syzbot

 sign-in | mailing list | source | docs
🐞 Open [1155] 🐞 Fixed [4318] 🐞 Invalid [9655] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes

KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (2)

Status: upstream: reported C repro on 2021/09/05 20:22
Reported-by: syzbot+272ce7abd8e49c0ddf42@syzkaller.appspotmail.com
Fix commit: 94a7ad928346 media: vivid: fix compose size exceed boundary
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce]
First crash: 515d, last: 2d22h

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: INFO: task hung in vivid_stop_generating_vid_cap (log)
Repro: C syz .config

Fix bisection: fixed by (bisect log) :
commit 94a7ad9283464b75b12516c5512541d467cefcf8
Author: Liu Shixin <liushixin2@huawei.com>
Date: Thu Oct 27 12:38:55 2022 +0000

  media: vivid: fix compose size exceed boundary

similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer 1 1110d 1110d 0/24 auto-closed as invalid on 2020/05/17 19:44
linux-4.19 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) syz error 8 48d 549d 0/1 upstream: reported syz repro on 2021/08/02 00:51
linux-4.14 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) 1 383d 383d 0/1 auto-closed as invalid on 2022/05/15 07:48
linux-4.19 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer 4 994d 1267d 0/1 auto-closed as invalid on 2020/09/11 05:35
linux-4.14 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer 1 1099d 1099d 0/1 auto-closed as invalid on 2020/05/29 08:05
upstream BUG: unable to handle kernel paging request in tpg_fill_plane_buffer syz done 17 1158d 1528d 0/24 auto-obsoleted due to no activity on 2022/12/18 03:07

Sample crash report:
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in memcpy include/linux/fortify-string.h:191 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2545 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1325/0x38e0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2626
Write of size 128 at addr ffffc9000dbe2fe0 by task vivid-001-vid-c/14838

CPU: 0 PID: 14838 Comm: vivid-001-vid-c Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105
 print_address_description.constprop.0.cold+0xf/0x309 mm/kasan/report.c:256
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 memcpy+0x39/0x60 mm/kasan/shadow.c:66
 memcpy include/linux/fortify-string.h:191 [inline]
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2545 [inline]
 tpg_fill_plane_buffer+0x1325/0x38e0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2626
 vivid_fillbuff+0x1ac1/0x3f00 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:469
 vivid_thread_vid_cap_tick+0x88b/0x2360 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:729
 vivid_thread_vid_cap+0x5d2/0xaf0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:868
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295


Memory state around the buggy address:
 ffffc9000dbe2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9000dbe2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc9000dbe3000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc9000dbe3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc9000dbe3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (14):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce 2021/09/04 23:21 upstream f1583cb1be35 d236a457 .config console log report syz C KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce 2022/10/21 11:22 upstream 6d36c728bc2e 63e790dd .config console log report info [disk image] [vmlinux] KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce-root 2022/08/24 23:36 upstream c40e8341e3b3 514514f6 .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce-root 2022/04/07 20:33 upstream 3e732ebf7316 c6ff3e05 .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce-selinux-root 2022/03/14 20:27 upstream 09688c0166e7 9e8eaa75 .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce-root 2022/02/27 13:16 upstream 2293be58d6a1 45a13a73 .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce 2022/02/15 14:13 upstream d567f5db412e 8b9ca619 .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce 2021/10/27 04:06 upstream 3906fe9bb7f1 d50eb50a .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce 2021/10/22 06:44 upstream 2f111a6fd5b5 55f90bc6 .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce-root 2021/10/18 03:13 upstream d999ade1cc86 0c5d9412 .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-qemu-upstream-386 2022/10/20 08:57 upstream aae703b02f92 b31320fc .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-kasan-gce-386 2022/10/09 04:36 upstream a6afa4199d3d aea5da89 .config console log report info [disk image] [vmlinux] KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-linux-next-kasan-gce-root 2022/04/24 04:44 linux-next f1244c81da13 131df97d .config console log report info KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
ci-upstream-linux-next-kasan-gce-root 2023/01/30 15:33 linux-next e2f86c02fdc9 9dfcf09c .config console log report info [disk image] [vmlinux] [kernel image] BUG: unable to handle kernel paging request in tpg_fill_plane_buffer
* Struck through repros no longer work on HEAD.