syzbot


KMSAN: uninit-value in dvbdmx_release_ts_feed

Status: upstream: reported C repro on 2026/02/08 01:15
Subsystems: media
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+01d4620886bee3db0e74@syzkaller.appspotmail.com
First crash: 139d, last: 8d04h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
f2bc2fae-c577-43a2-864f-40099455a121 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: uninit-value in dvbdmx_release_ts_feed 2026/05/16 23:08 2026/05/16 23:08 2026/05/16 23:47 de5aae85e5f28e2fa1c7deefcc24fe286abe5140

			
		
Discussions (6)
Title Replies (including bot) Last reply
[syzbot] Monthly media report (Jun 2026) 0 (1) 2026/06/03 04:32
[syzbot] Monthly media report (May 2026) 0 (1) 2026/05/02 20:32
[syzbot] Monthly media report (Apr 2026) 0 (1) 2026/04/01 13:15
[syzbot] Monthly media report (Mar 2026) 2 (3) 2026/03/10 09:57
[syzbot] [media?] KMSAN: uninit-value in dvbdmx_release_ts_feed 1 (4) 2026/02/08 11:09
[PATCH] media: dvb-core: pesfilter shouldn't be set when feed is uninitialized 1 (1) 2026/02/08 09:35
Last patch testing requests (5)
Created Duration User Patch Repo Result
2026/04/30 19:44 40m retest repro upstream report log
2026/04/30 19:44 40m retest repro upstream report log
2026/04/30 19:44 30m retest repro upstream report log
2026/02/08 11:09 29m suunj1331@gmail.com patch upstream OK log
2026/02/08 09:05 29m eadavis@qq.com patch upstream OK log

Sample crash report:
dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff)
=====================================================
BUG: KMSAN: uninit-value in dvbdmx_release_ts_feed+0x198/0x290 drivers/media/dvb-core/dvb_demux.c:858
 dvbdmx_release_ts_feed+0x198/0x290 drivers/media/dvb-core/dvb_demux.c:858
 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:-1 [inline]
 dvb_dmxdev_filter_start+0x1187/0x1af0 drivers/media/dvb-core/dmxdev.c:766
 dvb_dmxdev_pes_filter_set+0x810/0x860 drivers/media/dvb-core/dmxdev.c:963
 dvb_demux_do_ioctl+0x9a3/0xc80 drivers/media/dvb-core/dmxdev.c:1077
 dvb_usercopy+0x263/0x500 drivers/media/dvb-core/dvbdev.c:999
 dvb_demux_ioctl+0x46/0x70 drivers/media/dvb-core/dmxdev.c:1186
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0x23c/0x400 fs/ioctl.c:583
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:583
 x64_sys_call+0x18a7/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_frozen_pages_noprof+0x6df/0xf50 mm/page_alloc.c:5263
 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
 alloc_pages_noprof+0x101/0x280 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3649 [inline]
 __vmalloc_area_node mm/vmalloc.c:3863 [inline]
 __vmalloc_node_range_noprof+0xa97/0x2d80 mm/vmalloc.c:4051
 __vmalloc_node_noprof mm/vmalloc.c:4111 [inline]
 __vmalloc_noprof+0x128/0x1f0 mm/vmalloc.c:4127
 __vmalloc_array_noprof mm/util.c:633 [inline]
 vmalloc_array_noprof+0x48/0x80 mm/util.c:644
 dvb_dmx_init+0x121/0x930 drivers/media/dvb-core/dvb_demux.c:1253
 vidtv_bridge_dmx_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:334 [inline]
 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:441 [inline]
 vidtv_bridge_probe+0x1b1f/0x2690 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508
 platform_probe+0x213/0x370 drivers/base/platform.c:1446
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:661
 __driver_probe_device+0x25e/0x370 drivers/base/dd.c:803
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:833
 __driver_attach+0x53e/0xaa0 drivers/base/dd.c:1227
 bus_for_each_dev+0x33b/0x580 drivers/base/bus.c:383
 driver_attach+0x51/0x70 drivers/base/dd.c:1245
 bus_add_driver+0x54f/0xdb0 drivers/base/bus.c:715
 driver_register+0x42e/0x6a0 drivers/base/driver.c:249
 __platform_driver_register+0x65/0x80 drivers/base/platform.c:908
 vidtv_bridge_init+0x73/0x100 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598
 do_one_initcall+0x22b/0xad0 init/main.c:1378
 do_initcall_level+0x157/0x2e0 init/main.c:1440
 do_initcalls+0x176/0x310 init/main.c:1456
 do_basic_setup+0x1d/0x30 init/main.c:1475
 kernel_init_freeable+0x213/0x430 init/main.c:1688
 kernel_init+0x2f/0x5e0 init/main.c:1578
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 0 UID: 0 PID: 6181 Comm: syz.1.40 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
=====================================================

Crashes (1832):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/07 13:35 upstream 2687c848e578 f20fc9f9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/02/07 12:25 upstream 2687c848e578 f20fc9f9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/02/07 11:01 upstream 2687c848e578 f20fc9f9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/17 18:12 upstream 2b414a95b8f7 62cc6db3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/17 17:23 upstream 2b414a95b8f7 62cc6db3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/17 15:45 upstream 2b414a95b8f7 62cc6db3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/17 02:20 upstream 2b414a95b8f7 0e4b3e40 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/16 04:36 upstream 2b414a95b8f7 50bb0618 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/15 14:52 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/14 19:14 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/14 01:24 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 20:20 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 20:13 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 11:51 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 10:22 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 04:18 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 21:35 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 21:23 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 08:46 upstream 2b414a95b8f7 e93da63e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 08:46 upstream 2b414a95b8f7 e93da63e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/11 19:30 upstream 9716c086c8e8 d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/11 10:26 upstream 9716c086c8e8 b754d2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/11 09:24 upstream 9716c086c8e8 b754d2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/17 21:36 upstream 2b414a95b8f7 62cc6db3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/17 20:28 upstream 2b414a95b8f7 62cc6db3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/17 03:41 upstream 2b414a95b8f7 0e4b3e40 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/16 06:12 upstream 2b414a95b8f7 50bb0618 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/14 13:49 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/14 13:49 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/14 07:27 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/14 00:02 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 22:48 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 22:29 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 21:20 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 17:48 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 15:52 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 13:03 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/13 05:36 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 23:39 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 14:34 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 11:24 upstream 2b414a95b8f7 e93da63e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/12 10:13 upstream 2b414a95b8f7 e93da63e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/11 22:48 upstream 9716c086c8e8 d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/11 21:28 upstream 9716c086c8e8 d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/11 12:23 upstream 9716c086c8e8 b754d2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
2026/06/10 20:23 upstream acb7500801e9 f79bac11 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in dvbdmx_release_ts_feed
* Struck through repros no longer work on HEAD.