> Add a null check for d before proceeding with the USB transfer.
>
> Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
> Reported-by: syzbot+f9f333782a8f54509322@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=f9f333782a8f54509322
> Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
> ---
> drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
> index 870ac3c8b085..9908675c355e 100644
> --- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
> +++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
> @@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
> int wo = (rbuf == NULL || rlen == 0); /* write-only */
> int ret;
>
> + if (!d)
> + return -ENODEV;
> +
> if (1 + wlen > MXL_MAX_XFER_SIZE) {
> pr_warn("%s: len=%d is too big!\n", __func__, wlen);
> return -EOPNOTSUPP;
> --
> 2.34.1
>
I see the command but can't find the corresponding bug.
The email is sent to syzbot+HASH@syzkaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v3] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
2026-05-10 16:29 ` [PATCH v2] " Moksh Panicker
2026-05-10 16:29 ` syzbot
@ 2026-05-10 17:24 ` Moksh Panicker
2026-05-11 10:13 ` [PATCH v4] " Moksh Panicker
1 sibling, 1 reply; 5+ messages in thread
From: Moksh Panicker @ 2026-05-10 17:24 UTC (permalink / raw)
To: linux-media; +Cc: mchehab, Moksh Panicker
When mxl111sf_ctrl_msg() is called during early probe, state->d
may not yet be initialized, causing a null pointer dereference in
dvb_usbv2_generic_write() when it accesses d->usb_mutex.
Add a null check for d before proceeding with the USB transfer.
Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 870ac3c8b085..9908675c355e 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
+ if (!d)
+ return -ENODEV;
+
if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH v4] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
2026-05-10 17:24 ` [PATCH v3] " Moksh Panicker
@ 2026-05-11 10:13 ` Moksh Panicker
0 siblings, 0 replies; 5+ messages in thread
From: Moksh Panicker @ 2026-05-11 10:13 UTC (permalink / raw)
To: linux-media; +Cc: mchehab, Moksh Panicker
When mxl111sf_ctrl_msg() is called during early probe, state->d
may not yet be initialized, causing a null pointer dereference in
dvb_usbv2_generic_write() when it accesses d->usb_mutex.
Add a null check for d before proceeding with the USB transfer.
Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 870ac3c8b085..9908675c355e 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
+ if (!d)
+ return -ENODEV;
+
if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-05-11 10:13 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-10 16:24 [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg Moksh Panicker
2026-05-10 16:29 ` [PATCH v2] " Moksh Panicker
2026-05-10 16:29 ` syzbot
2026-05-10 17:24 ` [PATCH v3] " Moksh Panicker
2026-05-11 10:13 ` [PATCH v4] " Moksh Panicker
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox