==================================================================
BUG: KASAN: vmalloc-out-of-bounds in iosys_map_memcpy_to include/linux/iosys-map.h:287 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_damage_blit_real drivers/gpu/drm/drm_fbdev_generic.c:173 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_damage_blit drivers/gpu/drm/drm_fbdev_generic.c:204 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fbdev_generic_helper_fb_dirty+0x57e/0xab0 drivers/gpu/drm/drm_fbdev_generic.c:224
Write of size 32 at addr ffffc9000456a180 by task kworker/0:3/2179

CPU: 0 PID: 2179 Comm: kworker/0:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events drm_fb_helper_damage_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x241/0x290 mm/kasan/generic.c:187
 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
 iosys_map_memcpy_to include/linux/iosys-map.h:287 [inline]
 drm_fbdev_generic_damage_blit_real drivers/gpu/drm/drm_fbdev_generic.c:173 [inline]
 drm_fbdev_generic_damage_blit drivers/gpu/drm/drm_fbdev_generic.c:204 [inline]
 drm_fbdev_generic_helper_fb_dirty+0x57e/0xab0 drivers/gpu/drm/drm_fbdev_generic.c:224
 drm_fb_helper_fb_dirty drivers/gpu/drm/drm_fb_helper.c:388 [inline]
 drm_fb_helper_damage_work+0x22f/0x6f0 drivers/gpu/drm/drm_fb_helper.c:411
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

The buggy address belongs to a vmalloc virtual mapping
Memory state around the buggy address:
 ffffc9000456a080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc9000456a100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc9000456a180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc9000456a200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc9000456a280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================