==================================================================
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x145c/0x482c drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2626
Write of size 128 at addr ffff800024cadfa0 by task vivid-000-vid-c/27513
CPU: 0 PID: 27513 Comm: vivid-000-vid-c Not tainted 5.15.107-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
kasan_check_range+0x274/0x2b4 mm/kasan/generic.c:189
memcpy+0xb4/0xe8 mm/kasan/shadow.c:66
tpg_fill_plane_buffer+0x145c/0x482c drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2626
vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:469 [inline]
vivid_thread_vid_cap_tick+0x17b0/0x5698 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:729
vivid_thread_vid_cap+0x6ac/0xc94 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:868
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
Memory state around the buggy address:
ffff800024cadf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff800024cadf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff800024cae000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffff800024cae080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffff800024cae100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Unable to handle kernel paging request at virtual address ffff800024cae000
Mem abort info:
ESR = 0x0000000096000047
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000047
CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001b4b0d000
[ffff800024cae000] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=1000000107dd9003, pte=0000000000000000
Internal error: Oops: 96000047 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 27513 Comm: vivid-000-vid-c Tainted: G B 5.15.107-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __memcpy+0xd8/0x260 arch/arm64/lib/memcpy.S:136
lr : memcpy+0xc8/0xe8 mm/kasan/shadow.c:69
sp : ffff800024c875e0
x29: ffff800024c875e0 x28: ffff800024cadfc0 x27: ffff80001a199000
x26: 0000000000000000 x25: 000000000000007e x24: ffff80001a199000
x23: ffff800016ebf000 x22: ffff80000e22702c x21: ffff800024cadfc0
x20: ffff80001a199000 x19: 0000000000000080 x18: 0000000000000000
x17: 80b380b380b380b3 x16: 80b380b380b380b3 x15: 80b380b380b380b3
x14: 80b380b380b380b3 x13: 8da02ca08da02ca0 x12: 8da02ca08da02ca0
x11: 8da02ca08da02ca0 x10: 8da02ca08da02ca0 x9 : 80b380b380b380b3
x8 : 80b380b380b380b3 x7 : 80b380b380b380b3 x6 : 80b380b380b380b3
x5 : ffff800024cae040 x4 : 8da02ca086a056b3 x3 : 80b380b380b380b3
x2 : 80b380b380b380b3 x1 : 80b380b380b380b3 x0 : ffff800024cadfc0
Call trace:
__memcpy+0xd8/0x260 arch/arm64/lib/memcpy.S:135
tpg_fill_plane_buffer+0x145c/0x482c drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2626
vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:469 [inline]
vivid_thread_vid_cap_tick+0x17b0/0x5698 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:729
vivid_thread_vid_cap+0x6ac/0xc94 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:868
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
Code: f101805f 540000a9 a97c0c82 a97d1081 (a93c0ca2)
---[ end trace a55d489da394871a ]---
----------------
Code disassembly (best guess):
0: f101805f cmp x2, #0x60
4: 540000a9 b.ls 0x18 // b.plast
8: a97c0c82 ldp x2, x3, [x4, #-64]
c: a97d1081 ldp x1, x4, [x4, #-48]
* 10: a93c0ca2 stp x2, x3, [x5, #-64] <-- trapping instruction