==================================================================
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x12c4/0x43a4 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
Write of size 360 at addr ffff80009456fea0 by task vivid-000-vid-c/14758

CPU: 0 UID: 0 PID: 14758 Comm: vivid-000-vid-c Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __asan_memcpy+0x54/0x84 mm/kasan/shadow.c:106
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
 tpg_fill_plane_buffer+0x12c4/0x43a4 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]
 vivid_thread_vid_cap_tick+0xf70/0x47f4 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629
 vivid_thread_vid_cap+0x698/0xdf8 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767
 kthread+0x2f8/0x3c8 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842

The buggy address belongs to a vmalloc virtual mapping
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x2010d pfn:0x1516a8
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 000000000002010d 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff80009456ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff80009456ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff800094570000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffff800094570080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffff800094570100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Unable to handle kernel paging request at virtual address ffff800094570000
KASAN: probably user-memory-access in range [0x00000004a2b80000-0x00000004a2b80007]
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000
  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b2ad000
[ffff800094570000] pgd=0000000000000000, p4d=1000000221564003, pud=1000000221565003, pmd=1000000107655403, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 14758 Comm: vivid-000-vid-c Tainted: G    B        L      syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __pi_memcpy_generic+0x184/0x22c arch/arm64/lib/memcpy.S:189
lr : __asan_memcpy+0x68/0x84 mm/kasan/shadow.c:109
sp : ffff800096537470
x29: ffff800096537470 x28: ffff800098738006 x27: dfff800000000000
x26: ffff80009456fec0 x25: 00000000000001d8 x24: 0000000000000000
x23: ffff800098738000 x22: ffff800083a2e1f4 x21: ffff80009456fec0
x20: ffff800098738006 x19: 0000000000000168 x18: 0000000000000004
x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 02ff02ff02ff0000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800094570028 x4 : ffff80009873816e x3 : ffff80009456ffc0
x2 : ffffffffffffffd8 x1 : ffff800098738146 x0 : ffff80009456fec0
Call trace:
 __pi_memcpy_generic+0x184/0x22c arch/arm64/lib/memcpy.S:188 (P)
 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:-1 [inline]
 tpg_fill_plane_buffer+0x12c4/0x43a4 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]
 vivid_thread_vid_cap_tick+0xf70/0x47f4 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629
 vivid_thread_vid_cap+0x698/0xdf8 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767
 kthread+0x2f8/0x3c8 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: a9022468 a97e2488 a9032c6a a97f2c8a (a904346c) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	a9022468 	stp	x8, x9, [x3, #32]
   4:	a97e2488 	ldp	x8, x9, [x4, #-32]
   8:	a9032c6a 	stp	x10, x11, [x3, #48]
   c:	a97f2c8a 	ldp	x10, x11, [x4, #-16]
* 10:	a904346c 	stp	x12, x13, [x3, #64] <-- trapping instruction