* [PATCH v2] media: dvb-usb-v2: set active_fe before the demux goes live
@ 2026-09-27 6:11 Nguyen Ngoc Thang
0 siblings, 0 replies; 2+ messages in thread
From: Nguyen Ngoc Thang @ 2026-09-27 6:11 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Antti Palosaari
Cc: linux-media, linux-kernel, Nguyen Ngoc Thang,
syzbot+c35815bad054e6ad396e, stable
dvb_usbv2_adapter_dvb_init() registers the demux devices before
dvb_usbv2_adapter_frontend_init() runs. Only the latter set
adap->active_fe to -1, so until then it holds the kzalloc'ed 0 while
adap->fe[0] is still NULL.
A process that opens the demux and starts a filter in that window, which
lasts as long as frontend_attach() takes, gets past the active_fe == -1
check in dvb_usb_start_feed() and passes the NULL adap->fe[0] to
streaming_ctrl() (or get_stream_config()). mxl111sf_ep6_streaming_ctrl()
then dereferences it:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000061
KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f]
RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0
dvb_usb_start_feed+0x57a/0xc70
dmx_ts_feed_start_filtering+0x129/0x220
dvb_dmxdev_filter_start+0x434/0x10d0
dvb_demux_do_ioctl+0x48b/0x540
Initialise active_fe to -1 before the demux is registered so early
feeds fail with -EINVAL.
Reported-by: syzbot+c35815bad054e6ad396e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c35815bad054e6ad396e
Fixes: ad6b9e517b39 ("[media] dvb_usb_v2: move from dvb-usb to dvb-usb-v2")
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
index bd86d250433d..557451b541e6 100644
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -637,7 +637,6 @@ static int dvb_usbv2_adapter_frontend_init(struct dvb_usb_adapter *adap)
dev_dbg(&d->udev->dev, "%s: adap=%d\n", __func__, adap->id);
memset(adap->fe, 0, sizeof(adap->fe));
- adap->active_fe = -1;
if (d->props->frontend_attach) {
ret = d->props->frontend_attach(adap);
@@ -795,6 +794,9 @@ static int dvb_usbv2_adapter_init(struct dvb_usb_device *d)
adap->max_feed_count = adap->props->pid_filter_count;
}
+ /* demux is live before frontends attach: no feed until then */
+ adap->active_fe = -1;
+
ret = dvb_usbv2_adapter_stream_init(adap);
if (ret)
goto err;
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH v2] media: dvb-usb-v2: set active_fe before the demux goes live
2026-09-27 4:45 [PATCH] " Nguyen Ngoc Thang
@ 2026-09-27 6:10 ` Nguyen Ngoc Thang
0 siblings, 0 replies; 2+ messages in thread
From: Nguyen Ngoc Thang @ 2026-09-27 6:10 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Antti Palosaari
Cc: linux-media, linux-kernel, Nguyen Ngoc Thang,
syzbot+c35815bad054e6ad396e, stable
dvb_usbv2_adapter_dvb_init() registers the demux devices before
dvb_usbv2_adapter_frontend_init() runs. Only the latter set
adap->active_fe to -1, so until then it holds the kzalloc'ed 0 while
adap->fe[0] is still NULL.
A process that opens the demux and starts a filter in that window, which
lasts as long as frontend_attach() takes, gets past the active_fe == -1
check in dvb_usb_start_feed() and passes the NULL adap->fe[0] to
streaming_ctrl() (or get_stream_config()). mxl111sf_ep6_streaming_ctrl()
then dereferences it:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000061
KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f]
RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0
dvb_usb_start_feed+0x57a/0xc70
dmx_ts_feed_start_filtering+0x129/0x220
dvb_dmxdev_filter_start+0x434/0x10d0
dvb_demux_do_ioctl+0x48b/0x540
Initialise active_fe to -1 before the demux is registered so early
feeds fail with -EINVAL.
Reported-by: syzbot+c35815bad054e6ad396e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c35815bad054e6ad396e
Fixes: ad6b9e517b39 ("[media] dvb_usb_v2: move from dvb-usb to dvb-usb-v2")
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
index bd86d250433d..557451b541e6 100644
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -637,7 +637,6 @@ static int dvb_usbv2_adapter_frontend_init(struct dvb_usb_adapter *adap)
dev_dbg(&d->udev->dev, "%s: adap=%d\n", __func__, adap->id);
memset(adap->fe, 0, sizeof(adap->fe));
- adap->active_fe = -1;
if (d->props->frontend_attach) {
ret = d->props->frontend_attach(adap);
@@ -795,6 +794,9 @@ static int dvb_usbv2_adapter_init(struct dvb_usb_device *d)
adap->max_feed_count = adap->props->pid_filter_count;
}
+ /* demux is live before frontends attach: no feed until then */
+ adap->active_fe = -1;
+
ret = dvb_usbv2_adapter_stream_init(adap);
if (ret)
goto err;
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-27 6:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-27 6:11 [PATCH v2] media: dvb-usb-v2: set active_fe before the demux goes live Nguyen Ngoc Thang
-- strict thread matches above, loose matches on Subject: below --
2026-09-27 4:45 [PATCH] " Nguyen Ngoc Thang
2026-09-27 6:10 ` [PATCH v2] " Nguyen Ngoc Thang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®