drivers/media/test-drivers/vidtv/vidtv_mux.c | 2 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 18 +++++++++--------- drivers/media/test-drivers/vidtv/vidtv_ts.h | 2 +- 3 files changed, 11 insertions(+), 11 deletions(-)
vidtv_ts_null_write_into() takes null_packet_write_args by value,
causing MSAN to report an uninit-value warning on buf_sz inside
the function.
Fix by passing the struct by pointer instead, avoiding the stack copy
entirely.
Reported-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
Fixes: cd7a5651db26 ("alpha: add missing address argument in call to page_table_check_pte_clear()")
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
---
drivers/media/test-drivers/vidtv/vidtv_mux.c | 2 +-
drivers/media/test-drivers/vidtv/vidtv_ts.c | 18 +++++++++---------
drivers/media/test-drivers/vidtv/vidtv_ts.h | 2 +-
3 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
index f99878eff7ac..67a580396112 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
@@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m, u32 npkts)
args.continuity_counter = &ctx->cc;
for (i = 0; i < npkts; ++i) {
- m->mux_buf_offset += vidtv_ts_null_write_into(args);
+ m->mux_buf_offset += vidtv_ts_null_write_into(&args);
args.dest_offset = m->mux_buf_offset;
}
diff --git a/drivers/media/test-drivers/vidtv/vidtv_ts.c b/drivers/media/test-drivers/vidtv/vidtv_ts.c
index ca4bb9c40b78..7e6e92503fb8 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_ts.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_ts.c
@@ -48,7 +48,7 @@ void vidtv_ts_inc_cc(u8 *continuity_counter)
*continuity_counter = 0;
}
-u32 vidtv_ts_null_write_into(struct null_packet_write_args args)
+u32 vidtv_ts_null_write_into(struct null_packet_write_args *args)
{
u32 nbytes = 0;
struct vidtv_mpeg_ts ts_header = {};
@@ -56,21 +56,21 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_args args)
ts_header.sync_byte = TS_SYNC_BYTE;
ts_header.bitfield = cpu_to_be16(TS_NULL_PACKET_PID);
ts_header.payload = 1;
- ts_header.continuity_counter = *args.continuity_counter;
+ ts_header.continuity_counter = *args->continuity_counter;
/* copy TS header */
- nbytes += vidtv_memcpy(args.dest_buf,
- args.dest_offset + nbytes,
- args.buf_sz,
+ nbytes += vidtv_memcpy(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->buf_sz,
&ts_header,
sizeof(ts_header));
- vidtv_ts_inc_cc(args.continuity_counter);
+ vidtv_ts_inc_cc(args->continuity_counter);
/* fill the rest with empty data */
- nbytes += vidtv_memset(args.dest_buf,
- args.dest_offset + nbytes,
- args.buf_sz,
+ nbytes += vidtv_memset(args->dest_buf,
+ args->dest_offset + nbytes,
+ args->buf_sz,
TS_FILL_BYTE,
TS_PACKET_LEN - nbytes);
diff --git a/drivers/media/test-drivers/vidtv/vidtv_ts.h b/drivers/media/test-drivers/vidtv/vidtv_ts.h
index 09b4ffd02829..28da15dcc697 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_ts.h
+++ b/drivers/media/test-drivers/vidtv/vidtv_ts.h
@@ -90,7 +90,7 @@ void vidtv_ts_inc_cc(u8 *continuity_counter);
*
* Return: The number of bytes written into the buffer.
*/
-u32 vidtv_ts_null_write_into(struct null_packet_write_args args);
+u32 vidtv_ts_null_write_into(struct null_packet_write_args *args);
/**
* vidtv_ts_pcr_write_into - Write a PCR packet into a buffer.
--
2.43.0Hi Abd-Alrhman!
On Mon, Feb 16, 2026 at 10:17:03PM +0100, Abd-Alrhman Masalkhi wrote:
> vidtv_ts_null_write_into() takes null_packet_write_args by value,
> causing MSAN to report an uninit-value warning on buf_sz inside
> the function.
>
> Fix by passing the struct by pointer instead, avoiding the stack copy
> entirely.
>
> Reported-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
> Fixes: cd7a5651db26 ("alpha: add missing address argument in call to page_table_check_pte_clear()")
The Fixes tag should point to the commit which originally introduced
the issue that is being fixed. My commit for alpha-specific code is
unlikely to be the root cause because a) syscaller is not running alpha
systems and b) the first occurrence of the syscaller was before my patch
was picked up by Linus. So please try to find a better Fixes tag.
> Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
> ---
> drivers/media/test-drivers/vidtv/vidtv_mux.c | 2 +-
> drivers/media/test-drivers/vidtv/vidtv_ts.c | 18 +++++++++---------
> drivers/media/test-drivers/vidtv/vidtv_ts.h | 2 +-
> 3 files changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
> index f99878eff7ac..67a580396112 100644
> --- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
> +++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
> @@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m, u32 npkts)
> args.continuity_counter = &ctx->cc;
>
> for (i = 0; i < npkts; ++i) {
> - m->mux_buf_offset += vidtv_ts_null_write_into(args);
> + m->mux_buf_offset += vidtv_ts_null_write_into(&args);
Please explain in the commit message why this is change is safe to do.
Modifying shared data might break the logic. (I have not verified this)
> args.dest_offset = m->mux_buf_offset;
> }
(...)
Did have syscaller test this patch before submission?
See the following documentation from the report:
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Thomas
On Wed, Feb 18, 2026 at 14:24 +0100, Thomas Weißschuh wrote:
Hi Thomas,
Thank you for the feedback.
> Hi Abd-Alrhman!
>
> On Mon, Feb 16, 2026 at 10:17:03PM +0100, Abd-Alrhman Masalkhi wrote:
>> vidtv_ts_null_write_into() takes null_packet_write_args by value,
>> causing MSAN to report an uninit-value warning on buf_sz inside
>> the function.
>>
>> Fix by passing the struct by pointer instead, avoiding the stack copy
>> entirely.
>>
>> Reported-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
>> Fixes: cd7a5651db26 ("alpha: add missing address argument in call to page_table_check_pte_clear()")
>
> The Fixes tag should point to the commit which originally introduced
> the issue that is being fixed. My commit for alpha-specific code is
> unlikely to be the root cause because a) syscaller is not running alpha
> systems and b) the first occurrence of the syscaller was before my patch
> was picked up by Linus. So please try to find a better Fixes tag.
>
I will fix the Fixes tag to point to the correct vidtv commit.
>> Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
>> ---
>> drivers/media/test-drivers/vidtv/vidtv_mux.c | 2 +-
>> drivers/media/test-drivers/vidtv/vidtv_ts.c | 18 +++++++++---------
>> drivers/media/test-drivers/vidtv/vidtv_ts.h | 2 +-
>> 3 files changed, 11 insertions(+), 11 deletions(-)
>>
>> diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
>> index f99878eff7ac..67a580396112 100644
>> --- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
>> +++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
>> @@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m, u32 npkts)
>> args.continuity_counter = &ctx->cc;
>>
>> for (i = 0; i < npkts; ++i) {
>> - m->mux_buf_offset += vidtv_ts_null_write_into(args);
>> + m->mux_buf_offset += vidtv_ts_null_write_into(&args);
>
> Please explain in the commit message why this is change is safe to do.
> Modifying shared data might break the logic. (I have not verified this)
>
vidtv_ts_null_write_into() only reads from the struct and does not
modify it. should I add a const qualifier to the parameter?
>> args.dest_offset = m->mux_buf_offset;
>> }
>
> (...)
>
> Did have syscaller test this patch before submission?
> See the following documentation from the report:
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
I will test with syzbot before sending v2.
>
> Thomas
--
Best Regards,
Abd-Alrhman
© 2016 - 2026 Red Hat, Inc.