==================================================================
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1594/0x4aec drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1
Write of size 1440 at addr ffff800020f2fda0 by task vivid-000-vid-c/4585

CPU: 0 PID: 4585 Comm: vivid-000-vid-c Not tainted 6.1.141-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 print_address_description+0x88/0x220 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:427
 kasan_report+0xa8/0x100 mm/kasan/report.c:531
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x260/0x2a0 mm/kasan/generic.c:189
 memcpy+0x60/0x90 mm/kasan/shadow.c:66
 tpg_fill_plane_buffer+0x1594/0x4aec drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1
 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]
 vivid_thread_vid_cap_tick+0x1574/0x5694 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:729
 vivid_thread_vid_cap+0x688/0xdb8 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:872
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

The buggy address belongs to the virtual mapping at
 [ffff800020f19000, ffff800020f31000) created by:
 vb2_vmalloc_alloc+0xf8/0x2d4 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47

The buggy address belongs to the physical page:
page:0000000063feab4c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1132d7
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff800020f2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff800020f2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff800020f30000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffff800020f30080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffff800020f30100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Unable to handle kernel paging request at virtual address ffff800020f30340
KASAN: probably user-memory-access in range [0x0000000107981a00-0x0000000107981a07]
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047
  CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000020e41a000
[ffff800020f30340] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003
, pmd=10000001098d9003, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4585 Comm: vivid-000-vid-c Tainted: G    B              6.1.141-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __memcpy+0x128/0x260 arch/arm64/lib/memcpy.S:161
lr : memcpy+0x74/0x90 mm/kasan/shadow.c:69
sp : ffff800020fb74c0
x29: ffff800020fb74c0 x28: ffff800020f30340 x27: 0000000000000042
x26: 1fffe0001a722f8a x25: 0000000000000007 x24: 1fffe0001a722f8a
x23: 0000000000000000 x22: ffff80000e135df8 x21: ffff800020f30340
x20: ffff800027809164 x19: 00000000000005a0 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008042940 x15: 0000000000000000
x14: 0000000000000000 x13: 80b380b380b380b3 x12: 80b380b380b380b3
x11: 0000000000000016 x10: ffff7000041e6118 x9 : ffff80001c2ce9d0
x8 : 0000000000000001 x7 : 80b380b380b380b3 x6 : 80b380b380b380b3
x5 : ffff800020f308e0 x4 : ffff800027809704 x3 : ffff800020f30340
x2 : 00000000000005a0 x1 : ffff800027809164 x0 : ffff800020f30340
Call trace:
 __memcpy+0x128/0x260 arch/arm64/lib/memcpy.S:160
 tpg_fill_plane_buffer+0x1594/0x4aec drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1
 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]
 vivid_thread_vid_cap_tick+0x1574/0x5694 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:729
 vivid_thread_vid_cap+0x688/0xdb8 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:872
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
Code: 927cec03 cb0e0021 8b0e0042 a9411c26 (a900340c) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	927cec03 	and	x3, x0, #0xfffffffffffffff0
   4:	cb0e0021 	sub	x1, x1, x14
   8:	8b0e0042 	add	x2, x2, x14
   c:	a9411c26 	ldp	x6, x7, [x1, #16]
* 10:	a900340c 	stp	x12, x13, [x0] <-- trapping instruction