================================================================== BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x2c84/0x4380 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 1440 at addr ffffc90005e27da0 by task vivid-000-vid-c/22329 CPU: 2 UID: 0 PID: 22329 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00185-g128c8f96eb86 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] tpg_fill_plane_buffer+0x2c84/0x4380 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff+0x8e0/0x41f0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 vivid_thread_vid_cap_tick+0x81b/0x15d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x5b8/0xb90 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x3af/0x750 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the virtual mapping at [ffffc90005e11000, ffffc90005e29000) created by: vb2_vmalloc_alloc+0x11e/0x3d0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28ab8 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 22328, tgid 22326 (syz.3.7784), ts 282811226677, free_ts 279995057407 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551 prep_new_page mm/page_alloc.c:1559 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3477 __alloc_frozen_pages_noprof+0x221/0x2470 mm/page_alloc.c:4739 alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270 alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline] alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2361 vm_area_alloc_pages mm/vmalloc.c:3591 [inline] __vmalloc_area_node mm/vmalloc.c:3669 [inline] __vmalloc_node_range_noprof+0x721/0x1530 mm/vmalloc.c:3846 vmalloc_user_noprof+0x6b/0x90 mm/vmalloc.c:4000 vb2_vmalloc_alloc+0x11e/0x3d0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47 __vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:242 [inline] __vb2_queue_alloc+0x896/0x1230 drivers/media/common/videobuf2/videobuf2-core.c:523 vb2_core_reqbufs+0xa73/0xfb0 drivers/media/common/videobuf2/videobuf2-core.c:964 __vb2_init_fileio+0x3f3/0x1110 drivers/media/common/videobuf2/videobuf2-core.c:2895 __vb2_perform_fileio+0x9de/0x1620 drivers/media/common/videobuf2/videobuf2-core.c:3041 vb2_fop_read+0x213/0x3e0 drivers/media/common/videobuf2/videobuf2-v4l2.c:1215 v4l2_read+0x226/0x360 drivers/media/v4l2-core/v4l2-dev.c:316 vfs_read+0x1df/0xbf0 fs/read_write.c:563 ksys_read+0x12b/0x250 fs/read_write.c:708 page last free pid 22120 tgid 22120 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660 vfree+0x174/0x950 mm/vmalloc.c:3383 snd_dma_free_pages+0x51/0x70 sound/core/memalloc.c:132 do_free_pages sound/core/pcm_memory.c:88 [inline] do_free_pages sound/core/pcm_memory.c:83 [inline] snd_pcm_lib_free_pages+0x172/0x390 sound/core/pcm_memory.c:495 do_hw_free sound/core/pcm_native.c:894 [inline] snd_pcm_release_substream.part.0+0x2a8/0x340 sound/core/pcm_native.c:2718 snd_pcm_release_substream+0x5b/0x70 sound/core/pcm_native.c:2712 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2398 [inline] snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2390 [inline] snd_pcm_oss_release+0x16f/0x310 sound/core/oss/pcm_oss.c:2577 __fput+0x3ff/0xb70 fs/file_table.c:464 task_work_run+0x14e/0x250 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffffc90005e27f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90005e27f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc90005e28000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90005e28080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90005e28100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ==================================================================