syzbot


KMSAN: uninit-value in dvbdmx_release_ts_feed

Status: upstream: reported C repro on 2026/02/08 01:15
Subsystems: media
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+01d4620886bee3db0e74@syzkaller.appspotmail.com
First crash: 120d, last: 32m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
f2bc2fae-c577-43a2-864f-40099455a121 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: uninit-value in dvbdmx_release_ts_feed 2026/05/16 23:08 2026/05/16 23:08 2026/05/16 23:47 de5aae85e5f28e2fa1c7deefcc24fe286abe5140
Discussions (6)
Title Replies (including bot) Last reply
[syzbot] Monthly media report (Jun 2026) 0 (1) 2026/06/03 04:32
[syzbot] Monthly media report (May 2026) 0 (1) 2026/05/02 20:32
[syzbot] Monthly media report (Apr 2026) 0 (1) 2026/04/01 13:15
[syzbot] Monthly media report (Mar 2026) 2 (3) 2026/03/10 09:57
[syzbot] [media?] KMSAN: uninit-value in dvbdmx_release_ts_feed 1 (4) 2026/02/08 11:09
[PATCH] media: dvb-core: pesfilter shouldn't be set when feed is uninitialized 1 (1) 2026/02/08 09:35
Last patch testing requests (5)
Created Duration User Patch Repo Result
2026/04/30 19:44 40m retest repro upstream report log
2026/04/30 19:44 40m retest repro upstream report log
2026/04/30 19:44 30m retest repro upstream report log
2026/02/08 11:09 29m suunj1331@gmail.com patch upstream OK log
2026/02/08 09:05 29m eadavis@qq.com patch upstream OK log

Sample crash report:
dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff)
=====================================================
BUG: KMSAN: uninit-value in dvbdmx_release_ts_feed+0x198/0x290 drivers/media/dvb-core/dvb_demux.c:858
 dvbdmx_release_ts_feed+0x198/0x290 drivers/media/dvb-core/dvb_demux.c:858
 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:-1 [inline]
 dvb_dmxdev_filter_start+0x1187/0x1af0 drivers/media/dvb-core/dmxdev.c:766
 dvb_dmxdev_pes_filter_set+0x810/0x860 drivers/media/dvb-core/dmxdev.c:963
 dvb_demux_do_ioctl+0x9a3/0xc80 drivers/media/dvb-core/dmxdev.c:1077
 dvb_usercopy+0x263/0x500 drivers/media/dvb-core/dvbdev.c:999
 dvb_demux_ioctl+0x46/0x70 drivers/media/dvb-core/dmxdev.c:1186
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0x23c/0x400 fs/ioctl.c:583
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:583
 x64_sys_call+0x18a7/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_frozen_pages_noprof+0x6df/0xf50 mm/page_alloc.c:5263
 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
 alloc_pages_noprof+0x101/0x280 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
 __vmalloc_area_node mm/vmalloc.c:3863 [inline]
 __vmalloc_node_range_noprof+0xa97/0x2d80 mm/vmalloc.c:4051
 __vmalloc_node_noprof mm/vmalloc.c:4111 [inline]
 __vmalloc_noprof+0x128/0x1f0 mm/vmalloc.c:4127
 __vmalloc_array_noprof mm/util.c:633 [inline]
 vmalloc_array_noprof+0x48/0x80 mm/util.c:644
 dvb_dmx_init+0x121/0x930 drivers/media/dvb-core/dvb_demux.c:1253
 vidtv_bridge_dmx_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:334 [inline]
 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:441 [inline]
 vidtv_bridge_probe+0x1b1f/0x2690 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508
 platform_probe+0x213/0x370 drivers/base/platform.c:1446
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:661
 __driver_probe_device+0x25e/0x370 drivers/base/dd.c:803
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:833
 __driver_attach+0x53e/0xaa0 drivers/base/dd.c:1227
 bus_for_each_dev+0x33b/0x580 drivers/base/bus.c:383
 driver_attach+0x51/0x70 drivers/base/dd.c:1245
 bus_add_driver+0x54f/0xdb0 drivers/base/bus.c:715
 driver_register+0x42e/0x6a0 drivers/base/driver.c:249
 __platform_driver_register+0x65/0x80 drivers/base/platform.c:908
 vidtv_bridge_init+0x73/0x100 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598
 do_one_initcall+0x22b/0xad0 init/main.c:1378
 do_initcall_level+0x157/0x2e0 init/main.c:1440
 do_initcalls+0x176/0x310 init/main.c:1456
 do_basic_setup+0x1d/0x30 init/main.c:1475
 kernel_init_freeable+0x213/0x430 init/main.c:1688
 kernel_init+0x2f/0x5e0 init/main.c:1578
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 0 UID: 0 PID: 6181 Comm: syz.1.40 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
=====================================================

Crashes (1644):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/07 13:35 upstream 2687c848e578 f20fc9f9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/02/07 12:25 upstream 2687c848e578 f20fc9f9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/02/07 11:01 upstream 2687c848e578 f20fc9f9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/07 17:09 upstream 979c294509f9 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/07 15:57 upstream 979c294509f9 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/07 00:52 upstream 8e65320d91cd cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/06 22:07 upstream 8e65320d91cd cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/06 19:17 upstream 8e65320d91cd cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/06 15:58 upstream c10130c234c8 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/06 14:49 upstream c10130c234c8 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/06 13:58 upstream c10130c234c8 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/06 07:54 upstream c10130c234c8 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/06 05:17 upstream c10130c234c8 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/05 23:37 upstream ddd664bbff63 48b6c3fa .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/05 19:46 upstream ddd664bbff63 48b6c3fa .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/04 13:05 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/04 09:05 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/04 03:40 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/03 22:23 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/02 22:10 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/02 22:09 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/01 19:39 upstream e43ffb69e043 8d8eeb3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/01 18:18 upstream e43ffb69e043 8d8eeb3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/01 03:54 upstream 8d9c51eac648 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/31 15:22 upstream 174914ea5513 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/31 06:14 upstream 670b77dfebe7 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/31 04:04 upstream 670b77dfebe7 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/30 23:44 upstream 670b77dfebe7 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/30 22:20 upstream 670b77dfebe7 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/30 15:09 upstream 9215e74f228f 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/30 07:59 upstream 9215e74f228f 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/29 21:19 upstream 8fde5d1d47f6 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/29 11:21 upstream 8fde5d1d47f6 4624854e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/07 15:13 upstream 979c294509f9 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/05 05:48 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/04 16:17 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/04 16:16 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/04 07:31 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/03 19:25 upstream 6f3ed7fec72f 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/01 20:43 upstream e43ffb69e043 8d8eeb3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/01 06:50 upstream 8d9c51eac648 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/31 09:22 upstream 174914ea5513 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/31 02:16 upstream f5e5d3509bff 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/31 01:14 upstream f5e5d3509bff 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/30 21:46 upstream f5e5d3509bff 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/30 10:49 upstream 9215e74f228f 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/05/30 09:30 upstream 9215e74f228f 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
* Struck through repros no longer work on HEAD.