syzbot


KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (3)

Status: upstream: reported on 2024/07/17 09:01
Subsystems: media
[Documentation on labels]
Reported-by: syzbot+365005005522b70a36f2@syzkaller.appspotmail.com
First crash: 116d, last: 1d22h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [media?] KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (3) 0 (1) 2024/07/17 09:01
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer media 1 1753d 1753d 0/28 auto-closed as invalid on 2020/05/17 19:44
linux-5.15 KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer 1 567d 567d 0/3 auto-obsoleted due to no activity on 2023/08/17 04:37
upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (2) media C inconclusive done 14 645d 1157d 22/28 fixed on 2023/02/24 13:51
linux-4.19 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) syz error 8 691d 1192d 0/1 upstream: reported syz repro on 2021/08/02 00:51
linux-4.14 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) 1 1025d 1025d 0/1 auto-closed as invalid on 2022/05/15 07:48
upstream BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) media 1 575d 571d 0/28 auto-obsoleted due to no activity on 2023/07/09 12:46

Sample crash report:
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2621 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x21a6/0x4350 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2702
Write of size 20480 at addr ffffc9001e150000 by task vivid-000-vid-c/11383

CPU: 0 UID: 0 PID: 11383 Comm: vivid-000-vid-c Not tainted 6.12.0-rc5-syzkaller-00322-gb9021de3ec2f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2621 [inline]
 tpg_fill_plane_buffer+0x21a6/0x4350 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2702
 vivid_fillbuff+0x8e0/0x41f0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470
 vivid_thread_vid_cap_tick+0x81b/0x15d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629
 vivid_thread_vid_cap+0x5b8/0xb90 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

The buggy address belongs to the virtual mapping at
 [ffffc9001bb50000, ffffc9001e151000) created by:
 vb2_vmalloc_alloc+0x11e/0x3d0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47

Memory state around the buggy address:
 ffffc9001e14ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9001e14ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc9001e150000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc9001e150080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc9001e150100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (18):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/04 07:55 upstream b9021de3ec2f f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/11/01 07:15 upstream 6c52d4da1c74 96eb609f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/30 20:06 upstream 4236f913808c 66aeb999 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/28 14:48 upstream 819837584309 9efb3cc7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/26 10:09 upstream 850925a8133c 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/25 22:42 upstream b423f5a9a61f 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/24 03:24 upstream c2ee9f594da8 15fa2979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/14 09:47 upstream 6485cf5ea253 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/14 03:07 upstream ba01565ced22 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/12 19:46 upstream 09f6b0c8904b 084d8178 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/05 07:10 upstream 27cc6fdf7201 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/09/30 18:19 upstream 9852d85ec9d4 bbd4e0a4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/09/08 22:02 upstream 5dadc1be8fc5 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/09/02 09:31 upstream c9f016e72b5c 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/08/30 05:16 upstream d5d547aa7b51 54fe8471 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/07/13 05:33 upstream e091caf99f3a eaeb5c15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/10/29 08:35 upstream e42b1a9a2557 66aeb999 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2024/09/17 22:13 upstream a940d9a43e62 c673ca06 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
* Struck through repros no longer work on HEAD.