WARNING in media_create_pad_link

Status: fixed on 2024/12/14 20:01
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+0584f746fde3d52b4675@syzkaller.appspotmail.com
Fix commit: 19464d732252 media: uvcvideo: Require entities to have a non-zero unique ID
First crash: 1228d, last: 697d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH 5.15.y] media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID 3 (3) 2026/04/09 07:04
[PATCH] media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID 6 (6) 2025/09/08 13:21
Re: [PATCH v3 1/1] media: uvcvideo: require entities to have a non-zero unique ID 22 (22) 2025/01/31 16:59
Re: [PATCH v3 1/1] media: uvcvideo: require entities to have a non-zero unique ID 1 (1) 2025/01/06 10:55
Re: [PATCH v3 1/1] media: uvcvideo: require entities to have a non-zero unique ID 1 (1) 2025/01/06 07:27
[PATCH v3 1/1] media: uvcvideo: require entities to have a non-zero unique ID 2 (2) 2024/09/25 19:45
[PATCH v2 1/1] media: uvcvideo: require entities to have a non-zero unique ID 4 (4) 2024/09/13 16:01
[PATCH 2/2] media: uvcvideo: require entities to have a non-zero ID 1 (1) 2024/09/09 20:46
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2024/01/29 upstream (ToT) 41bccc98fb79 C [report] WARNING in media_create_pad_link
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 WARNING in media_create_pad_link (2) origin:lts-only -1 syz, C error 4 121d 135d 0/3 auto-obsoleted due to no activity on 2026/07/09 20:59
upstream WARNING in media_create_pad_link (2) usb media -1 syz, C error done 11 295d 498d 29/29 fixed on 2025/11/14 14:05
linux-5.15 WARNING in media_create_pad_link origin:upstream -1 syz, C error 7 595d 1228d 0/3 auto-obsoleted due to no activity on 2025/03/22 03:16
upstream WARNING in media_create_pad_link usb media -1 syz, C done done 104 616d 2268d 28/29 fixed on 2024/12/16 09:50
linux-6.1 WARNING in media_create_pad_link (2) origin:lts-only -1 syz, C inconclusive 16 105d 135d 0/3 upstream: reported C repro on 2026/03/17 03:30
▶ ▼ Fix bisection attempts (15)
Created Duration User Patch Repo Result
2024/10/15 00:19 0m bisect fix linux-6.1.y error job log
2024/09/01 21:32 1h30m bisect fix linux-6.1.y OK (0) job log log
2024/07/30 01:31 2h47m bisect fix linux-6.1.y OK (0) job log log
2024/06/13 12:36 1h07m bisect fix linux-6.1.y OK (0) job log log
2024/05/14 04:20 58m bisect fix linux-6.1.y OK (0) job log log
2024/04/07 07:08 1h28m bisect fix linux-6.1.y OK (0) job log log
2024/03/07 20:14 1h28m bisect fix linux-6.1.y OK (0) job log log
2024/01/29 12:03 1h18m bisect fix linux-6.1.y OK (0) job log log
2023/12/27 13:08 1h42m bisect fix linux-6.1.y OK (0) job log log
2023/11/26 23:44 1h33m bisect fix linux-6.1.y OK (0) job log log
2023/10/27 06:00 1h24m bisect fix linux-6.1.y OK (0) job log log
2023/09/24 02:48 1h22m bisect fix linux-6.1.y OK (0) job log log
2023/07/14 21:30 4h16m bisect fix linux-6.1.y OK (0) job log log
2023/06/07 23:12 33m bisect fix linux-6.1.y OK (0) job log log
2023/04/19 06:59 1h27m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
usb 1-1: New USB device found, idVendor=0bd3, idProduct=0d55, bcdDevice=69.6a
usb 1-1: New USB device strings: Mfr=64, Product=0, SerialNumber=0
usb 1-1: Manufacturer: syz
usb 1-1: config 0 descriptor??
usb 1-1: Found UVC 0.00 device <unnamed> (0bd3:0d55)
uvcvideo 1-1:0.0: Entity type for entity Output 255 was not initialized!
------------[ cut here ]------------
WARNING: CPU: 1 PID: 22 at drivers/media/mc/mc-entity.c:1021 media_create_pad_link+0x975/0xad0
Modules linked in:
CPU: 1 PID: 22 Comm: kworker/1:0 Not tainted 6.1.27-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: usb_hub_wq hub_event
RIP: 0010:media_create_pad_link+0x975/0xad0 drivers/media/mc/mc-entity.c:1021
Code: 00 66 41 ff 04 24 31 c0 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 39 e3 91 fa 0f 0b b8 ea ff ff ff eb e3 e8 2b e3 91 fa <0f> 0b b8 ea ff ff ff eb d5 e8 1d e3 91 fa 0f 0b b8 ea ff ff ff eb
RSP: 0018:ffffc900001c6a20 EFLAGS: 00010293
RAX: ffffffff86f7e595 RBX: 0000000000000000 RCX: ffff88813feeba80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff86f7dc8d R09: ffffed100f621098
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88807b416880
FS:  0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6c5edd51c8 CR3: 0000000075460000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 uvc_mc_create_links drivers/media/usb/uvc/uvc_entity.c:50 [inline]
 uvc_mc_register_entities+0x6e0/0x950 drivers/media/usb/uvc/uvc_entity.c:151
 uvc_register_chains+0x3d4/0x4c0 drivers/media/usb/uvc/uvc_driver.c:2034
 uvc_probe+0xa091/0xa940 drivers/media/usb/uvc/uvc_driver.c:2171
 usb_probe_interface+0x5c0/0xaf0 drivers/usb/core/driver.c:396
 really_probe+0x2ab/0xcb0 drivers/base/dd.c:639
 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:783
 driver_probe_device+0x50/0x420 drivers/base/dd.c:813
 __device_attach_driver+0x2cf/0x510 drivers/base/dd.c:941
 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:427
 __device_attach+0x359/0x570 drivers/base/dd.c:1013
 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:487
 device_add+0xb48/0xfd0 drivers/base/core.c:3664
 usb_set_configuration+0x19dd/0x2020 drivers/usb/core/message.c:2170
 usb_generic_driver_probe+0x84/0x140 drivers/usb/core/generic.c:238
 usb_probe_device+0x130/0x260 drivers/usb/core/driver.c:293
 really_probe+0x2ab/0xcb0 drivers/base/dd.c:639
 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:783
 driver_probe_device+0x50/0x420 drivers/base/dd.c:813
 __device_attach_driver+0x2cf/0x510 drivers/base/dd.c:941
 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:427
 __device_attach+0x359/0x570 drivers/base/dd.c:1013
 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:487
 device_add+0xb48/0xfd0 drivers/base/core.c:3664
 usb_new_device+0xbdd/0x18e0 drivers/usb/core/hub.c:2575
 hub_port_connect drivers/usb/core/hub.c:5355 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5499 [inline]
 port_event drivers/usb/core/hub.c:5655 [inline]
 hub_event+0x2d4d/0x57b0 drivers/usb/core/hub.c:5737
 process_one_work+0x8aa/0x11f0 kernel/workqueue.c:2289
 worker_thread+0xa5f/0x1210 kernel/workqueue.c:2436
 kthread+0x26e/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/08 18:14 linux-6.1.y ca48fc16c493 90c93c40 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan WARNING in media_create_pad_link
2023/03/20 05:39 linux-6.1.y 7eaef76fbc46 7939252e .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in media_create_pad_link
* Struck through repros no longer work on HEAD.