Skip to contentSkip to conversation

KMSAN: uninit-value in vidtv_ts_null_write_into

syzbot Abd-Alrhman Masalkhi 2 participants 2 messages Feb 20 – Feb 21

Subsystems (2)
Media (V4L/DVB) Vidtv virtual digital tv driver
lore
Share & tools
lore

Abd-Alrhman Masalkhi

author
#0 lore raw
Quoted 4 lines · Syzbot

Hello,

syzbot found the following issue on:

Quoted 11 lines
HEAD commit:    cd7a5651db26 alpha: add missing address argument in call t..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=125b62aa580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=50148b563a4d5941
dashboard link: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
compiler:       Debian clang version 21.1.8
(++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD >
21.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13e5a6e6580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=172c7e5a580000

#syz test

Signed-off-by Abd-Alrhman Masalkhi <[email protected]>
---
 drivers/media/test-drivers/vidtv/vidtv_mux.c |  4 +-
 drivers/media/test-drivers/vidtv/vidtv_ts.c  | 48 ++++++++++----------
 drivers/media/test-drivers/vidtv/vidtv_ts.h  |  4 +-
 3 files changed, 28 insertions(+), 28 deletions(-)
drivers/media/test-drivers/vidtv/vidtv_mux.c +2 -2
index f99878eff7ac..7dad97881fdb 100644
@@ -233,7 +233,7 @@ static u32 vidtv_mux_push_pcr(struct vidtv_mux *m)
 	/* the 27Mhz clock will feed both parts of the PCR bitfield */
 	args.pcr = m->timing.clk;
 
-	nbytes += vidtv_ts_pcr_write_into(args);
+	nbytes += vidtv_ts_pcr_write_into(&args);
 	m->mux_buf_offset += nbytes;
 
 	m->num_streamed_pcr++;

@@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m, u32 npkts)
 	args.continuity_counter = &ctx->cc;
 
 	for (i = 0; i < npkts; ++i) {
-		m->mux_buf_offset += vidtv_ts_null_write_into(args);
+		m->mux_buf_offset += vidtv_ts_null_write_into(&args);
 		args.dest_offset  = m->mux_buf_offset;
 	}
drivers/media/test-drivers/vidtv/vidtv_ts.c +24 -24

96 lines not on this page · raw message

drivers/media/test-drivers/vidtv/vidtv_ts.h +2 -2
index 09b4ffd02829..3606398e160d 100644
@@ -90,7 +90,7 @@ void vidtv_ts_inc_cc(u8 *continuity_counter);
  *
  * Return: The number of bytes written into the buffer.
  */
-u32 vidtv_ts_null_write_into(struct null_packet_write_args args);
+u32 vidtv_ts_null_write_into(const struct null_packet_write_args *args);
 
 /**
  * vidtv_ts_pcr_write_into - Write a PCR  packet into a buffer.

@@ -101,6 +101,6 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_args args);
  *
  * Return: The number of bytes written into the buffer.
  */
-u32 vidtv_ts_pcr_write_into(struct pcr_write_args args);
+u32 vidtv_ts_pcr_write_into(const struct pcr_write_args *args);
 
 #endif //VIDTV_TS_H

--

Signature · 2 lines
Best Regards,
Abd-Alrhman
syzbot Tested-by
#1 lore raw
syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by [email protected]
Tested-by [email protected]

Tested on:

commit:         d79526b8 Merge tag 'spi-fix-v7.0-merge-window' of git:..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1445c55a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e9e76fdaa4072fa5
dashboard link: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1696c55a580000

Note: testing is done by a robot and is best-effort only.