Re: [PATCH] media: vidtv: fix uninitialized args.buf_sz passed by value

[Abd-Alrhman Masalkhi]

On Wed, Feb 18, 2026 at 14:24 +0100, Thomas Weißschuh wrote:

Hi Thomas,

Thank you for the feedback.

> Hi Abd-Alrhman!
>
> On Mon, Feb 16, 2026 at 10:17:03PM +0100, Abd-Alrhman Masalkhi wrote:
>> vidtv_ts_null_write_into() takes null_packet_write_args by value,
>> causing MSAN to report an uninit-value warning on buf_sz inside
>> the function.
>> 
>> Fix by passing the struct by pointer instead, avoiding the stack copy
>> entirely.
>> 
>> Reported-by: syzbot+96f901260a0b2d29cd1a@xxxxxxxxxxxxxxxxxxxxxxxxx
>> Closes: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a
>> Fixes: cd7a5651db26 ("alpha: add missing address argument in call to page_table_check_pte_clear()")
>
> The Fixes tag should point to the commit which originally introduced
> the issue that is being fixed. My commit for alpha-specific code is
> unlikely to be the root cause because a) syscaller is not running alpha
> systems and b) the first occurrence of the syscaller was before my patch
> was picked up by Linus. So please try to find a better Fixes tag.
>
I will fix the Fixes tag to point to the correct vidtv commit.

>> Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@xxxxxxxxx>
>> ---
>>  drivers/media/test-drivers/vidtv/vidtv_mux.c |  2 +-
>>  drivers/media/test-drivers/vidtv/vidtv_ts.c  | 18 +++++++++---------
>>  drivers/media/test-drivers/vidtv/vidtv_ts.h  |  2 +-
>>  3 files changed, 11 insertions(+), 11 deletions(-)
>> 
>> diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
>> index f99878eff7ac..67a580396112 100644
>> --- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
>> +++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
>> @@ -363,7 +363,7 @@ static u32 vidtv_mux_pad_with_nulls(struct vidtv_mux *m, u32 npkts)
>>  	args.continuity_counter = &ctx->cc;
>>  
>>  	for (i = 0; i < npkts; ++i) {
>> -		m->mux_buf_offset += vidtv_ts_null_write_into(args);
>> +		m->mux_buf_offset += vidtv_ts_null_write_into(&args);
>
> Please explain in the commit message why this is change is safe to do.
> Modifying shared data might break the logic. (I have not verified this)
>
vidtv_ts_null_write_into() only reads from the struct and does not
modify it. should I add a const qualifier to the parameter? 

>>  		args.dest_offset  = m->mux_buf_offset;
>>  	}
>
> (...)
>
> Did have syscaller test this patch before submission?
> See the following documentation from the report:
>
> 	If you want syzbot to run the reproducer, reply with:
> 	#syz test: git://repo/address.git branch-or-commit-hash
> 	If you attach or paste a git patch, syzbot will apply it before testing.
>
I will test with syzbot before sending v2.

>
> Thomas

-- 
Best Regards,
Abd-Alrhman