[BUG] drm: lease: WARNING in the page allocator from drm_mode_create_lease_ioctl

[BUG] drm: lease: WARNING in the page allocator from drm_mode_create_lease_ioctl

[CJ]

Hi,




I am reporting a WARNING from the page allocator on the DRM lease-creation path,
triggered by a syzkaller reproducer.  The issue is reproducible with HEAD commit
cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).




The reproducer opens a DRM render node and issues DRM_IOCTL_MODE_CREATE_LEASE
with an object id array whose length field is 1000000 while the array itself
contains a single id.




The console shows a WARNING at mm/page_alloc.c:5340 with RIP in
__alloc_frozen_pages_noprof, reached from drm_mode_create_lease_ioctl through the
lease object bookkeeping.  On the kernel where this was first reported the same
warning was recorded at mm/page_alloc.c:5398 in __alloc_pages, which is the same
allocation path before a later refactor, and the caller is the same ioctl.




One possible cause is that the length the ioctl supplies for the object id array
is used to size an allocation without being checked against the number of objects
that can actually exist, so the request reaches the allocator with a size or
order the allocator warns about.  This looks like a missing bound on a
user-supplied count rather than an allocator defect.  I am reporting the warning
and the path as observed.




This appears to be a recurrence of the syzbot issue whose external id is
f26744b52ab87f2864e3.  It remains reproducible on v7.3-rc1.




Reproducer:




syz reproducer:
r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[0x0], 0xf4240})




console output: https://pastebin.com/raw/1S4PEBQU


kernel config: https://pastebin.com/raw/Vu5Ky4uj




Kernel:




HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)




Let me know if you need more details or testing.




Best regards,
Changjian