Dear Linux Developers for DVB, We encountered "WARNING in vb2_core_reqbufs" when testing the DVB driver with Syzkaller and our generated specifications. It seems that when invoking `ioctl$DMX_REQBUFS`, it will fail the following WARN_ON in https://elixir.bootlin.com/linux/v6.12-rc2/source/drivers/media/common/videobuf2/videobuf2-core.c#L956 ``` for (i = 0; i < num_planes; i++) if (WARN_ON(!plane_sizes[i])) { ret = -EINVAL; goto error; } ``` Linux version: Linux 6.12-rc2 (8cf0b93919e13d1e8d4466eb4080a4c4d9d66d7b) Configuration is attached (with `CONFIG_DVB_MMAP=y`) Syz and C reproducers are as below: ``` Syzkaller hit 'WARNING in vb2_core_reqbufs' bug. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 10407 at drivers/media/common/videobuf2/videobuf2-core.c:957 vb2_core_reqbufs+0x128d/0x17a0 drivers/media/common/videobuf2/videobuf2-core.c:957 Modules linked in: CPU: 0 UID: 0 PID: 10407 Comm: syz-executor171 Not tainted 6.12.0-rc2-g8cf0b93919e1 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:vb2_core_reqbufs+0x128d/0x17a0 drivers/media/common/videobuf2/videobuf2-core.c:957 Code: 49 8d b6 28 02 00 00 48 c7 c7 a0 5a 04 8e 48 c7 c2 9d 12 4d 8f e8 03 81 d7 03 4c 8b 7c 24 28 e9 02 f5 ff ff e8 b4 87 db f8 90 <0f> 0b 90 41 bd ea ff ff ff 49 bc 00 00 00 00 00 fc ff df 4c 8b 7c RSP: 0018:ffffc9000e7f7b40 EFLAGS: 00010293 RAX: ffffffff88bedbbc RBX: 0000000000000000 RCX: ffff8880463d0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000e7f7ce8 R08: ffffffff88bed5e0 R09: 1ffff92001cfef58 R10: dffffc0000000000 R11: ffffffff88b4fd00 R12: 0000000000000000 R13: ffffc9000e7f7c20 R14: ffffc9000652c260 R15: ffffc9000e7f7c40 FS: 0000555565e823c0(0000) GS:ffff88802c200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000098 CR3: 0000000020696000 CR4: 0000000000752ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> dvb_vb2_reqbufs+0xfe/0x3c0 drivers/media/dvb-core/dvb_vb2.c:338 dvb_demux_do_ioctl+0x5f9/0x760 drivers/media/dvb-core/dmxdev.c:1132 dvb_usercopy+0x170/0x270 drivers/media/dvb-core/dvbdev.c:993 dvb_demux_ioctl+0x2e/0x40 drivers/media/dvb-core/dmxdev.c:1185 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf9/0x280 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f54a9a8ba8d Code: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd57732608 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffd57732808 RCX: 00007f54a9a8ba8d RDX: 0000000020000280 RSI: 00000000c0086f3c RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffd57732808 R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffd577327f8 R14: 00007f54a9b09530 R15: 0000000000000001 </TASK> Syzkaller reproducer: # {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}} r0 = syz_open_dev$KGPT_dvb_demux_syzkalm(&(0x7f0000000080), 0x0, 0x60200) ioctl$KGPT_DMX_REQBUFS_0_dup(r0, 0xc0086f3c, &(0x7f0000000280)={0x1ff}) C reproducer: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <endian.h> #include <fcntl.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <unistd.h> static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf) - 1); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; memcpy((void*)0x20000080, "/dev/dvb/adapter#/demux#\000", 25); res = -1; res = syz_open_dev(/*dev=*/0x20000080, /*id=*/0, /*flags=*/0x60200); if (res != -1) r[0] = res; *(uint32_t*)0x20000280 = 0x1ff; *(uint32_t*)0x20000284 = 0; syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc0086f3c, /*arg=*/0x20000280ul); return 0; } ``` If you have any questions or require more information, please feel free to contact us. Reported-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx> Best, Chenyuan
Attachment:
config
Description: Binary data
