KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty

Status: upstream: reported on 2026/08/07 12:24
Reported-by: syzbot+aa4beb6f1c501d592d09@syzkaller.appspotmail.com
First crash: 66d, last: 15h47m

Sample crash report:
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in iosys_map_memcpy_to include/linux/iosys-map.h:287 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_damage_blit_real drivers/gpu/drm/drm_fbdev_generic.c:165 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_damage_blit drivers/gpu/drm/drm_fbdev_generic.c:196 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_helper_fb_dirty+0x57e/0xab0 drivers/gpu/drm/drm_fbdev_generic.c:216
Write of size 3040 at addr ffffc9000423a020 by task kworker/0:4/5834

CPU: 0 PID: 5834 Comm: kworker/0:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: events drm_fb_helper_damage_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x241/0x290 mm/kasan/generic.c:187
 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
 iosys_map_memcpy_to include/linux/iosys-map.h:287 [inline]
 drm_fbdev_generic_damage_blit_real drivers/gpu/drm/drm_fbdev_generic.c:165 [inline]
 drm_fbdev_generic_damage_blit drivers/gpu/drm/drm_fbdev_generic.c:196 [inline]
 drm_fbdev_generic_helper_fb_dirty+0x57e/0xab0 drivers/gpu/drm/drm_fbdev_generic.c:216
 drm_fb_helper_fb_dirty drivers/gpu/drm/drm_fb_helper.c:388 [inline]
 drm_fb_helper_damage_work+0x22f/0x6f0 drivers/gpu/drm/drm_fb_helper.c:411
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

The buggy address belongs to a vmalloc virtual mapping
Memory state around the buggy address:
 ffffc90004239f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90004239f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc9000423a000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                               ^
 ffffc9000423a080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc9000423a100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/12 16:11 linux-6.6.y a91a6aa9253c 745a967f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/10/12 16:10 linux-6.6.y a91a6aa9253c 745a967f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/10/09 19:50 linux-6.6.y a91a6aa9253c 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/10/09 03:37 linux-6.6.y a91a6aa9253c b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/10/05 14:46 linux-6.6.y a91a6aa9253c af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/10/05 14:46 linux-6.6.y a91a6aa9253c af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/09/30 21:40 linux-6.6.y 79643295eba1 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/09/14 16:20 linux-6.6.y 79643295eba1 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/09/03 22:01 linux-6.6.y 8b73de7da85f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/08/26 04:09 linux-6.6.y dc6160265ffc 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/08/07 12:23 linux-6.6.y 6436c12a2ced e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/08/07 12:23 linux-6.6.y 6436c12a2ced e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Write in drm_fbdev_generic_helper_fb_dirty
2026/10/11 08:27 linux-6.6.y a91a6aa9253c 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/10/08 11:20 linux-6.6.y a91a6aa9253c 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/10/03 17:13 linux-6.6.y a91a6aa9253c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/09/30 21:39 linux-6.6.y 79643295eba1 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/09/14 19:47 linux-6.6.y 79643295eba1 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/09/04 23:51 linux-6.6.y 8b73de7da85f 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: unable to handle kernel paging request in drm_fbdev_generic_helper_fb_dirty
2026/08/28 22:03 linux-6.6.y a4a971135a2f 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: unable to handle kernel paging request in drm_fbdev_generic_helper_fb_dirty
2026/08/28 22:00 linux-6.6.y a4a971135a2f 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/08/17 08:11 linux-6.6.y d27334b2888c 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/08/15 13:06 linux-6.6.y d27334b2888c 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/08/15 01:25 linux-6.6.y d27334b2888c 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
2026/08/12 19:41 linux-6.6.y d27334b2888c 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan KASAN: vmalloc-out-of-bounds Read in drm_fbdev_generic_helper_fb_dirty
* Struck through repros no longer work on HEAD.