================================================================== BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2605 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2702 Write of size 1440 at addr ffffc900044b0da0 by task vivid-000-vid-c/30587 CPU: 1 UID: 0 PID: 30587 Comm: vivid-000-vid-c Not tainted 6.12.0-rc3-syzkaller-00007-g6485cf5ea253 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2605 [inline] tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2702 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the virtual mapping at [ffffc9000449a000, ffffc900044b2000) created by: vb2_vmalloc_alloc+0xf2/0x340 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888068141f00 pfn:0x68141 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff888068141f00 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 30586, tgid 30585 (syz.1.4962), ts 1536294328911, free_ts 1536074661452 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 vm_area_alloc_pages mm/vmalloc.c:3568 [inline] __vmalloc_area_node mm/vmalloc.c:3646 [inline] __vmalloc_node_range_noprof+0xa2b/0x13f0 mm/vmalloc.c:3828 vmalloc_user_noprof+0x74/0x80 mm/vmalloc.c:3982 vb2_vmalloc_alloc+0xf2/0x340 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 __vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:242 [inline] __vb2_queue_alloc+0xa0b/0x16f0 drivers/media/common/videobuf2/videobuf2-core.c:523 vb2_core_reqbufs+0xd2e/0x17c0 drivers/media/common/videobuf2/videobuf2-core.c:964 __vb2_init_fileio+0x319/0xf90 drivers/media/common/videobuf2/videobuf2-core.c:2878 __vb2_perform_fileio+0x31a/0x17b0 drivers/media/common/videobuf2/videobuf2-core.c:3024 vb2_fop_read+0x247/0x330 drivers/media/common/videobuf2/videobuf2-v4l2.c:1215 v4l2_read+0x1a4/0x2c0 drivers/media/v4l2-core/v4l2-dev.c:314 do_loop_readv_writev fs/read_write.c:854 [inline] vfs_readv+0x6bc/0xa80 fs/read_write.c:1027 do_preadv fs/read_write.c:1142 [inline] __do_sys_preadv fs/read_write.c:1192 [inline] __se_sys_preadv fs/read_write.c:1187 [inline] __x64_sys_preadv+0x1c7/0x2d0 fs/read_write.c:1187 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 page last free pid 30576 tgid 30576 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2638 vfree+0x186/0x2e0 mm/vmalloc.c:3361 do_free_pages sound/core/pcm_memory.c:88 [inline] snd_pcm_lib_free_pages+0x1cc/0x2a0 sound/core/pcm_memory.c:495 do_hw_free sound/core/pcm_native.c:894 [inline] snd_pcm_release_substream+0x2c6/0x490 sound/core/pcm_native.c:2718 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2398 [inline] snd_pcm_oss_release+0x1a5/0x280 sound/core/oss/pcm_oss.c:2577 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:228 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffffc900044b0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc900044b0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900044b1000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900044b1080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900044b1100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ==================================================================