================================================================== BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2624 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x21a6/0x4350 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 5120 at addr ffffc90004201d24 by task vivid-000-vid-c/18320 CPU: 2 UID: 0 PID: 18320 Comm: vivid-000-vid-c Not tainted 6.12.0-rc6-syzkaller-00279-gde2f378f2b77 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2624 [inline] tpg_fill_plane_buffer+0x21a6/0x4350 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff+0x8e0/0x41f0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 vivid_thread_vid_cap_tick+0x81b/0x15d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x5b8/0xb90 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the virtual mapping at [ffffc900041a8000, ffffc90004204000) created by: vb2_vmalloc_alloc+0x11e/0x3d0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804d17af00 pfn:0x4d17a flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88804d17af00 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 18317, tgid 18316 (syz.1.3409), ts 334405593519, free_ts 333320140239 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0xf7d/0x2d10 mm/page_alloc.c:3457 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 vm_area_alloc_pages mm/vmalloc.c:3568 [inline] __vmalloc_area_node mm/vmalloc.c:3646 [inline] __vmalloc_node_range_noprof+0x724/0x15a0 mm/vmalloc.c:3828 vmalloc_user_noprof+0x6b/0x90 mm/vmalloc.c:3982 vb2_vmalloc_alloc+0x11e/0x3d0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 __vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:242 [inline] __vb2_queue_alloc+0x896/0x1230 drivers/media/common/videobuf2/videobuf2-core.c:523 vb2_core_reqbufs+0xa73/0xfb0 drivers/media/common/videobuf2/videobuf2-core.c:964 __vb2_init_fileio+0x3f3/0x1110 drivers/media/common/videobuf2/videobuf2-core.c:2880 __vb2_perform_fileio+0x9de/0x1620 drivers/media/common/videobuf2/videobuf2-core.c:3026 vb2_fop_read+0x213/0x3e0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1215 v4l2_read+0x226/0x360 drivers/media/v4l2-core/v4l2-dev.c:314 vfs_read+0x1df/0xbe0 fs/read_write.c:567 ksys_pread64 fs/read_write.c:764 [inline] __do_sys_pread64 fs/read_write.c:774 [inline] __se_sys_pread64 fs/read_write.c:771 [inline] __x64_sys_pread64+0x200/0x260 fs/read_write.c:771 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 page last free pid 18191 tgid 18191 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 snd_dma_free_pages+0x51/0x70 sound/core/memalloc.c:132 do_free_pages sound/core/pcm_memory.c:88 [inline] do_free_pages sound/core/pcm_memory.c:83 [inline] snd_pcm_lib_free_pages+0x172/0x390 sound/core/pcm_memory.c:495 do_hw_free sound/core/pcm_native.c:894 [inline] snd_pcm_release_substream.part.0+0x2a8/0x340 sound/core/pcm_native.c:2718 snd_pcm_release_substream+0x5b/0x70 sound/core/pcm_native.c:2712 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2398 [inline] snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2390 [inline] snd_pcm_oss_release+0x16f/0x310 sound/core/oss/pcm_oss.c:2577 __fput+0x3f6/0xb60 fs/file_table.c:431 task_work_run+0x14e/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffffc90004202f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90004202f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc90004203000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90004203080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90004203100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ==================================================================