memory leak in drm_mode_atomic_ioctl

Status: upstream: reported C repro on 2025/12/04 14:25
Subsystems: dri
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+3fc9eecaf97147282c87@syzkaller.appspotmail.com
First crash: 238d, last: 4d10h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
bd374134 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ memory leak in drm_mode_atomic_ioctl 2026/05/25 07:36 2026/05/25 07:36 2026/05/25 08:20 c69befb3

			
		
Discussions (4)
Title Replies (including bot) Last reply
[PATCH] drm/atomic: fix vblank event leak in complete_signaling() 1 (1) 2026/03/29 07:34
[syzbot] Monthly dri report (Mar 2026) 0 (1) 2026/03/01 06:22
[syzbot] Monthly dri report (Dec 2025) 0 (1) 2025/12/29 08:12
[syzbot] [dri?] memory leak in drm_mode_atomic_ioctl 1 (3) 2025/12/04 16:47
Last patch testing requests (9)
Created Duration User Patch Repo Result
2026/07/22 13:38 36m retest repro upstream report log
2026/07/22 13:38 27m retest repro upstream report log
2026/06/21 02:03 33m retest repro upstream report log
2026/05/04 03:54 26m retest repro upstream report log
2026/04/12 00:22 48m retest repro upstream report log
2026/02/22 20:36 40m retest repro upstream report log
2026/02/22 20:32 17m retest repro upstream report log
2025/12/14 14:21 25m retest repro upstream report log
2025/12/04 15:57 34m ssranevjti@gmail.com patch upstream OK log

Sample crash report:
2026/07/07 23:37:49 executed programs: 5
BUG: memory leak
unreferenced object 0xffff88810f56c580 (size 128):
  comm "syz.0.18", pid 5949, jiffies 4294944102
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 9bd0353):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4625 [inline]
    slab_alloc_node mm/slub.c:4945 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5511
    _kmalloc_noprof include/linux/slab.h:969 [inline]
    _kzalloc_noprof include/linux/slab.h:1290 [inline]
    create_vblank_event drivers/gpu/drm/drm_atomic_uapi.c:1120 [inline]
    prepare_signaling drivers/gpu/drm/drm_atomic_uapi.c:1438 [inline]
    drm_mode_atomic_ioctl+0x911/0x13c0 drivers/gpu/drm/drm_atomic_uapi.c:1747
    drm_ioctl_kernel+0x122/0x1f0 drivers/gpu/drm/drm_ioctl.c:805
    drm_ioctl+0x37c/0x6d0 drivers/gpu/drm/drm_ioctl.c:902
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88811277ff00 (size 128):
  comm "syz.0.19", pid 5950, jiffies 4294944104
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 9bd0353):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4625 [inline]
    slab_alloc_node mm/slub.c:4945 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5511
    _kmalloc_noprof include/linux/slab.h:969 [inline]
    _kzalloc_noprof include/linux/slab.h:1290 [inline]
    create_vblank_event drivers/gpu/drm/drm_atomic_uapi.c:1120 [inline]
    prepare_signaling drivers/gpu/drm/drm_atomic_uapi.c:1438 [inline]
    drm_mode_atomic_ioctl+0x911/0x13c0 drivers/gpu/drm/drm_atomic_uapi.c:1747
    drm_ioctl_kernel+0x122/0x1f0 drivers/gpu/drm/drm_ioctl.c:805
    drm_ioctl+0x37c/0x6d0 drivers/gpu/drm/drm_ioctl.c:902
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/07 23:38 upstream 0e35b9b6ec0f 88a4b44c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in drm_mode_atomic_ioctl
2026/03/28 23:44 upstream be762d8b6dd7 356bdfc9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in drm_mode_atomic_ioctl
2025/11/30 14:15 upstream 6bda50f4333f d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in drm_mode_atomic_ioctl
* Struck through repros no longer work on HEAD.