syzbot

 sign-in | mailing list | source | docs
🐞 Open [1419]
≡ Subsystems
🐞 Fixed [6982]
🐞 Invalid [18203]
⬇ Missing Backports [223]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (4)

Status: upstream: reported on 2025/07/14 07:23
Subsystems: media
[Documentation on labels]
Reported-by: syzbot+dac8f5eaa46837e97b89@syzkaller.appspotmail.com
First crash: 247d, last: 13h59m
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
d9a727cd-9701-464e-b906-fc16fe84e9e4 repro ❓ KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (4) 2026/03/10 13:48 2026/03/11 11:39 2026/03/11 12:40 86914af9098a80da53c3c5d46be980c572ee29f8
▶ ▼ Discussions (7)
Title Replies (including bot) Last reply
[syzbot] Monthly media report (Mar 2026) 2 (3) 2026/03/10 09:57
[syzbot] Monthly media report (Jan 2026) 0 (1) 2026/01/29 11:51
[syzbot] Monthly media report (Oct 2025) 0 (1) 2025/10/27 12:50
[syzbot] Monthly media report (Sep 2025) 0 (1) 2025/09/26 05:14
[syzbot] Monthly media report (Aug 2025) 0 (1) 2025/08/26 07:14
[syzbot] Monthly media report (Jul 2025) 0 (1) 2025/07/26 20:43
[syzbot] [media?] KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (4) 0 (1) 2025/07/14 07:23
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer 21 3 271d 307d 0/3 auto-obsoleted due to no activity on 2025/09/22 17:26
upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (3) media 21 C 271 250d 604d 29/29 fixed on 2025/07/08 00:33
upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer media 21 1 2245d 2245d 0/29 auto-closed as invalid on 2020/05/17 19:44
linux-5.15 KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer 21 1 1059d 1059d 0/3 auto-obsoleted due to no activity on 2023/08/17 04:37
upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (2) media 21 C inconclusive done 14 1137d 1649d 22/29 fixed on 2023/02/24 13:51
linux-4.19 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) 8 syz error 8 1183d 1684d 0/1 upstream: reported syz repro on 2021/08/02 00:51
linux-4.14 BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) 8 1 1518d 1518d 0/1 auto-closed as invalid on 2022/05/15 07:48
upstream BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) media 8 1 1067d 1063d 0/29 auto-obsoleted due to no activity on 2023/07/09 12:46

Sample crash report:
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1b9b/0x5ec0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
Write of size 2560 at addr ffffc90004336620 by task vivid-000-vid-c/7790

CPU: 0 UID: 0 PID: 7790 Comm: vivid-000-vid-c Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xba/0x230 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
 tpg_fill_plane_buffer+0x1b9b/0x5ec0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]
 vivid_thread_vid_cap_tick+0x1021/0x5fd0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629
 vivid_thread_vid_cap+0x909/0x1190 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a 6-page vmalloc region starting at 0xffffc90004331000 allocated at vb2_vmalloc_alloc+0xef/0x360 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x9e0a3
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: ffffffffffffffff 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 7789, tgid 7788 (syz.5.9709), ts 1732842868988, free_ts 1732729904013
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2484
 alloc_frozen_pages_noprof mm/mempolicy.c:2555 [inline]
 alloc_pages_noprof+0xa8/0x190 mm/mempolicy.c:2575
 vm_area_alloc_pages mm/vmalloc.c:3662 [inline]
 __vmalloc_area_node mm/vmalloc.c:3876 [inline]
 __vmalloc_node_range_noprof+0x79b/0x1730 mm/vmalloc.c:4064
 vmalloc_user_noprof+0xad/0xe0 mm/vmalloc.c:4218
 vb2_vmalloc_alloc+0xef/0x360 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47
 __vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:242 [inline]
 __vb2_queue_alloc+0x9c5/0x15a0 drivers/media/common/videobuf2/videobuf2-core.c:523
 vb2_core_reqbufs+0xc1f/0x1410 drivers/media/common/videobuf2/videobuf2-core.c:958
 __vb2_init_fileio+0x318/0xff0 drivers/media/common/videobuf2/videobuf2-core.c:2879
 __vb2_perform_fileio+0x282/0x1620 drivers/media/common/videobuf2/videobuf2-core.c:3025
 vb2_fop_read+0x273/0x360 drivers/media/common/videobuf2/videobuf2-v4l2.c:1215
 v4l2_read+0x19c/0x2c0 drivers/media/v4l2-core/v4l2-dev.c:316
 loop_rw_iter+0x42c/0x680 include/linux/uio.h:-1
 io_iter_do_read io_uring/rw.c:837 [inline]
 __io_read+0x134b/0x1520 io_uring/rw.c:951
page last free pid 7759 tgid 7756 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
 mm_free_pgd kernel/fork.c:585 [inline]
 __mmdrop+0xb5/0x750 kernel/fork.c:727
 exit_mm+0x168/0x220 kernel/exit.c:581
 do_exit+0x6a2/0x23c0 kernel/exit.c:964
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1118
 get_signal+0x1284/0x1330 kernel/signal.c:3034
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffffc90004336f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90004336f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90004337000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90004337080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90004337100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (141):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/11 22:44 upstream b29fb8829bff 2d88ab01 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/03/08 01:15 upstream 4ae12d8bd9a8 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/03/07 02:20 upstream 651690480a96 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/03/01 15:18 upstream eb71ab2bf722 43249bac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/24 08:24 upstream 7dff99b35460 41d2fa6a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/20 05:18 upstream 8bf22c33e7a1 17d780d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/15 05:16 upstream ca4ee40bf13d 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/07 17:05 upstream 2687c848e578 f20fc9f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/06 19:56 upstream b7ff7151e653 97745f52 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/05 02:37 upstream 5fd0a1df5d05 ea10c935 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/03 21:09 upstream 6bd9ed02871f 6df4c87a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/29 16:43 upstream 8dfce8991b95 aeb6fdd5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/22 07:43 upstream cf38b2340c0e 101dad69 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/18 19:22 upstream e84d960149e7 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/17 02:04 upstream 983d014aafb1 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/14 17:48 upstream c537e12daeec d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/08 08:40 upstream f0b9d8eb98df d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/07 19:54 upstream f0b9d8eb98df d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2025/12/13 07:05 upstream 9551a26f17d9 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2025/08/31 04:04 upstream c8bc81a52d5a 807a3b61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2025/07/09 05:53 upstream d006330be3f7 abade794 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2025/07/08 19:00 upstream d006330be3f7 abade794 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/03 08:37 upstream dee65f79364c d78927dd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/20 11:02 upstream 24d479d26b25 572effc1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/17 13:37 upstream b62ce2547fe8 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/03/02 02:50 upstream 39c633261414 43249bac .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/25 01:47 upstream 7dff99b35460 787dfb7c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/22 17:44 upstream 32a92f8c8932 6e7b5511 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/19 11:09 upstream 23b0f90ba871 746545b8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/17 15:14 upstream 970296997869 4db8fa92 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/15 15:54 upstream ca4ee40bf13d 1e62d198 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/15 11:36 upstream ca4ee40bf13d 1e62d198 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/13 13:31 upstream 7449f86bafcd 6a673c50 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/11 17:00 upstream 192c0159402e 75707236 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/09 12:13 upstream 05f7e89ab973 df949cd9 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/05 17:20 upstream f14faaf3a1fb 4936e85c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/04 19:53 upstream 5fd0a1df5d05 ea10c935 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/03 04:02 upstream dee65f79364c d78927dd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/02/02 13:52 upstream 18f7fcd5e69a 018ebef2 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/30 03:06 upstream 4d310797262f bfa73b7b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/29 08:23 upstream 8dfce8991b95 0adc945e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/28 07:55 upstream 1f97d9dcf536 3029c699 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/19 17:27 upstream 24d479d26b25 d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/05 21:10 upstream 3609fa95fb0f d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/05 17:44 upstream 3609fa95fb0f d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/04 05:18 upstream aacb0a6d604a d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/01 09:42 upstream 349bd28a86f2 d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2025/12/30 13:23 upstream 8640b74557fc d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/03/12 22:10 upstream 8004279c41ad 2f7f359d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/18 13:15 linux-next 46fe65a2c28e d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/01/02 16:04 linux-next cc3aa43b44bd d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2025/12/27 05:38 linux-next cc3aa43b44bd d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
* Struck through repros no longer work on HEAD.