================================================================== BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1594/0x4aec drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 Write of size 1440 at addr ffff800021479da0 by task vivid-000-vid-c/4701 CPU: 1 PID: 4701 Comm: vivid-000-vid-c Not tainted 6.1.141-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x88/0x220 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:427 kasan_report+0xa8/0x100 mm/kasan/report.c:531 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x260/0x2a0 mm/kasan/generic.c:189 memcpy+0x60/0x90 mm/kasan/shadow.c:66 tpg_fill_plane_buffer+0x1594/0x4aec drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0x1574/0x5694 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:729 vivid_thread_vid_cap+0x688/0xdb8 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:872 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 The buggy address belongs to the virtual mapping at [ffff800021463000, ffff80002147b000) created by: vb2_vmalloc_alloc+0xf8/0x2d4 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 The buggy address belongs to the physical page: page:00000000721059ff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13f45b flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800021479f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff800021479f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80002147a000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffff80002147a080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffff80002147a100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== Unable to handle kernel paging request at virtual address ffff80002147a340 KASAN: probably user-memory-access in range [0x000000010a3d1a00-0x000000010a3d1a07] Mem abort info: ESR = 0x0000000096000047 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000047 CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000020e41a000 [ffff80002147a340] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000010a60f003, pte=0000000000000000 Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4701 Comm: vivid-000-vid-c Tainted: G B 6.1.141-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x128/0x260 arch/arm64/lib/memcpy.S:161 lr : memcpy+0x74/0x90 mm/kasan/shadow.c:69 sp : ffff8000214a74c0 x29: ffff8000214a74c0 x28: ffff80002147a340 x27: 0000000000000042 x26: 1fffe0001a740f8a x25: 0000000000000007 x24: 1fffe0001a740f8a x23: 0000000000000000 x22: ffff80000e135df8 x21: ffff80002147a340 x20: ffff800027f09164 x19: 00000000000005a0 x18: ffff800011a7bce0 x17: 1fffe00033ee7176 x16: ffff800008042940 x15: 0000000000000000 x14: 0000000000000000 x13: 80b380b380b380b3 x12: 80b380b380b380b3 x11: 0000000000000016 x10: ffff70000428f518 x9 : ffff80001c2ce9d0 x8 : 0000000000000001 x7 : 80b380b380b380b3 x6 : 80b380b380b380b3 x5 : ffff80002147a8e0 x4 : ffff800027f09704 x3 : ffff80002147a340 x2 : 00000000000005a0 x1 : ffff800027f09164 x0 : ffff80002147a340 Call trace: __memcpy+0x128/0x260 arch/arm64/lib/memcpy.S:160 tpg_fill_plane_buffer+0x1594/0x4aec drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0x1574/0x5694 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:729 vivid_thread_vid_cap+0x688/0xdb8 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:872 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 Code: 927cec03 cb0e0021 8b0e0042 a9411c26 (a900340c) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 927cec03 and x3, x0, #0xfffffffffffffff0 4: cb0e0021 sub x1, x1, x14 8: 8b0e0042 add x2, x2, x14 c: a9411c26 ldp x6, x7, [x1, #16] * 10: a900340c stp x12, x13, [x0] <-- trapping instruction