==================================================================
BUG: KASAN: vmalloc-out-of-bounds in iosys_map_memcpy_to include/linux/iosys-map.h:287 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_damage_blit_real drivers/gpu/drm/drm_fbdev_generic.c:165 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_damage_blit drivers/gpu/drm/drm_fbdev_generic.c:196 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_helper_fb_dirty+0x57e/0xab0 drivers/gpu/drm/drm_fbdev_generic.c:216
Read of size 3072 at addr ffffc90003e99000 by task kworker/0:2/174

CPU: 0 PID: 174 Comm: kworker/0:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events drm_fb_helper_damage_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x241/0x290 mm/kasan/generic.c:187
 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
 iosys_map_memcpy_to include/linux/iosys-map.h:287 [inline]
 drm_fbdev_generic_damage_blit_real drivers/gpu/drm/drm_fbdev_generic.c:165 [inline]
 drm_fbdev_generic_damage_blit drivers/gpu/drm/drm_fbdev_generic.c:196 [inline]
 drm_fbdev_generic_helper_fb_dirty+0x57e/0xab0 drivers/gpu/drm/drm_fbdev_generic.c:216
 drm_fb_helper_fb_dirty drivers/gpu/drm/drm_fb_helper.c:388 [inline]
 drm_fb_helper_damage_work+0x22f/0x6f0 drivers/gpu/drm/drm_fb_helper.c:411
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

The buggy address belongs to a 768-page vmalloc region starting at 0xffffc90003b99000 allocated at drm_fbdev_generic_helper_fb_probe+0x247/0x520 drivers/gpu/drm/drm_fbdev_generic.c:97
Memory state around the buggy address:
 ffffc90003e98f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90003e98f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90003e99000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90003e99080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90003e99100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================