general protection fault in mxl111sf_ep4_streaming

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
52339250	repro-c	Reproduced: ✅	❓	general protection fault in mxl111sf_ep4_streaming_ctrl	2026/09/30 17:08	2026/09/30 17:08	2026/09/30 18:26	38f7f0d1
2a6963b8	assessment-security	DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	general protection fault in mxl111sf_ep4_streaming_ctrl	2026/09/24 01:28	2026/09/24 01:28	2026/09/24 02:40	0a1606bc

Title	Replies (including bot)	Last reply
[syzbot] [media?] general protection fault in mxl111sf_ep4_streaming_ctrl	0 (1)	2026/09/30 19:23

Title

Replies (including bot)

Last reply

[syzbot] [media?] general protection fault in mxl111sf_ep4_streaming_ctrl

0 (1)

2026/09/30 19:23

Created	Duration	User	Patch	Repo	Result
2026/09/30 18:58	23m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 551c722f40809618230001baccf219193e22fc5a	report job log log

Created

Duration

User

Patch

Repo

Result

2026/09/30 18:58

23m

retest repro

git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 551c722f40809618230001baccf219193e22fc5a

report job log log

usb 3-1: dvb_usb_v2: could not submit urb no. 0 - get them all back Oops: general protection fault, probably for non-canonical address 0xdffffc0000000061: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f] CPU: 1 UID: 0 PID: 5922 Comm: syz-executor559 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:mxl111sf_ep4_streaming_ctrl+0x2c/0x1a0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:399 Code: 1e fa 55 41 57 41 56 53 89 f3 49 89 fe 49 bf 00 00 00 00 00 fc ff df e8 02 5e 93 f9 49 81 c6 08 03 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 25 61 03 fa 4d 8b 36 49 83 c6 38 RSP: 0018:ffffc90002fc7b38 EFLAGS: 00010202 RAX: 0000000000000061 RBX: 0000000000000001 RCX: ffff88807ceb8000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90002fc7c38 R08: ffffc90002fc7647 R09: 1ffff920005f8ec8 R10: dffffc0000000000 R11: ffffffff88348d10 R12: dffffc0000000000 R13: ffff88805a6753b8 R14: 0000000000000308 R15: dffffc0000000000 FS: 00007f91525696c0(0000) GS:ffff888124dc8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f09f0cd1140 CR3: 000000002f2ca000 CR4: 00000000003526f0 Call Trace: <TASK> dvb_usb_start_feed+0x57a/0xc70 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:308 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline] dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9153da4a8b Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007f9152569060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f9153da4a8b RDX: 00007f91525690d0 RSI: 0000000040146f2c RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91525690f0 R13: 00007f9153e11fe6 R14: 0000001400000001 R15: 00007ffdf0c12528 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mxl111sf_ep4_streaming_ctrl+0x2c/0x1a0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:399 Code: 1e fa 55 41 57 41 56 53 89 f3 49 89 fe 49 bf 00 00 00 00 00 fc ff df e8 02 5e 93 f9 49 81 c6 08 03 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 25 61 03 fa 4d 8b 36 49 83 c6 38 RSP: 0018:ffffc90002fc7b38 EFLAGS: 00010202 RAX: 0000000000000061 RBX: 0000000000000001 RCX: ffff88807ceb8000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90002fc7c38 R08: ffffc90002fc7647 R09: 1ffff920005f8ec8 R10: dffffc0000000000 R11: ffffffff88348d10 R12: dffffc0000000000 R13: ffff88805a6753b8 R14: 0000000000000308 R15: dffffc0000000000 FS: 00007f91525696c0(0000) GS:ffff888124cc8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564103601950 CR3: 000000002f2ca000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: fa cli 1: 55 push %rbp 2: 41 57 push %r15 4: 41 56 push %r14 6: 53 push %rbx 7: 89 f3 mov %esi,%ebx 9: 49 89 fe mov %rdi,%r14 c: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15 13: fc ff df 16: e8 02 5e 93 f9 call 0xf9935e1d 1b: 49 81 c6 08 03 00 00 add $0x308,%r14 22: 4c 89 f0 mov %r14,%rax 25: 48 c1 e8 03 shr $0x3,%rax * 29: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 25 61 03 fa call 0xfa03615d 38: 4d 8b 36 mov (%r14),%r14 3b: 49 83 c6 38 add $0x38,%r14

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/09/30 19:22	git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git	551c722f4080	e12281bd	.config	console log	report		C			ci-upstream-kasan-gce	general protection fault in mxl111sf_ep4_streaming_ctrl
2026/09/22 08:07	upstream	f0100363d8c3	e12281bd	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	general protection fault in mxl111sf_ep4_streaming_ctrl

Crashes (2):

Assets (help?)