================================================================== BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1b76/0x5ec0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 1440 at addr ffffc90020ea7da0 by task vivid-000-vid-c/6579 CPU: 0 UID: 0 PID: 6579 Comm: vivid-000-vid-c Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xb4/0x290 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x29a/0x2b0 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline] tpg_fill_plane_buffer+0x1b76/0x5ec0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0xfff/0x5fe0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x8d8/0x10d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the virtual mapping at [ffffc90020e91000, ffffc90020ea9000) created by: vb2_vmalloc_alloc+0xef/0x340 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5f5f4 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 6578, tgid 6572 (syz.4.171), ts 132436649381, free_ts 132351615870 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1714 prep_new_page mm/page_alloc.c:1722 [inline] get_page_from_freelist+0x21ce/0x22b0 mm/page_alloc.c:3684 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4966 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2301 alloc_frozen_pages_noprof mm/mempolicy.c:2372 [inline] alloc_pages_noprof+0xa9/0x190 mm/mempolicy.c:2392 vm_area_alloc_pages mm/vmalloc.c:3592 [inline] __vmalloc_area_node mm/vmalloc.c:3670 [inline] __vmalloc_node_range_noprof+0x8fe/0x12c0 mm/vmalloc.c:3845 vmalloc_user_noprof+0x74/0x80 mm/vmalloc.c:3997 vb2_vmalloc_alloc+0xef/0x340 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 __vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:242 [inline] __vb2_queue_alloc+0x9bf/0x15a0 drivers/media/common/videobuf2/videobuf2-core.c:523 vb2_core_reqbufs+0xc31/0x1420 drivers/media/common/videobuf2/videobuf2-core.c:964 __vb2_init_fileio+0x318/0xff0 drivers/media/common/videobuf2/videobuf2-core.c:2895 vb2_core_poll+0x4c1/0x840 drivers/media/common/videobuf2/videobuf2-core.c:2729 vb2_poll drivers/media/common/videobuf2/videobuf2-v4l2.c:980 [inline] vb2_fop_poll+0x168/0x380 drivers/media/common/videobuf2/videobuf2-v4l2.c:1245 v4l2_poll+0x144/0x2c0 drivers/media/v4l2-core/v4l2-dev.c:350 vfs_poll include/linux/poll.h:82 [inline] do_pollfd fs/select.c:870 [inline] do_poll fs/select.c:913 [inline] do_sys_poll+0x8c1/0x1050 fs/select.c:1009 __do_sys_ppoll fs/select.c:1115 [inline] __se_sys_ppoll+0x1ff/0x260 fs/select.c:1095 page last free pid 36 tgid 36 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1258 [inline] __free_frozen_pages+0xb0e/0xcd0 mm/page_alloc.c:2721 __slab_free+0x326/0x400 mm/slub.c:4553 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4147 [inline] slab_alloc_node mm/slub.c:4196 [inline] kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4203 ext4_init_io_end+0x29/0x130 fs/ext4/page-io.c:307 ext4_do_writepages+0xb85/0x3e50 fs/ext4/inode.c:2687 ext4_writepages+0x203/0x350 fs/ext4/inode.c:2829 do_writepages+0x3b1/0x7b0 mm/page-writeback.c:2656 __writeback_single_inode+0x145/0xff0 fs/fs-writeback.c:1680 writeback_sb_inodes+0x6b5/0x1000 fs/fs-writeback.c:1976 __writeback_inodes_wb+0x111/0x240 fs/fs-writeback.c:2047 wb_writeback+0x44f/0xaf0 fs/fs-writeback.c:2158 wb_check_old_data_flush fs/fs-writeback.c:2262 [inline] wb_do_writeback fs/fs-writeback.c:2315 [inline] wb_workfn+0xaef/0xef0 fs/fs-writeback.c:2343 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 Memory state around the buggy address: ffffc90020ea7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90020ea7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc90020ea8000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90020ea8080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90020ea8100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ==================================================================