From nobody Fri Apr 17 09:18:11 2026 Received: from mail-wr1-f68.google.com (mail-wr1-f68.google.com [209.85.221.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 676AA137750 for ; Sat, 21 Feb 2026 12:56:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.68 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771678615; cv=none; b=mY1P3p4P6lqb5cZG4/342U4EhfTEdCzlwDrPuSAwNnTQeNv4lVN8X/OLJjUAHjJTe5dCnubSVSjyYJYtXpU8QF8UZrpfHd8JX38umpPHoSliy99kNxnLO4cob5fH21v2LC+e7nUP0JKjqXHYhIuTmEWbcfHHtB5Q830LT7mT/YI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771678615; c=relaxed/simple; bh=YgWjYxq7RXbp0FyYKts73N4C0h4XJlyREAM2Ese+c4k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RSc0kMOjdiClXVvCRzhPdJ3GcafYtUpALDNYTJ569IgWx5dnhlKqf9BUEihZIdrbwO7MFGOS69yMW4KLd2EZnsSD9P7poRTZKpc7jnCOE759CV8oEeqwF42iUl7IfGCeC9Z8jr7DNmubAcIeao07dOv7G4uAhtcmj3avVAPNnCA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ao/MFqem; arc=none smtp.client-ip=209.85.221.68 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ao/MFqem" Received: by mail-wr1-f68.google.com with SMTP id ffacd0b85a97d-43591b55727so2868091f8f.3 for ; Sat, 21 Feb 2026 04:56:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771678613; x=1772283413; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=b8C4N7X0/t/n4R4Lnbl6uwhiS31yaXGWjSbzbzgqD70=; b=ao/MFqemtjmdzNssZdB3rs8SN82Xm/HTNFzpJHHnYSpIEMk3BUFfB8imtpx3eg5sTj ynQgV6awZLQpKGtxDaRDaD5Lsy1aCIlTvrm6GJFv3bLFJtcqCWvixLGBA4SzQa9Ku1o2 pxJ9edNiivdheCOp+jbXTaT/0LB1817cAbxkLsR0d2XrASR+dxzPIcUJV8I7uR9Te42t l48kL4slP+AmBG2uUBDHblPZtmtK7pxzN7EVD/XAMjp0Q4y3+4NgEBIy1CgxTKkTdI+n e3d41EMoYQuNzVSft4uEdyYxmmsCgHOPBavqD7JniKqErvKn1d5d2tvChJZCWtY0+MCF 8gpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771678613; x=1772283413; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=b8C4N7X0/t/n4R4Lnbl6uwhiS31yaXGWjSbzbzgqD70=; b=IkMLkEfyLGWkKgdwJqyRnFNV8yIr3nPFtNa78BKkPRNn5/JDgDQA/9l5nhAVqd6Mj0 D+Xa0SKRN1iOtAYXEvQTrmxzIFZob1B6/SMI4GauagOLyovidM7gDZKnlxo+ylmZ95vt +zHHYI6IhX1tZC0+lx0d/5gznWpDdsNuN2lmIKgc++MZ8UlGGF+VSKHfAp6JXH0JUq4f NHRFBy+k9m1IFquuO29u+TDVrAfo73Drp3TxDyh4sl4R4Ayt/9xgrBIJmoiGNG5otBCx 0609VsCcpKtXNF5HfrakfmIPVX3bYQAUWw/4gvg974Biwg03Su6twNv9TezyrG0LCtiH XPbg== X-Forwarded-Encrypted: i=1; AJvYcCUbH9nmYeEUrKAWhClnQmL8fzQ5tAWEclzMLuNMXyWcuLDGA+e12gqnRvrbCzoz0p+vh32xT7YlYvlHr/Y=@vger.kernel.org X-Gm-Message-State: AOJu0Yyk8+Tc7Vky1TTXPJi6OGWi2Y6FOwlV7bkZLaojjjSPURXrRimW OGHISIx5GOW8a7FfjQPMxIaaqphxau+64ZYk6Wr+UGQX0+KmqauGdQbx X-Gm-Gg: AZuq6aJi713dd79PhthxnFDSPPevLRgOwBd7rCCgc9FDdDm4VKM+C2qKW0G0qbxzX7N HfNUvMUbb76NMluT85mOT0hqPbvNoE0+D6DAf4SdPmN37vFhbKPP4gS6RoPvg6HkXSoJKdXYUAK 6/Fw5MzMPP6geA3Uu/3lOEe1lO00s++KoJfeGGCTDYCR/LNSrZx+MMlEzyA9VIX040OHEcqIvjC kMU+aU3Dsnki/1xcOv0bq/L1HfeWaz6Y6IuwSnuikV6PYv2jVBg6z+XT4sFzSS/gy1QHCgzTlYu 5qWTRpKkHD8g3Cl84ODxqR/y/u01RkMA3oO94gXMj/7rdkAZZ15l6sBFIUie1DJIBzMKUFgtykm IhWuL3Y7VrHH6fGqTePHY1sEDcBKRiccz22SPdMrHkHTLPHCwUnx0xnVRkM+J+m/p1UlFt59KAT hEEChrRC3qljYYaxiIvwSsKKI= X-Received: by 2002:a05:6000:3111:b0:437:6f15:29f0 with SMTP id ffacd0b85a97d-4396f17f44dmr5877675f8f.45.1771678612573; Sat, 21 Feb 2026 04:56:52 -0800 (PST) Received: from masalkhi ([2a02:3037:22e:87e2:d9d5:eb22:70e:7c2e]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43970bf9ff5sm5700039f8f.4.2026.02.21.04.56.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 21 Feb 2026 04:56:51 -0800 (PST) From: Abd-Alrhman Masalkhi To: dwlsalmeida@gmail.com, mchehab@kernel.org, thomas.weissschuh@linutronix.de, dingyihan@uniontech.com Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Abd-Alrhman Masalkhi , syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com Subject: [PATCH v2] media: vidtv: fix pass-by-value structs causing MSAN warnings Date: Sat, 21 Feb 2026 13:56:18 +0100 Message-ID: <20260221125618.133570-1-abd.masalkhi@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their argument structs by value, causing MSAN to report uninit-value warnings. While only vidtv_ts_null_write_into() has triggered a report so far, both functions share the same issue. Fix by passing both structs by const pointer instead, avoiding the stack copy of the struct along with its MSAN shadow and origin metadata. The functions do not modify the structs, which is enforced by the const qualifier. Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver") Reported-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D96f901260a0b2d29cd1a Tested-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com Suggested-by: Yihan Ding Signed-off-by: Abd-Alrhman Masalkhi --- Changes in v2: - Fix the incorrect 'Fixes' tag - Add const qualifier to function parameters - Fix a similar pass-by-value issue in vidtv_ts_pcr_write_into() - Link to v1: https://lore.kernel.org/all/20260216211703.3702-1-abd.masalk= hi@gmail.com/ --- drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++++++++++---------- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- 3 files changed, 28 insertions(+), 28 deletions(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/t= est-drivers/vidtv/vidtv_mux.c index f99878eff7ac..7dad97881fdb 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_mux.c +++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c @@ -233,7 +233,7 @@ static u32 vidtv_mux_push_pcr(struct vidtv_mux *m) /* the 27Mhz clock will feed both parts of the PCR bitfield */ args.pcr =3D m->timing.clk; =20 - nbytes +=3D vidtv_ts_pcr_write_into(args); + nbytes +=3D vidtv_ts_pcr_write_into(&args); m->mux_buf_offset +=3D nbytes; =20 m->num_streamed_pcr++; @@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m= , u32 npkts) args.continuity_counter =3D &ctx->cc; =20 for (i =3D 0; i < npkts; ++i) { - m->mux_buf_offset +=3D vidtv_ts_null_write_into(args); + m->mux_buf_offset +=3D vidtv_ts_null_write_into(&args); args.dest_offset =3D m->mux_buf_offset; } =20 diff --git a/drivers/media/test-drivers/vidtv/vidtv_ts.c b/drivers/media/te= st-drivers/vidtv/vidtv_ts.c index ca4bb9c40b78..cbe9aff9ffb5 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_ts.c +++ b/drivers/media/test-drivers/vidtv/vidtv_ts.c @@ -48,7 +48,7 @@ void vidtv_ts_inc_cc(u8 *continuity_counter) *continuity_counter =3D 0; } =20 -u32 vidtv_ts_null_write_into(struct null_packet_write_args args) +u32 vidtv_ts_null_write_into(const struct null_packet_write_args *args) { u32 nbytes =3D 0; struct vidtv_mpeg_ts ts_header =3D {}; @@ -56,21 +56,21 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_a= rgs args) ts_header.sync_byte =3D TS_SYNC_BYTE; ts_header.bitfield =3D cpu_to_be16(TS_NULL_PACKET_PID); ts_header.payload =3D 1; - ts_header.continuity_counter =3D *args.continuity_counter; + ts_header.continuity_counter =3D *args->continuity_counter; =20 /* copy TS header */ - nbytes +=3D vidtv_memcpy(args.dest_buf, - args.dest_offset + nbytes, - args.buf_sz, + nbytes +=3D vidtv_memcpy(args->dest_buf, + args->dest_offset + nbytes, + args->buf_sz, &ts_header, sizeof(ts_header)); =20 - vidtv_ts_inc_cc(args.continuity_counter); + vidtv_ts_inc_cc(args->continuity_counter); =20 /* fill the rest with empty data */ - nbytes +=3D vidtv_memset(args.dest_buf, - args.dest_offset + nbytes, - args.buf_sz, + nbytes +=3D vidtv_memset(args->dest_buf, + args->dest_offset + nbytes, + args->buf_sz, TS_FILL_BYTE, TS_PACKET_LEN - nbytes); =20 @@ -83,17 +83,17 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_a= rgs args) return nbytes; } =20 -u32 vidtv_ts_pcr_write_into(struct pcr_write_args args) +u32 vidtv_ts_pcr_write_into(const struct pcr_write_args *args) { u32 nbytes =3D 0; struct vidtv_mpeg_ts ts_header =3D {}; struct vidtv_mpeg_ts_adaption ts_adap =3D {}; =20 ts_header.sync_byte =3D TS_SYNC_BYTE; - ts_header.bitfield =3D cpu_to_be16(args.pid); + ts_header.bitfield =3D cpu_to_be16(args->pid); ts_header.scrambling =3D 0; /* cc is not incremented, but it is needed. see 13818-1 clause 2.4.3.3 */ - ts_header.continuity_counter =3D *args.continuity_counter; + ts_header.continuity_counter =3D *args->continuity_counter; ts_header.payload =3D 0; ts_header.adaptation_field =3D 1; =20 @@ -102,27 +102,27 @@ u32 vidtv_ts_pcr_write_into(struct pcr_write_args arg= s) ts_adap.PCR =3D 1; =20 /* copy TS header */ - nbytes +=3D vidtv_memcpy(args.dest_buf, - args.dest_offset + nbytes, - args.buf_sz, + nbytes +=3D vidtv_memcpy(args->dest_buf, + args->dest_offset + nbytes, + args->buf_sz, &ts_header, sizeof(ts_header)); =20 /* write the adap after the TS header */ - nbytes +=3D vidtv_memcpy(args.dest_buf, - args.dest_offset + nbytes, - args.buf_sz, + nbytes +=3D vidtv_memcpy(args->dest_buf, + args->dest_offset + nbytes, + args->buf_sz, &ts_adap, sizeof(ts_adap)); =20 /* write the PCR optional */ - nbytes +=3D vidtv_ts_write_pcr_bits(args.dest_buf, - args.dest_offset + nbytes, - args.pcr); + nbytes +=3D vidtv_ts_write_pcr_bits(args->dest_buf, + args->dest_offset + nbytes, + args->pcr); =20 - nbytes +=3D vidtv_memset(args.dest_buf, - args.dest_offset + nbytes, - args.buf_sz, + nbytes +=3D vidtv_memset(args->dest_buf, + args->dest_offset + nbytes, + args->buf_sz, TS_FILL_BYTE, TS_PACKET_LEN - nbytes); =20 diff --git a/drivers/media/test-drivers/vidtv/vidtv_ts.h b/drivers/media/te= st-drivers/vidtv/vidtv_ts.h index 09b4ffd02829..3606398e160d 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_ts.h +++ b/drivers/media/test-drivers/vidtv/vidtv_ts.h @@ -90,7 +90,7 @@ void vidtv_ts_inc_cc(u8 *continuity_counter); * * Return: The number of bytes written into the buffer. */ -u32 vidtv_ts_null_write_into(struct null_packet_write_args args); +u32 vidtv_ts_null_write_into(const struct null_packet_write_args *args); =20 /** * vidtv_ts_pcr_write_into - Write a PCR packet into a buffer. @@ -101,6 +101,6 @@ u32 vidtv_ts_null_write_into(struct null_packet_write_a= rgs args); * * Return: The number of bytes written into the buffer. */ -u32 vidtv_ts_pcr_write_into(struct pcr_write_args args); +u32 vidtv_ts_pcr_write_into(const struct pcr_write_args *args); =20 #endif //VIDTV_TS_H --=20 2.51.0