* [syzbot] [media?] KMSAN: uninit-value in vidtv_ts_null_write_into
@ 2026-02-15 10:49 syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2026-02-15 10:49 UTC (permalink / raw)
To: dwlsalmeida, linux-kernel, linux-media, mchehab, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: cd7a5651db26 alpha: add missing address argument in call t..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=125b62aa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=50148b563a4d5941
dashboard link: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13e5a6e6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=172c7e5a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/23c623fcb1bf/disk-cd7a5651.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5128bb44f38d/vmlinux-cd7a5651.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a65d6b263e08/bzImage-cd7a5651.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in vidtv_ts_null_write_into+0x43e/0x5c0 drivers/media/test-drivers/vidtv/vidtv_ts.c:62
vidtv_ts_null_write_into+0x43e/0x5c0 drivers/media/test-drivers/vidtv/vidtv_ts.c:62
vidtv_mux_pad_with_nulls drivers/media/test-drivers/vidtv/vidtv_mux.c:366 [inline]
vidtv_mux_tick+0x34b7/0x3e40 drivers/media/test-drivers/vidtv/vidtv_mux.c:411
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xae7/0x1d60 kernel/workqueue.c:3358
worker_thread+0xede/0x1580 kernel/workqueue.c:3439
kthread+0x53f/0x600 kernel/kthread.c:467
ret_from_fork+0x20f/0x910 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Uninit was stored to memory at:
vidtv_ts_null_write_into+0x437/0x5c0 drivers/media/test-drivers/vidtv/vidtv_ts.c:64
vidtv_mux_pad_with_nulls drivers/media/test-drivers/vidtv/vidtv_mux.c:366 [inline]
vidtv_mux_tick+0x34b7/0x3e40 drivers/media/test-drivers/vidtv/vidtv_mux.c:411
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xae7/0x1d60 kernel/workqueue.c:3358
worker_thread+0xede/0x1580 kernel/workqueue.c:3439
kthread+0x53f/0x600 kernel/kthread.c:467
ret_from_fork+0x20f/0x910 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Local variable args.i134 created at:
vidtv_mux_pad_with_nulls drivers/media/test-drivers/vidtv/vidtv_mux.c:351 [inline]
vidtv_mux_tick+0x3150/0x3e40 drivers/media/test-drivers/vidtv/vidtv_mux.c:411
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xae7/0x1d60 kernel/workqueue.c:3358
CPU: 1 UID: 0 PID: 30 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events vidtv_mux_tick
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [media?] KMSAN: uninit-value in vidtv_ts_null_write_into
@ 2026-02-20 22:10 Abd-Alrhman Masalkhi
2026-02-21 2:21 ` syzbot
0 siblings, 1 reply; 3+ messages in thread
From: Abd-Alrhman Masalkhi @ 2026-02-20 22:10 UTC (permalink / raw)
To: syzbot+96f901260a0b2d29cd1a; +Cc: linux-kernel
On Sun, 15 Feb 2026 02:49:27 -0800, Syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: cd7a5651db26 alpha: add missing address argument in call t..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=125b62aa580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=50148b563a4d5941
> dashboard link: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
> compiler: Debian clang version 21.1.8
> (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD >
> 21.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13e5a6e6580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=172c7e5a580000
>
#syz test
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
---
drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +-
drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++++++++++----------
drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +-
3 files changed, 28 insertions(+), 28 deletions(-)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
index f99878eff7ac..7dad97881fdb 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
@@ -233,7 +233,7 @@ static u32 vidtv_mux_push_pcr(struct vidtv_mux *m)
/* the 27Mhz clock will feed both parts of the PCR bitfield */
args.pcr = m->timing.clk;
- nbytes += vidtv_ts_pcr_write_into(args);
+ nbytes += vidtv_ts_pcr_write_into(&args);
m->mux_buf_offset += nbytes;
m->num_streamed_pcr++;
@@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m, u32 npkts)
args.continuity_counter = &ctx->cc;
for (i = 0; i < npkts; ++i) {
- m->mux_buf_offset += vidtv_ts_null_write_into(args);
+ m->mux_buf_offset += vidtv_ts_null_write_into(&args);
args.dest_offset = m->mux_buf_offset;
}
diff --git a/drivers/media/test-drivers/vidtv/vidtv_ts.c b/drivers/media/test-drivers/vidtv/vidtv_ts.c
index ca4bb9c40b78..cbe9aff9ffb5 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_ts.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_ts.c
@@ -48,7 +48,7 @@ void vidtv_ts_inc_cc(u8 *continuity_counter)
*continuity_counter = 0;
}
-u32 vidtv_ts_null_write_into(struct null_packet_write_args args)
+u32 vidtv_ts_null_write_into(const struct null_packet_write_args *args)
{
u32 nbytes = 0;
struct vidtv_mpeg_ts ts_header = {};
@@ -56,21 +56,21 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_args args)
ts_header.sync_byte = TS_SYNC_BYTE;
ts_header.bitfield = cpu_to_be16(TS_NULL_PACKET_PID);
ts_header.payload = 1;
- ts_header.continuity_counter = *args.continuity_counter;
+ ts_header.continuity_counter = *args->continuity_counter;
/* copy TS header */
- nbytes += vidtv_memcpy(args.dest_buf,
- args.dest_offset + nbytes,
- args.buf_sz,
+ nbytes += vidtv_memcpy(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->buf_sz,
&ts_header,
sizeof(ts_header));
- vidtv_ts_inc_cc(args.continuity_counter);
+ vidtv_ts_inc_cc(args->continuity_counter);
/* fill the rest with empty data */
- nbytes += vidtv_memset(args.dest_buf,
- args.dest_offset + nbytes,
- args.buf_sz,
+ nbytes += vidtv_memset(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->buf_sz,
TS_FILL_BYTE,
TS_PACKET_LEN - nbytes);
@@ -83,17 +83,17 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_args args)
return nbytes;
}
-u32 vidtv_ts_pcr_write_into(struct pcr_write_args args)
+u32 vidtv_ts_pcr_write_into(const struct pcr_write_args *args)
{
u32 nbytes = 0;
struct vidtv_mpeg_ts ts_header = {};
struct vidtv_mpeg_ts_adaption ts_adap = {};
ts_header.sync_byte = TS_SYNC_BYTE;
- ts_header.bitfield = cpu_to_be16(args.pid);
+ ts_header.bitfield = cpu_to_be16(args->pid);
ts_header.scrambling = 0;
/* cc is not incremented, but it is needed. see 13818-1 clause 2.4.3.3 */
- ts_header.continuity_counter = *args.continuity_counter;
+ ts_header.continuity_counter = *args->continuity_counter;
ts_header.payload = 0;
ts_header.adaptation_field = 1;
@@ -102,27 +102,27 @@ u32 vidtv_ts_pcr_write_into(struct pcr_write_args args)
ts_adap.PCR = 1;
/* copy TS header */
- nbytes += vidtv_memcpy(args.dest_buf,
- args.dest_offset + nbytes,
- args.buf_sz,
+ nbytes += vidtv_memcpy(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->buf_sz,
&ts_header,
sizeof(ts_header));
/* write the adap after the TS header */
- nbytes += vidtv_memcpy(args.dest_buf,
- args.dest_offset + nbytes,
- args.buf_sz,
+ nbytes += vidtv_memcpy(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->buf_sz,
&ts_adap,
sizeof(ts_adap));
/* write the PCR optional */
- nbytes += vidtv_ts_write_pcr_bits(args.dest_buf,
- args.dest_offset + nbytes,
- args.pcr);
+ nbytes += vidtv_ts_write_pcr_bits(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->pcr);
- nbytes += vidtv_memset(args.dest_buf,
- args.dest_offset + nbytes,
- args.buf_sz,
+ nbytes += vidtv_memset(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->buf_sz,
TS_FILL_BYTE,
TS_PACKET_LEN - nbytes);
diff --git a/drivers/media/test-drivers/vidtv/vidtv_ts.h b/drivers/media/test-drivers/vidtv/vidtv_ts.h
index 09b4ffd02829..3606398e160d 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_ts.h
+++ b/drivers/media/test-drivers/vidtv/vidtv_ts.h
@@ -90,7 +90,7 @@ void vidtv_ts_inc_cc(u8 *continuity_counter);
*
* Return: The number of bytes written into the buffer.
*/
-u32 vidtv_ts_null_write_into(struct null_packet_write_args args);
+u32 vidtv_ts_null_write_into(const struct null_packet_write_args *args);
/**
* vidtv_ts_pcr_write_into - Write a PCR packet into a buffer.
@@ -101,6 +101,6 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_args args);
*
* Return: The number of bytes written into the buffer.
*/
-u32 vidtv_ts_pcr_write_into(struct pcr_write_args args);
+u32 vidtv_ts_pcr_write_into(const struct pcr_write_args *args);
#endif //VIDTV_TS_H
--
--
Best Regards,
Abd-Alrhman
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [syzbot] [media?] KMSAN: uninit-value in vidtv_ts_null_write_into
2026-02-20 22:10 [syzbot] [media?] KMSAN: uninit-value in vidtv_ts_null_write_into Abd-Alrhman Masalkhi
@ 2026-02-21 2:21 ` syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2026-02-21 2:21 UTC (permalink / raw)
To: abd.masalkhi, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com
Tested-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com
Tested on:
commit: d79526b8 Merge tag 'spi-fix-v7.0-merge-window' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1445c55a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e9e76fdaa4072fa5
dashboard link: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1696c55a580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-02-21 2:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-20 22:10 [syzbot] [media?] KMSAN: uninit-value in vidtv_ts_null_write_into Abd-Alrhman Masalkhi
2026-02-21 2:21 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2026-02-15 10:49 syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox