Re: [PATCH] media: vidtv: fix uninitialized args.buf_sz passed by value

[Thomas Weißschuh]

Hi Abd-Alrhman!

On Mon, Feb 16, 2026 at 10:17:03PM +0100, Abd-Alrhman Masalkhi wrote:
> vidtv_ts_null_write_into() takes null_packet_write_args by value,
> causing MSAN to report an uninit-value warning on buf_sz inside
> the function.
> 
> Fix by passing the struct by pointer instead, avoiding the stack copy
> entirely.
> 
> Reported-by: syzbot+96f901260a0b2d29cd1a@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
> Fixes: cd7a5651db26 ("alpha: add missing address argument in call to page_table_check_pte_clear()")

The Fixes tag should point to the commit which originally introduced
the issue that is being fixed. My commit for alpha-specific code is
unlikely to be the root cause because a) syscaller is not running alpha
systems and b) the first occurrence of the syscaller was before my patch
was picked up by Linus. So please try to find a better Fixes tag.

> Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@xxxxxxxxx>
> ---
>  drivers/media/test-drivers/vidtv/vidtv_mux.c |  2 +-
>  drivers/media/test-drivers/vidtv/vidtv_ts.c  | 18 +++++++++---------
>  drivers/media/test-drivers/vidtv/vidtv_ts.h  |  2 +-
>  3 files changed, 11 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
> index f99878eff7ac..67a580396112 100644
> --- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
> +++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
> @@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m, u32 npkts)
>  	args.continuity_counter = &ctx->cc;
>  
>  	for (i = 0; i < npkts; ++i) {
> -		m->mux_buf_offset += vidtv_ts_null_write_into(args);
> +		m->mux_buf_offset += vidtv_ts_null_write_into(&args);

Please explain in the commit message why this is change is safe to do.
Modifying shared data might break the logic. (I have not verified this)

>  		args.dest_offset  = m->mux_buf_offset;
>  	}

(...)

Did have syscaller test this patch before submission?
See the following documentation from the report:

	If you want syzbot to run the reproducer, reply with:
	#syz test: git://repo/address.git branch-or-commit-hash
	If you attach or paste a git patch, syzbot will apply it before testing.


Thomas