==================================================================
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x128c/0x44a0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
Write of size 5120 at addr ffff800094929000 by task vivid-000-vid-c/13390

CPU: 0 UID: 0 PID: 13390 Comm: vivid-000-vid-c Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __asan_memcpy+0x54/0x84 mm/kasan/shadow.c:106
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
 tpg_fill_plane_buffer+0x128c/0x44a0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]
 vivid_thread_vid_cap_tick+0x130c/0x4b58 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629
 vivid_thread_vid_cap+0x6f0/0xe28 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842

The buggy address belongs to a 1-page vmalloc region starting at 0xffff800094929000 allocated at vb2_vmalloc_alloc+0xf8/0x304 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000d52a1000 pfn:0x1152a1
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff0000d52a1000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff800094929f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff800094929f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff80009492a000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffff80009492a080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffff80009492a100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Unable to handle kernel paging request at virtual address ffff80009492a000
KASAN: probably user-memory-access in range [0x00000004a4950000-0x00000004a4950007]
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000
  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b1fc000
[ffff80009492a000] pgd=0000000000000000, p4d=10000002214ba003, pud=10000002214bb003, pmd=100000010824f403, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 13390 Comm: vivid-000-vid-c Tainted: G    B        L      syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __pi_memcpy_generic+0x158/0x22c arch/arm64/lib/memcpy.S:175
lr : __asan_memcpy+0x68/0x84 mm/kasan/shadow.c:109
sp : ffff8000942c7490
x29: ffff8000942c7490 x28: 00000000000002c1 x27: 00000000000000ab
x26: 0000000000001400 x25: ffff8000975fc000 x24: 0000000000000000
x23: dfff800000000000 x22: ffff800083ad5d9c x21: ffff800094929040
x20: ffff8000975fc000 x19: 0000000000001400 x18: 0000000000000001
x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d
x14: 0000000000000000 x13: 000000bf000000bf x12: 000000bf000000bf
x11: 000000bf000000bf x10: 000000bf000000bf x9 : 000000bf000000bf
x8 : 000000bf000000bf x7 : 000000bf000000bf x6 : 000000bf000000bf
x5 : ffff80009492a440 x4 : ffff8000975fd400 x3 : ffff800094929fc0
x2 : 00000000000003f0 x1 : ffff8000975fcfc0 x0 : ffff800094929040
Call trace:
 __pi_memcpy_generic+0x158/0x22c arch/arm64/lib/memcpy.S:174 (P)
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
 tpg_fill_plane_buffer+0x128c/0x44a0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]
 vivid_thread_vid_cap_tick+0x130c/0x4b58 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629
 vivid_thread_vid_cap+0x6f0/0xe28 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: a9022468 a9422428 a9032c6a a9432c2a (a984346c) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	a9022468 	stp	x8, x9, [x3, #32]
   4:	a9422428 	ldp	x8, x9, [x1, #32]
   8:	a9032c6a 	stp	x10, x11, [x3, #48]
   c:	a9432c2a 	ldp	x10, x11, [x1, #48]
* 10:	a984346c 	stp	x12, x13, [x3, #64]! <-- trapping instruction