* [syzbot] [media?] KMSAN: uninit-value in pctv452e_i2c_msg @ 2025-10-10 4:19 syzbot 2025-10-10 15:21 ` [PATCH] meida: dvb-usb: Optimizing err() output Edward Adam Davis 0 siblings, 1 reply; 6+ messages in thread From: syzbot @ 2025-10-10 4:19 UTC (permalink / raw) To: linux-kernel, linux-media, mchehab, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 9b0d551bcc05 Merge tag 'pull-misc' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14e89a7c580000 kernel config: https://syzkaller.appspot.com/x/.config?x=50fb29d81ff5a3df dashboard link: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/90b0fb888152/disk-9b0d551b.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/1120c646f284/vmlinux-9b0d551b.xz kernel image: https://storage.googleapis.com/syzbot-assets/df9bbfa8cbe6/bzImage-9b0d551b.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com ===================================================== BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220 hex_string+0x681/0x740 lib/vsprintf.c:1220 pointer+0x2c7/0x1bd0 lib/vsprintf.c:2520 vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930 vscnprintf+0x6d/0x120 lib/vsprintf.c:2991 printk_sprint+0x53/0x5c0 kernel/printk/printk.c:2189 vprintk_store+0xbb9/0x1530 kernel/printk/printk.c:2309 vprintk_emit+0x21a/0xb60 kernel/printk/printk.c:2399 vprintk_default+0x3f/0x50 kernel/printk/printk.c:2438 vprintk+0x36/0x50 kernel/printk/printk_safe.c:82 _printk+0x17e/0x1b0 kernel/printk/printk.c:2448 pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467 pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 __i2c_transfer+0xecd/0x3110 drivers/i2c/i2c-core-base.c:-1 i2c_transfer+0x300/0x4b0 drivers/i2c/i2c-core-base.c:2317 i2c_transfer_buffer_flags+0x138/0x200 drivers/i2c/i2c-core-base.c:2345 i2c_master_recv include/linux/i2c.h:79 [inline] i2cdev_read+0x1b2/0x3c0 drivers/i2c/i2c-dev.c:155 vfs_read+0x27c/0xf90 fs/read_write.c:570 ksys_pread64 fs/read_write.c:763 [inline] __do_sys_pread64 fs/read_write.c:771 [inline] __se_sys_pread64 fs/read_write.c:768 [inline] __x64_sys_pread64+0x2ab/0x3b0 fs/read_write.c:768 x64_sys_call+0x3370/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:18 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5245 [inline] __kmalloc_cache_noprof+0x8f5/0x16b0 mm/slub.c:5719 kmalloc_noprof include/linux/slab.h:957 [inline] pctv452e_i2c_msg+0x98/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:425 pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 __i2c_transfer+0xecd/0x3110 drivers/i2c/i2c-core-base.c:-1 i2c_transfer+0x300/0x4b0 drivers/i2c/i2c-core-base.c:2317 i2c_transfer_buffer_flags+0x138/0x200 drivers/i2c/i2c-core-base.c:2345 i2c_master_recv include/linux/i2c.h:79 [inline] i2cdev_read+0x1b2/0x3c0 drivers/i2c/i2c-dev.c:155 vfs_read+0x27c/0xf90 fs/read_write.c:570 ksys_pread64 fs/read_write.c:763 [inline] __do_sys_pread64 fs/read_write.c:771 [inline] __se_sys_pread64 fs/read_write.c:768 [inline] __x64_sys_pread64+0x2ab/0x3b0 fs/read_write.c:768 x64_sys_call+0x3370/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:18 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 10013 Comm: syz.1.697 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 ===================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] meida: dvb-usb: Optimizing err() output 2025-10-10 4:19 [syzbot] [media?] KMSAN: uninit-value in pctv452e_i2c_msg syzbot @ 2025-10-10 15:21 ` Edward Adam Davis 2025-10-14 0:30 ` [PATCH V2] media: " Edward Adam Davis 0 siblings, 1 reply; 6+ messages in thread From: Edward Adam Davis @ 2025-10-10 15:21 UTC (permalink / raw) To: syzbot+480edd2cadb85ddb4bbe Cc: linux-kernel, linux-media, mchehab, syzkaller-bugs syzbot reported a uninit-value in pctv452e_i2c_msg. [1] When the snd_len or rcv_len check fails and jumps to failed, buf is uninitialized, triggering the uninit-value issue. Setting the err() output buf byte count to 0 before jumping to failed before initializing buf and setting it to 7 after initializing buf avoids this warning. [1] BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220 pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467 pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- drivers/media/usb/dvb-usb/pctv452e.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c index 5094de9a312e..3b6e86a8e9ff 100644 --- a/drivers/media/usb/dvb-usb/pctv452e.c +++ b/drivers/media/usb/dvb-usb/pctv452e.c @@ -420,7 +420,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, struct pctv452e_state *state = d->priv; u8 *buf; u8 id; - int ret; + int ret, plen = 0; buf = kmalloc(64, GFP_KERNEL); if (!buf) @@ -432,6 +432,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, if (snd_len > 64 - 7 || rcv_len > 64 - 7) goto failed; + plen = 7; buf[0] = SYNC_BYTE_OUT; buf[1] = id; buf[2] = PCTV_CMD_I2C; @@ -466,7 +467,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, failed: err("I2C error %d; %02X %02X %02X %02X %02X -> %*ph", ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len, - 7, buf); + plen, buf); kfree(buf); return ret; -- 2.43.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH V2] media: dvb-usb: Optimizing err() output 2025-10-10 15:21 ` [PATCH] meida: dvb-usb: Optimizing err() output Edward Adam Davis @ 2025-10-14 0:30 ` Edward Adam Davis 2025-11-03 11:00 ` Hans Verkuil 0 siblings, 1 reply; 6+ messages in thread From: Edward Adam Davis @ 2025-10-14 0:30 UTC (permalink / raw) To: eadavis Cc: linux-kernel, linux-media, mchehab, syzbot+480edd2cadb85ddb4bbe, syzkaller-bugs syzbot reported a uninit-value in pctv452e_i2c_msg. [1] When the snd_len or rcv_len check fails and jumps to failed, buf is uninitialized, triggering the uninit-value issue. Setting the err() output buf byte count to 0 before jumping to failed before initializing buf and setting it to 7 after initializing buf avoids this warning. [1] BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220 pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467 pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- V1 -> V2: subject typos drivers/media/usb/dvb-usb/pctv452e.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c index 5094de9a312e..3b6e86a8e9ff 100644 --- a/drivers/media/usb/dvb-usb/pctv452e.c +++ b/drivers/media/usb/dvb-usb/pctv452e.c @@ -420,7 +420,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, struct pctv452e_state *state = d->priv; u8 *buf; u8 id; - int ret; + int ret, plen = 0; buf = kmalloc(64, GFP_KERNEL); if (!buf) @@ -432,6 +432,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, if (snd_len > 64 - 7 || rcv_len > 64 - 7) goto failed; + plen = 7; buf[0] = SYNC_BYTE_OUT; buf[1] = id; buf[2] = PCTV_CMD_I2C; @@ -466,7 +467,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, failed: err("I2C error %d; %02X %02X %02X %02X %02X -> %*ph", ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len, - 7, buf); + plen, buf); kfree(buf); return ret; -- 2.43.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH V2] media: dvb-usb: Optimizing err() output 2025-10-14 0:30 ` [PATCH V2] media: " Edward Adam Davis @ 2025-11-03 11:00 ` Hans Verkuil 2025-11-03 11:01 ` Hans Verkuil 0 siblings, 1 reply; 6+ messages in thread From: Hans Verkuil @ 2025-11-03 11:00 UTC (permalink / raw) To: Edward Adam Davis Cc: linux-kernel, linux-media, mchehab, syzbot+480edd2cadb85ddb4bbe, syzkaller-bugs On 14/10/2025 02:30, Edward Adam Davis wrote: > syzbot reported a uninit-value in pctv452e_i2c_msg. [1] > > When the snd_len or rcv_len check fails and jumps to failed, buf is > uninitialized, triggering the uninit-value issue. > > Setting the err() output buf byte count to 0 before jumping to failed > before initializing buf and setting it to 7 after initializing buf avoids > this warning. > > [1] > BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220 > pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467 > pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 > > Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > V1 -> V2: subject typos > > drivers/media/usb/dvb-usb/pctv452e.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c > index 5094de9a312e..3b6e86a8e9ff 100644 > --- a/drivers/media/usb/dvb-usb/pctv452e.c > +++ b/drivers/media/usb/dvb-usb/pctv452e.c > @@ -420,7 +420,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, > struct pctv452e_state *state = d->priv; > u8 *buf; > u8 id; > - int ret; > + int ret, plen = 0; Adding a plen variable isn't the right fix... > > buf = kmalloc(64, GFP_KERNEL); > if (!buf) > @@ -432,6 +432,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, > if (snd_len > 64 - 7 || rcv_len > 64 - 7) > goto failed; ...this check should be moved up to before the kmalloc and just return -EINVAL. That also avoids incrementing state->c in that case. Regards, Hans > > + plen = 7; > buf[0] = SYNC_BYTE_OUT; > buf[1] = id; > buf[2] = PCTV_CMD_I2C; > @@ -466,7 +467,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, > failed: > err("I2C error %d; %02X %02X %02X %02X %02X -> %*ph", > ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len, > - 7, buf); > + plen, buf); > > kfree(buf); > return ret; ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH V2] media: dvb-usb: Optimizing err() output 2025-11-03 11:00 ` Hans Verkuil @ 2025-11-03 11:01 ` Hans Verkuil 2025-11-03 11:57 ` [PATCH V3] media: dvb-usb: pctv452e: move snd/rcv len check before kmalloc Edward Adam Davis 0 siblings, 1 reply; 6+ messages in thread From: Hans Verkuil @ 2025-11-03 11:01 UTC (permalink / raw) To: Edward Adam Davis Cc: linux-kernel, linux-media, mchehab, syzbot+480edd2cadb85ddb4bbe, syzkaller-bugs Also fix the Subject line to add "pctv452e:" as prefix. Regards, Hans On 03/11/2025 12:00, Hans Verkuil wrote: > On 14/10/2025 02:30, Edward Adam Davis wrote: >> syzbot reported a uninit-value in pctv452e_i2c_msg. [1] >> >> When the snd_len or rcv_len check fails and jumps to failed, buf is >> uninitialized, triggering the uninit-value issue. >> >> Setting the err() output buf byte count to 0 before jumping to failed >> before initializing buf and setting it to 7 after initializing buf avoids >> this warning. >> >> [1] >> BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220 >> pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467 >> pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 >> >> Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com >> Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe >> Signed-off-by: Edward Adam Davis <eadavis@qq.com> >> --- >> V1 -> V2: subject typos >> >> drivers/media/usb/dvb-usb/pctv452e.c | 5 +++-- >> 1 file changed, 3 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c >> index 5094de9a312e..3b6e86a8e9ff 100644 >> --- a/drivers/media/usb/dvb-usb/pctv452e.c >> +++ b/drivers/media/usb/dvb-usb/pctv452e.c >> @@ -420,7 +420,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, >> struct pctv452e_state *state = d->priv; >> u8 *buf; >> u8 id; >> - int ret; >> + int ret, plen = 0; > > Adding a plen variable isn't the right fix... > >> >> buf = kmalloc(64, GFP_KERNEL); >> if (!buf) >> @@ -432,6 +432,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, >> if (snd_len > 64 - 7 || rcv_len > 64 - 7) >> goto failed; > > ...this check should be moved up to before the kmalloc and just return -EINVAL. > That also avoids incrementing state->c in that case. > > Regards, > > Hans > >> >> + plen = 7; >> buf[0] = SYNC_BYTE_OUT; >> buf[1] = id; >> buf[2] = PCTV_CMD_I2C; >> @@ -466,7 +467,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, >> failed: >> err("I2C error %d; %02X %02X %02X %02X %02X -> %*ph", >> ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len, >> - 7, buf); >> + plen, buf); >> >> kfree(buf); >> return ret; > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH V3] media: dvb-usb: pctv452e: move snd/rcv len check before kmalloc 2025-11-03 11:01 ` Hans Verkuil @ 2025-11-03 11:57 ` Edward Adam Davis 0 siblings, 0 replies; 6+ messages in thread From: Edward Adam Davis @ 2025-11-03 11:57 UTC (permalink / raw) To: hverkuil+cisco Cc: eadavis, linux-kernel, linux-media, mchehab, syzbot+480edd2cadb85ddb4bbe, syzkaller-bugs syzbot reported a uninit-value in pctv452e_i2c_msg. [1] When the snd_len or rcv_len check fails and jumps to failed, buf is uninitialized, triggering the uninit-value issue. Move the snd/rcv length check before kmalloc, and return -EINVAL directly if the condition is met. [1] BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220 pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467 pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- V1 -> V2: subject typos V2 -> V3: move the check before kmalloc drivers/media/usb/dvb-usb/pctv452e.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c index 5094de9a312e..bc7a224d829e 100644 --- a/drivers/media/usb/dvb-usb/pctv452e.c +++ b/drivers/media/usb/dvb-usb/pctv452e.c @@ -422,16 +422,15 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, u8 id; int ret; + if (snd_len > 64 - 7 || rcv_len > 64 - 7) + return -EINVAL; + buf = kmalloc(64, GFP_KERNEL); if (!buf) return -ENOMEM; id = state->c++; - ret = -EINVAL; - if (snd_len > 64 - 7 || rcv_len > 64 - 7) - goto failed; - buf[0] = SYNC_BYTE_OUT; buf[1] = id; buf[2] = PCTV_CMD_I2C; -- 2.43.0 ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-11-03 12:16 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2025-10-10 4:19 [syzbot] [media?] KMSAN: uninit-value in pctv452e_i2c_msg syzbot 2025-10-10 15:21 ` [PATCH] meida: dvb-usb: Optimizing err() output Edward Adam Davis 2025-10-14 0:30 ` [PATCH V2] media: " Edward Adam Davis 2025-11-03 11:00 ` Hans Verkuil 2025-11-03 11:01 ` Hans Verkuil 2025-11-03 11:57 ` [PATCH V3] media: dvb-usb: pctv452e: move snd/rcv len check before kmalloc Edward Adam Davis
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®