general protection fault in friio_streaming_ctrl

Status: closed as dup on 2026/10/04 14:39
Subsystems: media
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+ac020fbb657e00356ca2@syzkaller.appspotmail.com
First crash: 4d06h, last: 1d06h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
f3b5747f repro-c Reproduced: ✅ ❓ general protection fault in friio_streaming_ctrl 2026/10/03 02:16 2026/10/03 02:17 2026/10/03 03:08 57bbd979
b971ce1c assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ general protection fault in friio_streaming_ctrl 2026/10/02 00:00 2026/10/02 00:00 2026/10/02 00:09 6d32eb1f
▶ ▼ Duplicate of
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported
general protection fault in mxl111sf_ep6_streaming_ctrl media usb prio:high 2 syz, C error 2 7d18h 7d17h
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [media?] general protection fault in friio_streaming_ctrl 1 (3) 2026/10/04 14:39
[PATCH v2] media: dvb-usb-v2: set active_fe before the demux goes live 2 (2) 2026/10/04 14:39
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/10/04 14:12 22m kartikey406@gmail.com patch upstream OK job log log
2026/10/03 04:15 5h10m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ce1e0223d8ad4211275c82a17ed6d43ab81e13d9 report job log log

Sample crash report:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000061: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f]
CPU: 0 UID: 0 PID: 5921 Comm: syz-executor133 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:friio_streaming_ctrl+0x43/0xd0 drivers/media/usb/dvb-usb-v2/gl861.c:521
Code: 93 d9 93 f9 31 ff 89 de e8 8a de 93 f9 85 db b8 ff 00 ff 96 bb 64 ff 00 64 0f 44 d8 49 81 c6 08 03 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 9e dc 03 fa 4d 8b 36 49 83 c6 38
RSP: 0018:ffffc900026e7b20 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 000000006400ff64 RCX: ffff88807f1f3e80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900026e7c18 R08: ffffffff907a627f R09: 1ffffffff20f4c4f
R10: dffffc0000000000 R11: ffffffff883434e0 R12: dffffc0000000000
R13: ffff8880558f13b8 R14: 0000000000000308 R15: dffffc0000000000
FS:  00007fc833ad86c0(0000) GS:ffff888124cc7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562c5103b520 CR3: 00000000730d4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 dvb_usb_start_feed+0x57a/0xc70 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:308
 dmx_section_feed_start_filtering+0x519/0x6b0 drivers/media/dvb-core/dvb_demux.c:977
 dvb_dmxdev_filter_start+0xcdb/0x10d0 drivers/media/dvb-core/dmxdev.c:760
 dvb_demux_do_ioctl+0x470/0x540 drivers/media/dvb-core/dmxdev.c:1090
 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996
 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc835311cbb
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007fc833ad8100 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fc835311cbb
RDX: 00007fc833ad8160 RSI: 00000000403c6f2b RDI: 0000000000000008
RBP: 00007fc833ad81a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc83537d028
R13: 00007fc8353b0120 R14: 00007fc833ad8160 R15: 00007fc8353b0114
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:friio_streaming_ctrl+0x43/0xd0 drivers/media/usb/dvb-usb-v2/gl861.c:521
Code: 93 d9 93 f9 31 ff 89 de e8 8a de 93 f9 85 db b8 ff 00 ff 96 bb 64 ff 00 64 0f 44 d8 49 81 c6 08 03 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 9e dc 03 fa 4d 8b 36 49 83 c6 38
RSP: 0018:ffffc900026e7b20 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 000000006400ff64 RCX: ffff88807f1f3e80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900026e7c18 R08: ffffffff907a627f R09: 1ffffffff20f4c4f
R10: dffffc0000000000 R11: ffffffff883434e0 R12: dffffc0000000000
R13: ffff8880558f13b8 R14: 0000000000000308 R15: dffffc0000000000
FS:  00007fc833ad86c0(0000) GS:ffff888124dc7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4798882fb3 CR3: 00000000730d4000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	93                   	xchg   %eax,%ebx
   1:	d9 93 f9 31 ff 89    	fsts   -0x7600ce07(%rbx)
   7:	de e8                	fsubrp %st,%st(0)
   9:	8a de                	mov    %dh,%bl
   b:	93                   	xchg   %eax,%ebx
   c:	f9                   	stc
   d:	85 db                	test   %ebx,%ebx
   f:	b8 ff 00 ff 96       	mov    $0x96ff00ff,%eax
  14:	bb 64 ff 00 64       	mov    $0x6400ff64,%ebx
  19:	0f 44 d8             	cmove  %eax,%ebx
  1c:	49 81 c6 08 03 00 00 	add    $0x308,%r14
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 f7             	mov    %r14,%rdi
  34:	e8 9e dc 03 fa       	call   0xfa03dcd7
  39:	4d 8b 36             	mov    (%r14),%r14
  3c:	49 83 c6 38          	add    $0x38,%r14

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/03 09:26 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ce1e0223d8ad 7808aef4 .config console log report C ci-upstream-kasan-gce general protection fault in friio_streaming_ctrl
2026/09/30 09:14 upstream 6f8319e3e9a4 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in friio_streaming_ctrl
* Struck through repros no longer work on HEAD.