Warning: Permanently added '[localhost]:26359' (ED25519) to the list of known hosts. executing program [ 69.838264][ T5304] ================================================================== [ 69.841495][ T5304] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 69.844846][ T5304] Write of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304 [ 69.849650][ T5304] [ 69.850852][ T5304] CPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0 [ 69.850870][ T5304] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.850880][ T5304] Call Trace: [ 69.850889][ T5304] [ 69.850896][ T5304] dump_stack_lvl+0x241/0x360 [ 69.850912][ T5304] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.850924][ T5304] ? __pfx__printk+0x10/0x10 [ 69.850942][ T5304] ? _printk+0xd5/0x120 [ 69.850960][ T5304] print_report+0x169/0x550 [ 69.850983][ T5304] ? __virt_addr_valid+0xbd/0x530 [ 69.851010][ T5304] ? tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 69.851024][ T5304] kasan_report+0x143/0x180 [ 69.851043][ T5304] ? tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 69.851057][ T5304] kasan_check_range+0x282/0x290 [ 69.851068][ T5304] ? tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 69.851081][ T5304] __asan_memcpy+0x40/0x70 [ 69.851097][ T5304] tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 69.851127][ T5304] vivid_thread_vid_cap_tick+0xf8e/0x60d0 [ 69.851145][ T5304] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 69.851164][ T5304] ? do_raw_spin_unlock+0x58/0x8b0 [ 69.851187][ T5304] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 69.851207][ T5304] vivid_thread_vid_cap+0x8aa/0xf30 [ 69.851226][ T5304] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 69.851238][ T5304] kthread+0x7a9/0x920 [ 69.851254][ T5304] ? __pfx_kthread+0x10/0x10 [ 69.851270][ T5304] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 69.851282][ T5304] ? __pfx_kthread+0x10/0x10 [ 69.851298][ T5304] ? __pfx_kthread+0x10/0x10 [ 69.851314][ T5304] ? __pfx_kthread+0x10/0x10 [ 69.851329][ T5304] ? _raw_spin_unlock_irq+0x23/0x50 [ 69.851345][ T5304] ? lockdep_hardirqs_on+0x99/0x150 [ 69.851360][ T5304] ? __pfx_kthread+0x10/0x10 [ 69.851377][ T5304] ret_from_fork+0x4b/0x80 [ 69.851393][ T5304] ? __pfx_kthread+0x10/0x10 [ 69.851410][ T5304] ret_from_fork_asm+0x1a/0x30 [ 69.851428][ T5304] [ 69.851434][ T5304] [ 69.927853][ T5304] The buggy address belongs to the virtual mapping at [ 69.927853][ T5304] [ffffc9000d0e9000, ffffc9000d101000) created by: [ 69.927853][ T5304] vb2_vmalloc_alloc+0xf2/0x340 [ 69.934798][ T5304] [ 69.935919][ T5304] The buggy address belongs to the physical page: [ 69.939032][ T5304] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43e47 [ 69.943037][ T5304] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 69.946184][ T5304] raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 69.949504][ T5304] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 69.952887][ T5304] page dumped because: kasan: bad access detected [ 69.955370][ T5304] page_owner tracks the page as allocated [ 69.958022][ T5304] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5303, tgid 5303 (syz-executor881), ts 69776556067, free_ts 68046210271 [ 69.965598][ T5304] post_alloc_hook+0x1f4/0x240 [ 69.967355][ T5304] get_page_from_freelist+0x365c/0x37a0 [ 69.969645][ T5304] __alloc_frozen_pages_noprof+0x292/0x710 [ 69.972001][ T5304] alloc_pages_mpol+0x311/0x660 [ 69.973922][ T5304] alloc_pages_noprof+0x121/0x190 [ 69.976181][ T5304] __vmalloc_node_range_noprof+0x9c6/0x1380 [ 69.978376][ T5304] vmalloc_user_noprof+0x74/0x80 [ 69.980294][ T5304] vb2_vmalloc_alloc+0xf2/0x340 [ 69.982143][ T5304] __vb2_queue_alloc+0xa0b/0x16f0 [ 69.983960][ T5304] vb2_core_reqbufs+0xd2e/0x17c0 [ 69.985850][ T5304] __vb2_init_fileio+0x319/0xf90 [ 69.987698][ T5304] __vb2_perform_fileio+0x31a/0x17b0 [ 69.989609][ T5304] vb2_fop_read+0x247/0x330 [ 69.991327][ T5304] v4l2_read+0x1a4/0x2c0 [ 69.993334][ T5304] vfs_read+0x1f8/0xb40 [ 69.995179][ T5304] ksys_read+0x18f/0x2b0 [ 69.996779][ T5304] page last free pid 5290 tgid 5290 stack trace: [ 69.999157][ T5304] free_frozen_pages+0xe0d/0x10e0 [ 70.001009][ T5304] __put_partials+0x160/0x1c0 [ 70.002821][ T5304] put_cpu_partial+0x17c/0x250 [ 70.004753][ T5304] __slab_free+0x290/0x380 [ 70.006646][ T5304] qlist_free_all+0x9a/0x140 [ 70.008751][ T5304] kasan_quarantine_reduce+0x14f/0x170 [ 70.011143][ T5304] __kasan_slab_alloc+0x23/0x80 [ 70.013203][ T5304] kmem_cache_alloc_noprof+0x1d9/0x380 [ 70.015607][ T5304] vm_area_dup+0x27/0x290 [ 70.017491][ T5304] __split_vma+0x1cb/0xc50 [ 70.019538][ T5304] vms_gather_munmap_vmas+0x2e6/0x1600 [ 70.022484][ T5304] do_vmi_align_munmap+0x3ff/0x6f0 [ 70.024770][ T5304] do_vmi_munmap+0x24e/0x2d0 [ 70.026573][ T5304] __vm_munmap+0x372/0x510 [ 70.028399][ T5304] __x64_sys_munmap+0x60/0x70 [ 70.030434][ T5304] do_syscall_64+0xf3/0x230 [ 70.032274][ T5304] [ 70.033255][ T5304] Memory state around the buggy address: [ 70.036003][ T5304] ffffc9000d0fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.039547][ T5304] ffffc9000d0fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 70.043170][ T5304] >ffffc9000d100000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 70.046426][ T5304] ^ [ 70.047898][ T5304] ffffc9000d100080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 70.050871][ T5304] ffffc9000d100100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 70.053946][ T5304] ================================================================== [ 70.065582][ T5304] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 70.068326][ T5304] CPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0 [ 70.072416][ T5304] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 70.076391][ T5304] Call Trace: [ 70.077953][ T5304] [ 70.079512][ T5304] dump_stack_lvl+0x241/0x360 [ 70.081800][ T5304] ? __pfx_dump_stack_lvl+0x10/0x10 [ 70.084018][ T5304] ? __pfx__printk+0x10/0x10 [ 70.085800][ T5304] ? preempt_schedule+0xe1/0xf0 [ 70.087555][ T5304] ? vscnprintf+0x5d/0x90 [ 70.089111][ T5304] panic+0x349/0x880 [ 70.090557][ T5304] ? check_panic_on_warn+0x21/0xb0 [ 70.092497][ T5304] ? __pfx_panic+0x10/0x10 [ 70.094200][ T5304] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 70.096264][ T5304] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 70.098563][ T5304] ? print_report+0x502/0x550 [ 70.100678][ T5304] check_panic_on_warn+0x86/0xb0 [ 70.103675][ T5304] ? tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 70.106487][ T5304] end_report+0x77/0x160 [ 70.108114][ T5304] kasan_report+0x154/0x180 [ 70.109803][ T5304] ? tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 70.111920][ T5304] kasan_check_range+0x282/0x290 [ 70.113862][ T5304] ? tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 70.115859][ T5304] __asan_memcpy+0x40/0x70 [ 70.117725][ T5304] tpg_fill_plane_buffer+0x1a9c/0x5af0 [ 70.119961][ T5304] vivid_thread_vid_cap_tick+0xf8e/0x60d0 [ 70.122357][ T5304] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 70.124891][ T5304] ? do_raw_spin_unlock+0x58/0x8b0 [ 70.126925][ T5304] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 70.129276][ T5304] vivid_thread_vid_cap+0x8aa/0xf30 [ 70.131169][ T5304] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 70.133534][ T5304] kthread+0x7a9/0x920 [ 70.135353][ T5304] ? __pfx_kthread+0x10/0x10 [ 70.137361][ T5304] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 70.139801][ T5304] ? __pfx_kthread+0x10/0x10 [ 70.141634][ T5304] ? __pfx_kthread+0x10/0x10 [ 70.143323][ T5304] ? __pfx_kthread+0x10/0x10 [ 70.145009][ T5304] ? _raw_spin_unlock_irq+0x23/0x50 [ 70.146988][ T5304] ? lockdep_hardirqs_on+0x99/0x150 [ 70.148927][ T5304] ? __pfx_kthread+0x10/0x10 [ 70.150612][ T5304] ret_from_fork+0x4b/0x80 [ 70.152458][ T5304] ? __pfx_kthread+0x10/0x10 [ 70.154511][ T5304] ret_from_fork_asm+0x1a/0x30 [ 70.156852][ T5304] [ 70.158833][ T5304] Kernel Offset: disabled [ 70.160546][ T5304] Rebooting in 86400 seconds.. VM DIAGNOSIS: 09:10:55 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000069 RBX=ffffffff9a748080 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc9000d126e50 R8 =ffffffff8576cadb R9 =1ffff11000095046 R10=dffffc0000000000 R11=ffffffff8576ca90 R12=dffffc0000000000 R13=0000000000000069 R14=0000000000000069 R15=00000000000003f8 RIP=ffffffff8576cb0e RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88801fc00000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f889fe35000 CR3=000000003f146000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000400000 Opmask01=0000000000000001 Opmask02=00000000fff7ffff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f889fee9a5e 00007f889fec0000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f889fedc0a4 00007f889feef260 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f889fef6320 00007f889feea5d8 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f889fedc0a4 00007f889feef260 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 746f6f723d524553 5500383931353133 313838726f747563 6578652d7a79732f ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000