Re: [syzbot] [media?] [dri?] WARNING in udmabuf_create

Re: [syzbot] [media?] [dri?] WARNING in udmabuf_create

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).


no interfaces have a carrier
[   83.165290][ T5279] 8021q: adding VLAN 0 to HW filter on device bond0
[   83.176651][ T5279] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting crond: OK
Starting sshd: OK

syzkaller
syzkaller login: [  114.243158][    T9] cfg80211: failed to load regulatory.db
Warning: Permanently added '10.128.0.233' (ED25519) to the list of known hosts.
2026/09/16 05:37:24 parsed 1 programs
2026/09/16 05:37:24 serving rpc on tcp://37581
[  121.891431][ T5631] cgroup: Unknown subsys name 'net'
[  122.014742][ T5631] cgroup: Unknown subsys name 'cpuset'
[  122.024234][ T5631] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[  123.962440][ T5631] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[  128.498958][ T5644] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[  128.521252][ T5644] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  128.524188][ T5644] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  129.376802][ T5653] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  129.377579][ T5653] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  129.514072][ T5659] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  129.514855][ T5659] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  129.515648][ T5659] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  129.516637][ T5659] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  129.517407][ T5659] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  130.480696][   T45] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  130.480735][   T45] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  130.543973][   T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  130.543998][   T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  132.024638][ T5677] bridge0: port 1(bridge_slave_0) entered blocking state
[  132.025532][ T5677] bridge0: port 1(bridge_slave_0) entered disabled state
[  132.025672][ T5677] bridge_slave_0: entered allmulticast mode
[  132.027949][ T5677] bridge_slave_0: entered promiscuous mode
[  132.076170][ T5677] bridge0: port 2(bridge_slave_1) entered blocking state
[  132.076834][ T5677] bridge0: port 2(bridge_slave_1) entered disabled state
[  132.077022][ T5677] bridge_slave_1: entered allmulticast mode
[  132.102933][ T5677] bridge_slave_1: entered promiscuous mode
[  132.174547][ T5677] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  132.187486][ T5677] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  132.250540][ T5677] team0: Port device team_slave_0 added
[  132.254042][ T5677] team0: Port device team_slave_1 added
[  132.300085][ T5677] batman_adv: batadv0: Adding interface: batadv_slave_0
[  132.300106][ T5677] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  132.300139][ T5677] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  132.303509][ T5677] batman_adv: batadv0: Adding interface: batadv_slave_1
[  132.303529][ T5677] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  132.303640][ T5677] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  132.507651][ T5677] hsr_slave_0: entered promiscuous mode
[  132.509065][ T5677] hsr_slave_1: entered promiscuous mode
[  132.809314][ T5677] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  132.845685][ T5677] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  132.847749][ T5677] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  132.874511][ T5677] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  132.876090][ T5677] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  132.884908][ T5677] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  132.887927][ T5677] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  132.915834][ T5677] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  133.036266][ T5677] 8021q: adding VLAN 0 to HW filter on device bond0
[  133.070741][ T5677] 8021q: adding VLAN 0 to HW filter on device team0
[  133.079036][ T2225] bridge0: port 1(bridge_slave_0) entered blocking state
[  133.079162][ T2225] bridge0: port 1(bridge_slave_0) entered forwarding state
[  133.126108][   T45] bridge0: port 2(bridge_slave_1) entered blocking state
[  133.126199][   T45] bridge0: port 2(bridge_slave_1) entered forwarding state
[  133.813277][ T5677] 8021q: adding VLAN 0 to HW filter on device batadv0
[  134.186699][ T5677] veth0_vlan: entered promiscuous mode
[  134.207669][ T5677] veth1_vlan: entered promiscuous mode
[  134.293216][ T5677] veth0_macvtap: entered promiscuous mode
[  134.311660][ T5677] veth1_macvtap: entered promiscuous mode
[  134.349115][ T5677] batman_adv: batadv0: Interface activated: batadv_slave_0
[  134.379343][ T5677] batman_adv: batadv0: Interface activated: batadv_slave_1
[  134.492045][   T62] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  134.551786][ T2225] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  134.552284][ T2225] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  134.620447][   T62] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  134.799248][   T59] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  135.874694][   T59] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
[  136.855213][   T59] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  136.952225][   T59] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.224278][   T59] bridge_slave_1: left allmulticast mode
[  137.224334][   T59] bridge_slave_1: left promiscuous mode
[  137.226112][   T59] bridge0: port 2(bridge_slave_1) entered disabled state
[  137.275171][   T59] bridge_slave_0: left allmulticast mode
[  137.275201][   T59] bridge_slave_0: left promiscuous mode
[  137.275530][   T59] bridge0: port 1(bridge_slave_0) entered disabled state
[  137.665003][   T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  137.680748][   T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  137.682596][   T59] bond0 (unregistering): Released all slaves
[  137.832212][   T59] hsr_slave_0: left promiscuous mode
[  137.832917][   T59] hsr_slave_1: left promiscuous mode
[  137.833650][   T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  137.833676][   T59] batman_adv: batadv0: Removing interface: batadv_slave_0
[  137.836225][   T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  137.836252][   T59] batman_adv: batadv0: Removing interface: batadv_slave_1
[  137.888093][   T59] veth1_macvtap: left promiscuous mode
[  137.888147][   T59] veth0_macvtap: left promiscuous mode
[  137.888227][   T59] veth1_vlan: left promiscuous mode
[  137.888334][   T59] veth0_vlan: left promiscuous mode
[  138.251598][   T59] team0 (unregistering): Port device team_slave_1 removed
[  138.291619][   T59] team0 (unregistering): Port device team_slave_0 removed
[  138.436400][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1
[  139.193435][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2
[  139.758608][ T5279] 8021q: adding VLAN 0 to HW filter on device eth3
[  139.843453][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  139.843541][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  140.207942][ T5279] 8021q: adding VLAN 0 to HW filter on device eth4


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build264506101=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 85995287a88
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_386
x86_64-linux-gnu-g++ -o ./bin/linux_386/syz-executor executor/executor.cc \
	-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_386=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"85995287a888340d8818a8f3c43e2e89555eea21\"
/usr/bin/ld: /tmp/cc3OdTDn.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x145): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
[INFO] Unsupported architecture '386', skipping check.



Tested on:

commit:         e7c98468 udmabuf: cap page count to allocation-safe li..
git tree:       https://github.com/yutao-intel/linux.git fix-dri-udmabuf_create
kernel config:  https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e
dashboard link: https://syzkaller.appspot.com/bug?extid=bfeed181d1ce9ec87a8f
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: i386

Note: no patches were applied.

Re: [syzbot] [media?] [dri?] WARNING in udmabuf_create

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).


Warning: Permanently added '10.128.1.174' (ED25519) to the list of known hosts.
2026/09/15 11:39:16 parsed 1 programs
2026/09/15 11:39:16 serving rpc on tcp://40329
[  164.032451][ T5644] cgroup: Unknown subsys name 'net'
[  164.136368][ T5644] cgroup: Unknown subsys name 'cpuset'
[  164.141195][ T5644] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[  166.199670][ T5644] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[  170.039756][ T5655] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[  170.066765][ T5655] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  170.069747][ T5655] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  170.748703][ T4936] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  170.750332][ T4936] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  170.751133][ T4936] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  170.794058][ T4936] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  170.795173][ T4936] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  172.618702][   T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  172.618731][   T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  172.704043][   T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  172.704068][   T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  173.936465][ T5688] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  173.937304][ T5688] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  174.893786][ T5695] bridge0: port 1(bridge_slave_0) entered blocking state
[  174.894352][ T5695] bridge0: port 1(bridge_slave_0) entered disabled state
[  174.894468][ T5695] bridge_slave_0: entered allmulticast mode
[  174.895993][ T5695] bridge_slave_0: entered promiscuous mode
[  174.909520][ T5695] bridge0: port 2(bridge_slave_1) entered blocking state
[  174.910196][ T5695] bridge0: port 2(bridge_slave_1) entered disabled state
[  174.910684][ T5695] bridge_slave_1: entered allmulticast mode
[  174.917803][ T5695] bridge_slave_1: entered promiscuous mode
[  174.988942][ T5695] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  175.003307][ T5695] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  175.039371][ T5695] team0: Port device team_slave_0 added
[  175.048961][ T5695] team0: Port device team_slave_1 added
[  175.079853][ T5695] batman_adv: batadv0: Adding interface: batadv_slave_0
[  175.079869][ T5695] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  175.079894][ T5695] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  175.089178][ T5695] batman_adv: batadv0: Adding interface: batadv_slave_1
[  175.089247][ T5695] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  175.089313][ T5695] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  175.219468][ T5695] hsr_slave_0: entered promiscuous mode
[  175.220866][ T5695] hsr_slave_1: entered promiscuous mode
[  175.462685][ T5695] netdevsim netdevsim8 netdevsim0: renamed from eth0
[  175.475140][ T5695] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  175.479413][ T5695] netdevsim netdevsim8 netdevsim1: renamed from eth1
[  175.504861][ T5695] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  175.505847][ T5695] netdevsim netdevsim8 netdevsim2: renamed from eth2
[  175.509981][ T5695] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  175.538865][ T5695] netdevsim netdevsim8 netdevsim3: renamed from eth3
[  175.550904][ T5695] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  175.596778][ T5695] bridge0: port 2(bridge_slave_1) entered blocking state
[  175.596992][ T5695] bridge0: port 2(bridge_slave_1) entered forwarding state
[  175.597537][ T5695] bridge0: port 1(bridge_slave_0) entered blocking state
[  175.597930][ T5695] bridge0: port 1(bridge_slave_0) entered forwarding state
[  175.709168][ T5695] 8021q: adding VLAN 0 to HW filter on device bond0
[  175.736293][   T49] bridge0: port 1(bridge_slave_0) entered disabled state
[  175.737639][   T49] bridge0: port 2(bridge_slave_1) entered disabled state
[  175.774915][ T5695] 8021q: adding VLAN 0 to HW filter on device team0
[  175.793556][ T1127] bridge0: port 1(bridge_slave_0) entered blocking state
[  175.793704][ T1127] bridge0: port 1(bridge_slave_0) entered forwarding state
[  175.826576][ T1127] bridge0: port 2(bridge_slave_1) entered blocking state
[  175.826677][ T1127] bridge0: port 2(bridge_slave_1) entered forwarding state
[  176.299025][ T5695] 8021q: adding VLAN 0 to HW filter on device batadv0
[  176.565305][ T5695] veth0_vlan: entered promiscuous mode
[  176.585921][ T5695] veth1_vlan: entered promiscuous mode
[  176.650471][ T5695] veth0_macvtap: entered promiscuous mode
[  176.669091][ T5695] veth1_macvtap: entered promiscuous mode
[  176.700205][ T5695] batman_adv: batadv0: Interface activated: batadv_slave_0
[  176.721025][ T5695] batman_adv: batadv0: Interface activated: batadv_slave_1
[  176.822810][   T13] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  176.822864][   T13] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  176.822902][   T13] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  176.822938][   T13] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  176.927812][ T1127] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  177.042283][ T1127] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  177.748476][ T1127] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
[  178.374034][ T1127] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  179.252590][ T1127] bridge_slave_1: left allmulticast mode
[  179.252632][ T1127] bridge_slave_1: left promiscuous mode
[  179.253798][ T1127] bridge0: port 2(bridge_slave_1) entered disabled state
[  179.257783][ T1127] bridge_slave_0: left allmulticast mode
[  179.257805][ T1127] bridge_slave_0: left promiscuous mode
[  179.259188][ T1127] bridge0: port 1(bridge_slave_0) entered disabled state
[  179.468567][ T1127] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  179.483504][ T1127] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  179.485895][ T1127] bond0 (unregistering): Released all slaves
[  179.611377][ T1127] hsr_slave_0: left promiscuous mode
[  179.613582][ T1127] hsr_slave_1: left promiscuous mode
[  179.614734][ T1127] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  179.614773][ T1127] batman_adv: batadv0: Removing interface: batadv_slave_0
[  179.618745][ T1127] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  179.618773][ T1127] batman_adv: batadv0: Removing interface: batadv_slave_1
[  179.685609][ T1127] veth1_macvtap: left promiscuous mode
[  179.685678][ T1127] veth0_macvtap: left promiscuous mode
[  179.685913][ T1127] veth1_vlan: left promiscuous mode
[  179.686015][ T1127] veth0_vlan: left promiscuous mode
[  180.098022][ T1127] team0 (unregistering): Port device team_slave_1 removed
[  180.130421][ T1127] team0 (unregistering): Port device team_slave_0 removed
[  180.315425][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1
[  181.056031][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2
[  181.813895][ T5281] 8021q: adding VLAN 0 to HW filter on device eth4
[  182.339157][ T5281] 8021q: adding VLAN 0 to HW filter on device eth3


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build429373818=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 85995287a88
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_386
x86_64-linux-gnu-g++ -o ./bin/linux_386/syz-executor executor/executor.cc \
	-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_386=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"85995287a888340d8818a8f3c43e2e89555eea21\"
/usr/bin/ld: /tmp/cch4vc37.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x145): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
[INFO] Unsupported architecture '386', skipping check.



Tested on:

commit:         0d2c6557 dma-buf: udmabuf: cap page count to allocatio..
git tree:       https://github.com/yutao-intel/linux.git fix-dri-udmabuf_create
kernel config:  https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e
dashboard link: https://syzkaller.appspot.com/bug?extid=bfeed181d1ce9ec87a8f
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: i386

Note: no patches were applied.

Re: [syzbot] [media?] [dri?] WARNING in udmabuf_create

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine



Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts.
[   97.786558][  T991] cfg80211: failed to load regulatory.db
2026/09/15 10:50:08 parsed 1 programs
2026/09/15 10:50:08 serving rpc on tcp://44173
[  102.370241][ T5634] cgroup: Unknown subsys name 'net'
[  102.510422][ T5634] cgroup: Unknown subsys name 'cpuset'
[  102.514396][ T5634] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[  104.351724][ T5634] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[  108.056785][ T5648] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[  108.062797][ T5648] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  108.068861][ T5648] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  108.582737][ T4937] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  108.583577][ T4937] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  108.584222][ T4937] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  108.585462][ T4937] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  108.609300][ T4937] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  109.734410][   T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.734443][   T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  109.782322][ T1166] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.782348][ T1166] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.483132][ T5676] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  110.483793][ T5676] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[  111.173280][ T5681] bridge0: port 1(bridge_slave_0) entered blocking state
[  111.174077][ T5681] bridge0: port 1(bridge_slave_0) entered disabled state
[  111.174210][ T5681] bridge_slave_0: entered allmulticast mode
[  111.180442][ T5681] bridge_slave_0: entered promiscuous mode
[  111.205644][ T5681] bridge0: port 2(bridge_slave_1) entered blocking state
[  111.205725][ T5681] bridge0: port 2(bridge_slave_1) entered disabled state
[  111.205839][ T5681] bridge_slave_1: entered allmulticast mode
[  111.207192][ T5681] bridge_slave_1: entered promiscuous mode
[  111.273019][ T5681] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  111.284131][ T5681] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  111.326721][ T5681] team0: Port device team_slave_0 added
[  111.329659][ T5681] team0: Port device team_slave_1 added
[  111.364079][ T5681] batman_adv: batadv0: Adding interface: batadv_slave_0
[  111.364095][ T5681] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  111.364120][ T5681] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  111.371516][ T5681] batman_adv: batadv0: Adding interface: batadv_slave_1
[  111.371563][ T5681] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  111.371642][ T5681] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  111.490683][ T5681] hsr_slave_0: entered promiscuous mode
[  111.491890][ T5681] hsr_slave_1: entered promiscuous mode
[  111.681668][ T5681] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  111.695207][ T5681] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  111.698832][ T5681] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  111.716309][ T5681] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  111.718026][ T5681] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  111.721600][ T5681] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  111.722634][ T5681] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  111.730316][ T5681] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  111.870717][ T5681] 8021q: adding VLAN 0 to HW filter on device bond0
[  111.897849][ T5681] 8021q: adding VLAN 0 to HW filter on device team0
[  111.905286][   T13] bridge0: port 1(bridge_slave_0) entered blocking state
[  111.905412][   T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[  111.937788][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state
[  111.937887][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state
[  112.340978][ T5681] 8021q: adding VLAN 0 to HW filter on device batadv0
[  112.604890][ T5681] veth0_vlan: entered promiscuous mode
[  112.619788][ T5681] veth1_vlan: entered promiscuous mode
[  112.660128][ T5681] veth0_macvtap: entered promiscuous mode
[  112.664268][ T5681] veth1_macvtap: entered promiscuous mode
[  112.695347][ T5681] batman_adv: batadv0: Interface activated: batadv_slave_0
[  112.714375][ T5681] batman_adv: batadv0: Interface activated: batadv_slave_1
[  112.748603][   T50] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  112.748650][   T50] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  112.748685][   T50] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  112.748718][   T50] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  112.882798][   T59] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  112.981434][   T59] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  113.059638][   T59] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  113.129303][   T59] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  114.003889][   T59] bridge_slave_1: left allmulticast mode
[  114.003941][   T59] bridge_slave_1: left promiscuous mode
[  114.005600][   T59] bridge0: port 2(bridge_slave_1) entered disabled state
[  114.040756][   T59] bridge_slave_0: left allmulticast mode
[  114.040789][   T59] bridge_slave_0: left promiscuous mode
[  114.042310][   T59] bridge0: port 1(bridge_slave_0) entered disabled state
[  114.373228][   T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  114.391864][   T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  114.394015][   T59] bond0 (unregistering): Released all slaves
[  114.560846][   T59] hsr_slave_0: left promiscuous mode
[  114.562142][   T59] hsr_slave_1: left promiscuous mode
[  114.563318][   T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  114.563353][   T59] batman_adv: batadv0: Removing interface: batadv_slave_0
[  114.565447][   T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  114.565470][   T59] batman_adv: batadv0: Removing interface: batadv_slave_1
[  114.626880][   T59] veth1_macvtap: left promiscuous mode
[  114.626941][   T59] veth0_macvtap: left promiscuous mode
[  114.627063][   T59] veth1_vlan: left promiscuous mode
[  114.627209][   T59] veth0_vlan: left promiscuous mode
[  114.939935][   T59] team0 (unregistering): Port device team_slave_1 removed
[  114.960914][   T59] team0 (unregistering): Port device team_slave_0 removed
[  115.141058][ T5283] 8021q: adding VLAN 0 to HW filter on device eth1
[  115.879786][ T5283] 8021q: adding VLAN 0 to HW filter on device eth2
[  116.704848][ T5283] 8021q: adding VLAN 0 to HW filter on device eth3
[  117.419422][ T5283] 8021q: adding VLAN 0 to HW filter on device eth4
execution of simple program fails: NOTFAIL: arptable checkpoint: getsockopt(ARPT_SO_GET_ENTRIES) failed. table=filter (errno 22: Invalid argument).
[  133.617311][ T1316] ieee802154 phy0 wpan0: encryption failed: -22
[  133.617371][ T1316] ieee802154 phy1 wpan1: encryption failed: -22


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3857553325=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 85995287a88
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=85995287a888340d8818a8f3c43e2e89555eea21 -X github.com/google/syzkaller/prog.gitRevisionDate=20260902-115702"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_386
x86_64-linux-gnu-g++ -o ./bin/linux_386/syz-executor executor/executor.cc \
	-m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_386=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"85995287a888340d8818a8f3c43e2e89555eea21\"
/usr/bin/ld: /tmp/ccoD0zzS.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x145): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
[INFO] Unsupported architecture '386', skipping check.



Tested on:

commit:         0d2c6557 dma-buf: udmabuf: cap page count to allocatio..
git tree:       https://github.com/yutao-intel/linux.git fix-dri-udmabuf_create
kernel config:  https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e
dashboard link: https://syzkaller.appspot.com/bug?extid=bfeed181d1ce9ec87a8f
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: i386

Note: no patches were applied.

Re: [syzbot] [media?] [dri?] WARNING in udmabuf_create

[syzbot]

syzbot has bisected this issue to:

commit 44e9eb5a762142a4aa46c0b5da7c39bfeb78910e
Author: Robert Mader <robert.mader@collabora.com>
Date:   Wed Jul 22 11:01:45 2026 +0000

    dma-buf/udmabuf: Disable the size limit by default

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=17d14379580000
start commit:   0a0d1d55dad5 Merge tag 'scftorture.2026.08.18a' of git://g..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=14314379580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10314379580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=335632b21d0ce540
dashboard link: https://syzkaller.appspot.com/bug?extid=bfeed181d1ce9ec87a8f
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16c2719e580000

Reported-by: syzbot+bfeed181d1ce9ec87a8f@syzkaller.appspotmail.com
Fixes: 44e9eb5a7621 ("dma-buf/udmabuf: Disable the size limit by default")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [media?] [dri?] WARNING in udmabuf_create

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    73ae59e97596 Merge tag 'erofs-for-7.3-rc1-2' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12dff979580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8d423d3e91ba4f47
dashboard link: https://syzkaller.appspot.com/bug?extid=bfeed181d1ce9ec87a8f
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: i386
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16d50d49580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11296979580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-73ae59e9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2edc303b5fba/vmlinux-73ae59e9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2624d8e0a8af/bzImage-73ae59e9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bfeed181d1ce9ec87a8f@syzkaller.appspotmail.com

------------[ cut here ]------------
!(flags & __GFP_NOWARN)
WARNING: mm/slub.c:7013 at __kvmalloc_node_noprof+0x646/0x9b0 mm/slub.c:7013, CPU#2: syz.0.17/5920
Modules linked in:
CPU: 2 UID: 0 PID: 5920 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__kvmalloc_node_noprof+0x646/0x9b0 mm/slub.c:7013
Code: c1 e8 2e 07 ff ff 4d 85 f6 0f 85 b6 fd ff ff 48 81 fb ff ff ff 7f 0f 86 4d fd ff ff 41 81 e4 00 20 00 00 0f 85 9c fd ff ff 90 <0f> 0b 90 e9 93 fd ff ff 41 be 10 00 00 00 e9 88 fd ff ff be 42 01
RSP: 0018:ffffc90003d8fb50 EFLAGS: 00010246
RAX: 0000000000000001 RBX: 0000008000800018 RCX: 0000010000000000
RDX: 0000000000000000 RSI: ffffffff8c61e200 RDI: ffffffff8e6ad930
RBP: 0000000008000800 R08: 00000000000028c0 R09: 00000000ffffffff
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 00000000000028c0 R14: 0000000000000000 R15: 00000000ffffffff
FS:  0000000000000000(0000) GS:ffff888096b76000(0063) knlGS:00000000579e1480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7113140 CR3: 00000000542cb000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 init_udmabuf drivers/dma-buf/udmabuf.c:193 [inline]
 udmabuf_create+0x2e8/0x12a0 drivers/dma-buf/udmabuf.c:386
 udmabuf_ioctl_create_list drivers/dma-buf/udmabuf.c:484 [inline]
 udmabuf_ioctl+0x2b2/0x300 drivers/dma-buf/udmabuf.c:499
 __do_compat_sys_ioctl fs/ioctl.c:695 [inline]
 __se_compat_sys_ioctl fs/ioctl.c:638 [inline]
 __ia32_compat_sys_ioctl+0x2cf/0x360 fs/ioctl.c:638
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f03fec
Code: Unable to access opcode bytes at 0xf7f03fc2.
RSP: 002b:00000000ffe2d40c EFLAGS: 00000292 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040087543
RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot] [media?] [dri?] WARNING in udmabuf_create

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    6b8c8af514d7 Add linux-next specific files for 20260807
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10b34149580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6d343b54cc50df0f
dashboard link: https://syzkaller.appspot.com/bug?extid=bfeed181d1ce9ec87a8f
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11e8c079580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/71ff4edcb608/disk-6b8c8af5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1f5fa331d8f2/vmlinux-6b8c8af5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f993558ec63b/bzImage-6b8c8af5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bfeed181d1ce9ec87a8f@syzkaller.appspotmail.com

------------[ cut here ]------------
!(flags & __GFP_NOWARN)
WARNING: mm/slub.c:7013 at __kvmalloc_node_noprof+0x792/0x820 mm/slub.c:7013, CPU#1: syz.0.17/5840
Modules linked in:
CPU: 1 UID: 0 PID: 5840 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__kvmalloc_node_noprof+0x792/0x820 mm/slub.c:7013
Code: ff 48 c7 c7 70 f7 c8 8e 48 89 de e8 a8 3d eb 02 e9 1f fc ff ff 48 c7 c7 b0 f7 c8 8e 48 89 de e8 94 3d eb 02 e9 50 fc ff ff 90 <0f> 0b 90 31 db e9 08 fe ff ff 90 0f 0b 90 e9 57 ff ff ff 49 83 7f
RSP: 0018:ffffc900044ffae0 EFLAGS: 00010246
RAX: 0000000000000100 RBX: 0000000000000000 RCX: 0000000080000001
RDX: 0000008000000000 RSI: ffffffff8c4c7660 RDI: ffffffff8c4c7620
RBP: 00000000ffffffff R08: 00000000000028c0 R09: 00000000ffffffff
R10: 0000000000000006 R11: 0000000000000000 R12: 0000008000000000
R13: 00000000000028c0 R14: 0000001000000000 R15: ffffffff865110fc
FS:  0000555557138500(0000) GS:ffff88812500c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb692c70000 CR3: 0000000079676000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 init_udmabuf drivers/dma-buf/udmabuf.c:193 [inline]
 udmabuf_create+0x2dc/0xf50 drivers/dma-buf/udmabuf.c:386
 udmabuf_ioctl_create drivers/dma-buf/udmabuf.c:465 [inline]
 udmabuf_ioctl+0x1f3/0x300 drivers/dma-buf/udmabuf.c:496
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x510 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb692d9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc7e6eab08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fb693025fa0 RCX: 00007fb692d9e0d9
RDX: 0000200000000200 RSI: 0000000040187542 RDI: 0000000000000003
RBP: 00007fb692e35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb693025fac R14: 00007fb693025fa0 R15: 00007fb693025fa0
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup