WARNING in drm_syncobj_array_find

Status: upstream: reported C repro on 2023/09/06 11:42
Subsystems: dri mm
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+95416f957d84e858b377@syzkaller.appspotmail.com
First crash: 1166d, last: 56m
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
3e307748 patching 💥 WARNING in drm_syncobj_array_find 2026/10/19 13:44 2026/10/19 16:23 2026/10/19 16:49 e931f328
98c58fa2 patching 💥 WARNING in drm_syncobj_array_find 2026/10/12 22:27 2026/10/13 02:03 2026/10/13 02:28 745a967f
3600de84 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ WARNING in drm_syncobj_array_find 2026/05/23 02:16 2026/05/23 02:16 2026/05/23 02:46 df8ac09c
▶ ▼ Discussions (34)
Title Replies (including bot) Last reply
[PATCH v3] drm/syncobj: Limit the number of handles and use kvmalloc for user-sized arrays 3 (3) 2026/11/10 08:49
[PATCH v2] drm/syncobj: Limit the number of handles and use kvmalloc for user-sized arrays 8 (8) 2026/11/06 09:55
[syzbot] [dri?] WARNING in drm_syncobj_array_find 0 (4) 2026/11/04 02:37
[PATCH] drm/syncobj: Silence allocation warnings for user-sized arrays 2 (2) 2026/11/03 09:46
[syzbot] Monthly dri report (May 2026) 0 (1) 2026/05/02 12:32
[syzbot] Monthly dri report (Apr 2026) 0 (1) 2026/04/01 07:42
[syzbot] Monthly dri report (Mar 2026) 0 (1) 2026/03/01 06:22
[syzbot] Monthly dri report (Jan 2026) 0 (1) 2026/01/28 22:39
[PATCH] drm/syncobj: Validate count_handles to prevent large allocations in array_find() 1 (1) 2025/12/27 16:08
[PATCH RESEND] drm/syncobj: Validate count_handles to prevent large allocations in array_find() 1 (1) 2025/12/06 22:00
[PATCH] drm/syncobj: Validate count_handles to prevent large allocations in array_find() 1 (1) 2025/11/27 17:35
[PATCH] drm/syncobj: Prevent overflow and large kmalloc in array_find() 1 (2) 2025/11/27 13:22
[syzbot] Monthly dri report (Nov 2025) 0 (1) 2025/11/27 07:44
[syzbot] Monthly dri report (Oct 2025) 0 (1) 2025/10/27 08:42
[syzbot] Monthly dri report (Sep 2025) 0 (1) 2025/09/25 16:00
[syzbot] Monthly dri report (Aug 2025) 0 (1) 2025/08/25 13:19
[syzbot] Monthly dri report (Jul 2025) 0 (1) 2025/07/25 12:39
[syzbot] Monthly dri report (Jun 2025) 0 (1) 2025/06/24 07:38
[syzbot] Monthly dri report (Jan 2025) 0 (1) 2025/01/15 13:48
[syzbot] Monthly dri report (Dec 2024) 0 (1) 2024/12/16 09:44
[syzbot] Monthly dri report (Nov 2024) 0 (1) 2024/11/14 08:59
[syzbot] Monthly dri report (Oct 2024) 0 (1) 2024/10/13 19:21
[syzbot] Monthly dri report (Sep 2024) 0 (1) 2024/09/12 14:24
[syzbot] Monthly dri report (Aug 2024) 0 (1) 2024/08/13 08:54
[syzbot] Monthly dri report (Jul 2024) 0 (1) 2024/07/12 10:05
[syzbot] Monthly dri report (Jun 2024) 0 (1) 2024/06/10 12:41
[syzbot] Monthly dri report (May 2024) 0 (1) 2024/05/06 13:18
[syzbot] Monthly dri report (Apr 2024) 0 (1) 2024/04/05 12:37
[syzbot] Monthly dri report (Mar 2024) 0 (1) 2024/03/05 11:09
[syzbot] Monthly dri report (Feb 2024) 0 (1) 2024/02/02 21:05
[syzbot] Monthly dri report (Jan 2024) 0 (1) 2024/01/02 13:36
[syzbot] Monthly dri report (Nov 2023) 0 (1) 2023/11/30 20:33
[syzbot] Monthly dri report (Oct 2023) 0 (1) 2023/10/30 12:59
[syzbot] Monthly dri report (Sep 2023) 0 (1) 2023/09/28 11:42
▶ ▼ Last patch testing requests (14)
Created Duration User Patch Repo Result
2026/11/04 02:37 23m fei.yu@intel.com patch upstream OK job log log
2026/11/04 02:31 1m fei.yu@intel.com patch upstream error job log
2026/11/03 08:23 24m fei.yu@intel.com patch upstream OK job log log
2025/11/27 13:05 16m madhurkumar004@gmail.com patch upstream OK log
2025/04/21 15:20 24m retest repro upstream report log
2025/04/21 15:20 12m retest repro upstream report log
2025/04/21 15:20 12m retest repro upstream report log
2025/04/21 15:20 11m retest repro upstream report log
2025/04/21 12:54 27m retest repro upstream report log
2025/04/21 12:54 26m retest repro upstream report log
2025/04/21 12:54 26m retest repro upstream report log
2025/04/21 12:54 24m retest repro upstream report log
2025/02/10 13:09 15m retest repro upstream report log
2025/02/10 13:09 15m retest repro upstream report log

Sample crash report:
------------[ cut here ]------------
1
WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170 mm/slub.c:5459, CPU#0: syz.0.17/5581
Modules linked in:
CPU: 0 UID: 0 PID: 5581 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:___kmalloc_large_node+0x10c/0x170 mm/slub.c:5459
Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 98 ba 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 52 31 d4 09 cc 89 ef 89
RSP: 0018:ffffc90001bc7a00 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000100000920 RCX: ffff888035548000
RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 0000000100000920
RBP: 0000000000000cc0 R08: ffffffff85a49759 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff85adb330 R12: 1ffff92000378fb9
R13: ffffffff85adaf1a R14: 0000000100000920 R15: 0000000100000920
FS:  000055558d7c8500(0000) GS:ffff88808aa01000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2b5e388b80 CR3: 000000004536c000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5502
 __do_kmalloc_node mm/slub.c:5519 [inline]
 __kmalloc_noprof+0x3f6/0x710 mm/slub.c:5556
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 _kmalloc_array_noprof include/linux/slab.h:1211 [inline]
 drm_syncobj_array_find+0x3a/0x440 drivers/gpu/drm/drm_syncobj.c:1241
 drm_syncobj_timeline_wait_ioctl+0x18a/0x640 drivers/gpu/drm/drm_syncobj.c:1356
 drm_ioctl_kernel+0x2df/0x3b0 drivers/gpu/drm/drm_ioctl.c:817
 drm_ioctl+0x70e/0xba0 drivers/gpu/drm/drm_ioctl.c:914
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2b5e39f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe5342e528 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2b5e625fa0 RCX: 00007f2b5e39f559
RDX: 0000200000000280 RSI: 00000000c03064ca RDI: 0000000000000004
RBP: 00007f2b5e436b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2b5e625fac R14: 00007f2b5e625fa0 R15: 00007f2b5e625fa0
 </TASK>

Crashes (4837):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/01 18:03 upstream cbbddb6b08cc 25a0ae84 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/07/23 13:19 upstream 4539944e5151 4a865b71 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/01/04 04:48 upstream aacb0a6d604a d1b870e1 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2025/09/25 21:33 upstream bf40f4b87761 0abd0691 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2024/12/10 14:37 upstream 7cb1b4663150 cfc402b4 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2024/12/01 05:06 upstream d8b78066f4c9 68914665 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2024/10/10 15:29 upstream d3d1556696c1 a156c552 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2024/07/15 19:58 upstream 0c3836482481 efee4ed2 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2024/04/04 20:33 upstream c85af715cac0 0ee3535e .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2024/03/26 03:40 upstream 928a87efa423 bcd9b39f .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2023/12/17 02:52 upstream c8e97fc6b4c0 3222d10c .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2023/09/02 12:16 upstream 0468be89b3fa 696ea0d2 .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/11/12 07:52 upstream 79eb6679ef6a 8d68b303 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/11 18:10 upstream 067c5c24cef2 e56a968c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/11/11 07:25 upstream 067c5c24cef2 d3056657 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/11 02:39 upstream 067c5c24cef2 d3056657 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/11 01:12 upstream 067c5c24cef2 d3056657 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/10 23:54 upstream 067c5c24cef2 d3056657 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/11/10 12:33 upstream b3dfbde62cf1 01625235 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/09 05:49 upstream 8a65162514fb 5cecaf1f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/11/08 09:18 upstream d164c7d754f0 5cecaf1f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/11/07 15:10 upstream d48723711bae 5cecaf1f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/06 13:43 upstream f66469d9905b 5cecaf1f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/11/06 01:17 upstream d68ce4e71248 5cecaf1f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/05 16:13 upstream 05441d697f7f 5cecaf1f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/05 11:04 upstream 05441d697f7f 2ee8459f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/11/04 22:47 upstream 05441d697f7f 73438ed0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/04 19:56 upstream 05441d697f7f 73438ed0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/03 07:31 upstream 6628e7d4c6b2 0a94d799 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/02 17:48 upstream 6628e7d4c6b2 6969b601 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/02 07:36 upstream 46fec1c3029b 25a0ae84 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/11/01 16:53 upstream cbbddb6b08cc 25a0ae84 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/31 11:22 upstream abf8c33470f7 2041d3f8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/31 07:26 upstream abf8c33470f7 2041d3f8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/31 02:09 upstream abf8c33470f7 2041d3f8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/30 20:27 upstream d89e1d186ec9 0ec395f8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/30 17:56 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/30 04:09 upstream 4dd16e31135e b498adee .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/29 20:12 upstream 4dd16e31135e 4902417d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/29 15:11 upstream c339f4010dea 4902417d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/29 12:57 upstream c339f4010dea 4902417d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/28 17:08 upstream 65ba8f34ec88 858db2ec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/28 15:14 upstream 65ba8f34ec88 858db2ec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/28 09:11 upstream 65ba8f34ec88 96923c60 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/27 13:42 upstream d135ab453a74 96923c60 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/27 03:17 upstream d135ab453a74 168cb7a2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/25 03:11 upstream 5b0764a53235 1d9ca40b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/24 10:34 upstream 26344c0dd32a 1d9ca40b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/23 20:41 upstream 734bef548a96 1d9ca40b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/23 19:27 upstream 734bef548a96 1d9ca40b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/23 08:27 upstream a1c2b1da93f5 d566bfda .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/23 06:43 upstream 3ac032ef6ca8 d566bfda .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/22 17:40 upstream 7be4bc52fd9e 3875c4e4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/22 15:35 upstream 7be4bc52fd9e 3875c4e4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/22 10:22 upstream 4df4d2a577db 4ba27f85 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/21 19:44 upstream a804c5742bff 42e06812 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/21 01:24 upstream 4cbdd58dfa7a 61c200c7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/20 18:33 upstream f47d223627f8 df8746fb .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
2026/10/20 06:37 upstream c03c1a14507d 21286ae2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in drm_syncobj_array_find
2026/10/20 05:33 upstream c03c1a14507d 21286ae2 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in drm_syncobj_array_find
* Struck through repros no longer work on HEAD.