Public bug reported: # Summary Using a PLEX PX-S1UD ISDB-T USB tuner with Ubuntu's generic kernel causes `smsdvb` to repeatedly call `sysfs_emit_at()` with a non-page-aligned driver-owned debugfs buffer. Each ISDB-T statistics response produces kernel WARN traces. During normal Mirakurun operation this grew `/var/log/syslog` and `/var/log/kern.log` to about 101 GB each and filled the root filesystem. This is an upstream regression introduced by: ``` 2f7d0c94396e ("media: siano: Convert to use sysfs_emit_at() API") ``` Linux v6.5 uses `scnprintf()` in `smsdvb-debugfs.c`; v6.6 and later use `sysfs_emit_at()`. The current upstream source still contains the problematic calls. # Environment ``` Ubuntu 26.04 LTS (resolute) Ubuntu 7.0.0-28.28-generic 7.0.12 CONFIG_SMS_SIANO_DEBUGFS=y CONFIG_DEBUG_FS=y USB 3275:0080 VidzMedia/PLEX PX-S1UD Digital TV Tuner ``` The same `CONFIG_SMS_SIANO_DEBUGFS=y` setting is present in the official Ubuntu 22.04/5.15 and Ubuntu 24.04/6.8 generic kernel packages. The regression is caused by the upstream code change, not a recent Ubuntu config change. # Steps to reproduce 1. Boot an Ubuntu generic kernel based on Linux 6.6 or later with `CONFIG_SMS_SIANO_DEBUGFS=y`. 2. Connect a PLEX PX-S1UD (`3275:0080`). 3. Tune any Japanese ISDB-T channel, for example with `dvbv5-zap`, Mirakurun, or another DVB application. 4. Observe the kernel log with `journalctl -kf`. # Actual result The kernel repeatedly emits warnings similar to: ``` invalid sysfs_emit_at: buf:... at:0 WARNING: fs/sysfs/file.c:781 at sysfs_emit_at+0x... ... smsdvb_print_isdb_stats_ex+0x... [smsdvb] smsdvb_update_isdbt_stats_ex+0x... [smsdvb] smsdvb_onresponse+0x... [smsdvb] smscore_onresponse+0x... [smsmdtv] smsusb_onresponse+0x... [smsusb] ``` The issue was reproduced again on the affected system with a controlled three-second stream request. That produced 536 `invalid sysfs_emit_at` warnings and 4.1 MB of kernel log, approximately 179 warnings and 1.4 MB per second. The captured log is attached as `smsdvb-repro-kernel.log`. On the affected machine, normal operation over approximately four days produced: ``` /var/log/syslog approximately 101 GB /var/log/kern.log approximately 101 GB root filesystem 100% full ``` # Expected result Receiving ISDB-T statistics must not generate any kernel warning. The debugfs statistics buffer should be formatted successfully and `stats_count` should become nonzero. # Root cause `struct smsdvb_debugfs` contains: ```c char stats_data[PAGE_SIZE]; ``` This is a driver-owned array embedded in a dynamically allocated structure, not the page-aligned buffer supplied to a sysfs `show()` callback. Commit `2f7d0c94396e` mechanically replaced calls such as: ```c n += scnprintf(&buf[n], PAGE_SIZE - n, ...); ``` with: ```c n += sysfs_emit_at(buf, n, ...); ``` `sysfs_emit_at()` rejects this buffer because `offset_in_page(buf)` is nonzero and returns zero. Consequently `n` and `debug_data->stats_count` remain zero. Every subsequent statistics response retries all formatting calls and emits another set of WARN traces, creating an unbounded warning storm. # Suggested fix Revert the conversions in `drivers/media/common/siano/smsdvb-debugfs.c` from `sysfs_emit_at(buf, n, ...)` to the previous bounded debugfs-buffer form: ```c scnprintf(&buf[n], PAGE_SIZE - n, ...) ``` Alternatively, use another bounded formatter intended for a driver-owned buffer. Disabling `CONFIG_SMS_SIANO_DEBUGFS` avoids the faulty path but does not fix the upstream regression. # References - Culprit commit: https://github.com/torvalds/linux/commit/2f7d0c94396e8df1db6a5bc3b6ea272d640e874d - Current affected source: https://github.com/torvalds/linux/blob/master/drivers/media/common/siano/smsdvb-debugfs.c - Independent PX-S1UD report on kernel 6.8, with kernel 6.5 used as a workaround: https://mao.5ch.io/test/read.cgi/linux/1695289122/476-n ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic 7.0.0-28.28 ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: ubuntu 1831 F.... wireplumber /dev/snd/seq: ubuntu 1809 F.... pipewire CasperMD5CheckResult: pass Date: Thu Jul 30 20:23:36 2026 InstallationDate: Installed on 2026-07-25 (5 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) IwDevWlp2s0Link: Not connected. IwDevWlx40a5ef5c6f92Link: Not connected. MachineType: Intel(R) Client Systems NUC6CAYH ProcEnviron: LANG=ja_JP.UTF-8 LC_CTYPE=C.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=dumb ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-28-generic root=UUID=61cdc8d6-b16d-4d3e-a62f-d592da5c77c0 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M RebootRequiredPkgs: Error: path contained symlinks. SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 12/08/2021 dmi.bios.release: 5.6 dmi.bios.vendor: Intel Corp. dmi.bios.version: AYAPLCEL.86A.0071.2021.1208.1638 dmi.board.name: NUC6CAYB dmi.board.vendor: Intel Corporation dmi.board.version: J23203-409 dmi.chassis.type: 35 dmi.chassis.vendor: Intel Corporation dmi.chassis.version: 2.0 dmi.ec.firmware.release: 22.0 dmi.modalias: dmi:bvnIntelCorp.:bvrAYAPLCEL.86A.0071.2021.1208.1638:bd12/08/2021:br5.6:efr22.0:svnIntel(R)ClientSystems:pnNUC6CAYH:pvrJ26845-410:rvnIntelCorporation:rnNUC6CAYB:rvrJ23203-409:cvnIntelCorporation:ct35:cvr2.0:sku:pfaAY: dmi.product.family: AY dmi.product.name: NUC6CAYH dmi.product.version: J26845-410 dmi.sys.vendor: Intel(R) Client Systems ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute ** Attachment added: "Controlled 3-second PX-S1UD reproduction: 536 WARNs, 4.1 MB" https://bugs.launchpad.net/bugs/2162139/+attachment/5987930/+files/smsdvb-repro-kernel.log -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2162139 Title: smsdvb generates an unbounded invalid sysfs_emit_at WARN storm with PX-S1UD (regression in Linux 6.6) Status in linux package in Ubuntu: New Bug description: # Summary Using a PLEX PX-S1UD ISDB-T USB tuner with Ubuntu's generic kernel causes `smsdvb` to repeatedly call `sysfs_emit_at()` with a non-page-aligned driver-owned debugfs buffer. Each ISDB-T statistics response produces kernel WARN traces. During normal Mirakurun operation this grew `/var/log/syslog` and `/var/log/kern.log` to about 101 GB each and filled the root filesystem. This is an upstream regression introduced by: ``` 2f7d0c94396e ("media: siano: Convert to use sysfs_emit_at() API") ``` Linux v6.5 uses `scnprintf()` in `smsdvb-debugfs.c`; v6.6 and later use `sysfs_emit_at()`. The current upstream source still contains the problematic calls. # Environment ``` Ubuntu 26.04 LTS (resolute) Ubuntu 7.0.0-28.28-generic 7.0.12 CONFIG_SMS_SIANO_DEBUGFS=y CONFIG_DEBUG_FS=y USB 3275:0080 VidzMedia/PLEX PX-S1UD Digital TV Tuner ``` The same `CONFIG_SMS_SIANO_DEBUGFS=y` setting is present in the official Ubuntu 22.04/5.15 and Ubuntu 24.04/6.8 generic kernel packages. The regression is caused by the upstream code change, not a recent Ubuntu config change. # Steps to reproduce 1. Boot an Ubuntu generic kernel based on Linux 6.6 or later with `CONFIG_SMS_SIANO_DEBUGFS=y`. 2. Connect a PLEX PX-S1UD (`3275:0080`). 3. Tune any Japanese ISDB-T channel, for example with `dvbv5-zap`, Mirakurun, or another DVB application. 4. Observe the kernel log with `journalctl -kf`. # Actual result The kernel repeatedly emits warnings similar to: ``` invalid sysfs_emit_at: buf:... at:0 WARNING: fs/sysfs/file.c:781 at sysfs_emit_at+0x... ... smsdvb_print_isdb_stats_ex+0x... [smsdvb] smsdvb_update_isdbt_stats_ex+0x... [smsdvb] smsdvb_onresponse+0x... [smsdvb] smscore_onresponse+0x... [smsmdtv] smsusb_onresponse+0x... [smsusb] ``` The issue was reproduced again on the affected system with a controlled three-second stream request. That produced 536 `invalid sysfs_emit_at` warnings and 4.1 MB of kernel log, approximately 179 warnings and 1.4 MB per second. The captured log is attached as `smsdvb-repro-kernel.log`. On the affected machine, normal operation over approximately four days produced: ``` /var/log/syslog approximately 101 GB /var/log/kern.log approximately 101 GB root filesystem 100% full ``` # Expected result Receiving ISDB-T statistics must not generate any kernel warning. The debugfs statistics buffer should be formatted successfully and `stats_count` should become nonzero. # Root cause `struct smsdvb_debugfs` contains: ```c char stats_data[PAGE_SIZE]; ``` This is a driver-owned array embedded in a dynamically allocated structure, not the page-aligned buffer supplied to a sysfs `show()` callback. Commit `2f7d0c94396e` mechanically replaced calls such as: ```c n += scnprintf(&buf[n], PAGE_SIZE - n, ...); ``` with: ```c n += sysfs_emit_at(buf, n, ...); ``` `sysfs_emit_at()` rejects this buffer because `offset_in_page(buf)` is nonzero and returns zero. Consequently `n` and `debug_data->stats_count` remain zero. Every subsequent statistics response retries all formatting calls and emits another set of WARN traces, creating an unbounded warning storm. # Suggested fix Revert the conversions in `drivers/media/common/siano/smsdvb-debugfs.c` from `sysfs_emit_at(buf, n, ...)` to the previous bounded debugfs-buffer form: ```c scnprintf(&buf[n], PAGE_SIZE - n, ...) ``` Alternatively, use another bounded formatter intended for a driver-owned buffer. Disabling `CONFIG_SMS_SIANO_DEBUGFS` avoids the faulty path but does not fix the upstream regression. # References - Culprit commit: https://github.com/torvalds/linux/commit/2f7d0c94396e8df1db6a5bc3b6ea272d640e874d - Current affected source: https://github.com/torvalds/linux/blob/master/drivers/media/common/siano/smsdvb-debugfs.c - Independent PX-S1UD report on kernel 6.8, with kernel 6.5 used as a workaround: https://mao.5ch.io/test/read.cgi/linux/1695289122/476-n ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic 7.0.0-28.28 ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: ubuntu 1831 F.... wireplumber /dev/snd/seq: ubuntu 1809 F.... pipewire CasperMD5CheckResult: pass Date: Thu Jul 30 20:23:36 2026 InstallationDate: Installed on 2026-07-25 (5 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) IwDevWlp2s0Link: Not connected. IwDevWlx40a5ef5c6f92Link: Not connected. MachineType: Intel(R) Client Systems NUC6CAYH ProcEnviron: LANG=ja_JP.UTF-8 LC_CTYPE=C.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=dumb ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-28-generic root=UUID=61cdc8d6-b16d-4d3e-a62f-d592da5c77c0 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M RebootRequiredPkgs: Error: path contained symlinks. SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 12/08/2021 dmi.bios.release: 5.6 dmi.bios.vendor: Intel Corp. dmi.bios.version: AYAPLCEL.86A.0071.2021.1208.1638 dmi.board.name: NUC6CAYB dmi.board.vendor: Intel Corporation dmi.board.version: J23203-409 dmi.chassis.type: 35 dmi.chassis.vendor: Intel Corporation dmi.chassis.version: 2.0 dmi.ec.firmware.release: 22.0 dmi.modalias: dmi:bvnIntelCorp.:bvrAYAPLCEL.86A.0071.2021.1208.1638:bd12/08/2021:br5.6:efr22.0:svnIntel(R)ClientSystems:pnNUC6CAYH:pvrJ26845-410:rvnIntelCorporation:rnNUC6CAYB:rvrJ23203-409:cvnIntelCorporation:ct35:cvr2.0:sku:pfaAY: dmi.product.family: AY dmi.product.name: NUC6CAYH dmi.product.version: J26845-410 dmi.sys.vendor: Intel(R) Client Systems To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162139/+subscriptions
Комментариев нет:
Отправить комментарий