Public bug reported:
# Summary
Using a PLEX PX-S1UD ISDB-T USB tuner with Ubuntu's generic kernel causes
`smsdvb` to repeatedly call `sysfs_emit_at()` with a non-page-aligned
driver-owned debugfs buffer. Each ISDB-T statistics response produces kernel
WARN traces. During normal Mirakurun operation this grew `/var/log/syslog` and
`/var/log/kern.log` to about 101 GB each and filled the root filesystem.
This is an upstream regression introduced by:
```
2f7d0c94396e ("media: siano: Convert to use sysfs_emit_at() API")
```
Linux v6.5 uses `scnprintf()` in `smsdvb-debugfs.c`; v6.6 and later use
`sysfs_emit_at()`. The current upstream source still contains the problematic
calls.
# Environment
```
Ubuntu 26.04 LTS (resolute)
Ubuntu 7.0.0-28.28-generic 7.0.12
CONFIG_SMS_SIANO_DEBUGFS=y
CONFIG_DEBUG_FS=y
USB 3275:0080 VidzMedia/PLEX PX-S1UD Digital TV Tuner
```
The same `CONFIG_SMS_SIANO_DEBUGFS=y` setting is present in the official
Ubuntu 22.04/5.15 and Ubuntu 24.04/6.8 generic kernel packages. The regression
is caused by the upstream code change, not a recent Ubuntu config change.
# Steps to reproduce
1. Boot an Ubuntu generic kernel based on Linux 6.6 or later with
`CONFIG_SMS_SIANO_DEBUGFS=y`.
2. Connect a PLEX PX-S1UD (`3275:0080`).
3. Tune any Japanese ISDB-T channel, for example with `dvbv5-zap`, Mirakurun,
or another DVB application.
4. Observe the kernel log with `journalctl -kf`.
# Actual result
The kernel repeatedly emits warnings similar to:
```
invalid sysfs_emit_at: buf:... at:0
WARNING: fs/sysfs/file.c:781 at sysfs_emit_at+0x...
...
smsdvb_print_isdb_stats_ex+0x... [smsdvb]
smsdvb_update_isdbt_stats_ex+0x... [smsdvb]
smsdvb_onresponse+0x... [smsdvb]
smscore_onresponse+0x... [smsmdtv]
smsusb_onresponse+0x... [smsusb]
```
The issue was reproduced again on the affected system with a controlled
three-second stream request. That produced 536 `invalid sysfs_emit_at`
warnings and 4.1 MB of kernel log, approximately 179 warnings and 1.4 MB per
second. The captured log is attached as `smsdvb-repro-kernel.log`.
On the affected machine, normal operation over approximately four days
produced:
```
/var/log/syslog approximately 101 GB
/var/log/kern.log approximately 101 GB
root filesystem 100% full
```
# Expected result
Receiving ISDB-T statistics must not generate any kernel warning. The debugfs
statistics buffer should be formatted successfully and `stats_count` should
become nonzero.
# Root cause
`struct smsdvb_debugfs` contains:
```c
char stats_data[PAGE_SIZE];
```
This is a driver-owned array embedded in a dynamically allocated structure,
not the page-aligned buffer supplied to a sysfs `show()` callback.
Commit `2f7d0c94396e` mechanically replaced calls such as:
```c
n += scnprintf(&buf[n], PAGE_SIZE - n, ...);
```
with:
```c
n += sysfs_emit_at(buf, n, ...);
```
`sysfs_emit_at()` rejects this buffer because `offset_in_page(buf)` is
nonzero and returns zero. Consequently `n` and `debug_data->stats_count`
remain zero. Every subsequent statistics response retries all formatting
calls and emits another set of WARN traces, creating an unbounded warning
storm.
# Suggested fix
Revert the conversions in `drivers/media/common/siano/smsdvb-debugfs.c` from
`sysfs_emit_at(buf, n, ...)` to the previous bounded debugfs-buffer form:
```c
scnprintf(&buf[n], PAGE_SIZE - n, ...)
```
Alternatively, use another bounded formatter intended for a driver-owned
buffer. Disabling `CONFIG_SMS_SIANO_DEBUGFS` avoids the faulty path but does
not fix the upstream regression.
# References
- Culprit commit:
https://github.com/torvalds/linux/commit/2f7d0c94396e8df1db6a5bc3b6ea272d640e874d
- Current affected source:
https://github.com/torvalds/linux/blob/master/drivers/media/common/siano/smsdvb-debugfs.c
- Independent PX-S1UD report on kernel 6.8, with kernel 6.5 used as a
workaround:
https://mao.5ch.io/test/read.cgi/linux/1695289122/476-n
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-28-generic 7.0.0-28.28
ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12
Uname: Linux 7.0.0-28-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: ubuntu 1831 F.... wireplumber
/dev/snd/seq: ubuntu 1809 F.... pipewire
CasperMD5CheckResult: pass
Date: Thu Jul 30 20:23:36 2026
InstallationDate: Installed on 2026-07-25 (5 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
IwDevWlp2s0Link: Not connected.
IwDevWlx40a5ef5c6f92Link: Not connected.
MachineType: Intel(R) Client Systems NUC6CAYH
ProcEnviron:
LANG=ja_JP.UTF-8
LC_CTYPE=C.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=dumb
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-28-generic
root=UUID=61cdc8d6-b16d-4d3e-a62f-d592da5c77c0 ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 12/08/2021
dmi.bios.release: 5.6
dmi.bios.vendor: Intel Corp.
dmi.bios.version: AYAPLCEL.86A.0071.2021.1208.1638
dmi.board.name: NUC6CAYB
dmi.board.vendor: Intel Corporation
dmi.board.version: J23203-409
dmi.chassis.type: 35
dmi.chassis.vendor: Intel Corporation
dmi.chassis.version: 2.0
dmi.ec.firmware.release: 22.0
dmi.modalias:
dmi:bvnIntelCorp.:bvrAYAPLCEL.86A.0071.2021.1208.1638:bd12/08/2021:br5.6:efr22.0:svnIntel(R)ClientSystems:pnNUC6CAYH:pvrJ26845-410:rvnIntelCorporation:rnNUC6CAYB:rvrJ23203-409:cvnIntelCorporation:ct35:cvr2.0:sku:pfaAY:
dmi.product.family: AY
dmi.product.name: NUC6CAYH
dmi.product.version: J26845-410
dmi.sys.vendor: Intel(R) Client Systems
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute
** Attachment added: "Controlled 3-second PX-S1UD reproduction: 536 WARNs, 4.1
MB"
https://bugs.launchpad.net/bugs/2162139/+attachment/5987930/+files/smsdvb-repro-kernel.log
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162139
Title:
smsdvb generates an unbounded invalid sysfs_emit_at WARN storm with
PX-S1UD (regression in Linux 6.6)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162139/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
