[PATCH] drm/lease: cap object_count to avoid order > MAX_PAGE_ORDER warning

[PATCH] drm/lease: cap object_count to avoid order > MAX_PAGE_ORDER warning

[David Carlier]

cl->object_count comes from userspace unbounded and reaches
kzalloc_objs() in fill_object_idr(); a large value trips
WARN_ON_ONCE_GFP in __alloc_frozen_pages_noprof(), letting a DRM
master produce a kernel splat.

Bound object_count at the ioctl entry so the page allocator is
never asked for an absurd order.

Reported-by: syzbot+5d32c8bd82427f9c77cc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5d32c8bd82427f9c77cc
Fixes: 62884cd386b8 ("drm: Add four ioctls for managing drm mode object leases [v7]")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 drivers/gpu/drm/drm_lease.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 5d2cf724cbd7..bdec759187d9 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -466,6 +466,13 @@ static int fill_object_idr(struct drm_device *dev,
 	return ret;
 }
 
+/*
+ * Upper bound on the number of objects a single lease can reference.
+ * Real workloads use a handful; this is set well above any plausible
+ * value to avoid kmalloc requests that would exceed MAX_PAGE_ORDER.
+ */
+#define DRM_MAX_LEASE_OBJECTS	4096
+
 /*
  * The master associated with the specified file will have a lease
  * created containing the objects specified in the ioctl structure.
@@ -505,6 +512,12 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	}
 
 	object_count = cl->object_count;
+	if (unlikely(object_count > DRM_MAX_LEASE_OBJECTS)) {
+		drm_dbg_lease(dev, "object_count %zu exceeds max %u\n",
+			      object_count, DRM_MAX_LEASE_OBJECTS);
+		ret = -EINVAL;
+		goto out_lessor;
+	}
 
 	/* Handle leased objects, if any */
 	idr_init(&leases);
-- 
2.53.0

Claude review: drm/lease: cap object_count to avoid order > MAX_PAGE_ORDER warning

[Claude Code Review Bot]

Overall Series Review

Subject: drm/lease: cap object_count to avoid order > MAX_PAGE_ORDER warning
Author: David Carlier <devnexen@gmail.com>
Patches: 1
Reviewed: 2026-05-27T15:13:21.349922

---

This is a single patch fixing a syzbot-reported bug where an unbounded `object_count` from userspace causes `kzalloc_objs()` to request an allocation large enough to trigger a `WARN_ON_ONCE_GFP` in the page allocator. The fix is straightforward and correct in principle: cap the count at the ioctl entry point before the allocation happens. The approach is reasonable and the placement is right. There are a couple of minor issues worth discussing.

**Verdict: Acceptable with minor nits.**

---
Generated by Claude Code Patch Reviewer

Claude review: drm/lease: cap object_count to avoid order > MAX_PAGE_ORDER warning

[Claude Code Review Bot]

Patch Review

**Correctness: Good.** The check is placed after `cl->object_count` is read into `object_count` (line 514) and before it's used for the `memdup_array_user` call (line 525) and passed to `fill_object_idr` → `kzalloc_objs` (line 389). The `goto out_lessor` target correctly drops the `drm_master` reference obtained at line 506. The fix prevents both the `kzalloc_objs` allocation (array of pointers, 8 bytes each on 64-bit → 4096 * 8 = 32KB, well within a single page order) and the `memdup_array_user` allocation (4096 * 4 = 16KB) from going overboard.

**Nit 1 — Format specifier mismatch:**

```c
drm_dbg_lease(dev, "object_count %zu exceeds max %u\n",
              object_count, DRM_MAX_LEASE_OBJECTS);
```

`object_count` is `size_t` so `%zu` is correct for it. `DRM_MAX_LEASE_OBJECTS` is `4096` which is an `int` constant, so `%u` works but `%d` would be more conventional for a plain integer literal. This is not a bug, just a minor style point — either is fine.

**Nit 2 — Limit derivation vs. hard-coded constant.** The value `4096` is chosen to sit below the `MAX_PAGE_ORDER` threshold. A more self-documenting approach would derive the limit from the actual allocation size, e.g.:

```c
#define DRM_MAX_LEASE_OBJECTS \
    ((PAGE_SIZE << MAX_PAGE_ORDER) / sizeof(struct drm_mode_object *))
```

That said, the hard-coded `4096` is generous enough for any realistic use (real leases have a handful of objects) and simple to understand. The comment explains the rationale. This is a matter of taste, not correctness.

**Nit 3 — `unlikely()` annotation.** The `unlikely()` on line 515 is fine and conventional for error-path guards on ioctl inputs, though opinions vary on whether the branch predictor needs the hint here. No issue.

**Nit 4 — Placement of the `#define`.** The `DRM_MAX_LEASE_OBJECTS` macro is placed between `fill_object_idr()` and `drm_mode_create_lease_ioctl()` in the middle of the file. Placing it near the top of the file with other constants or near the include block would be slightly more conventional, but this is minor.

**Overall:** The patch is correct, well-targeted, and addresses the reported syzbot issue cleanly. The commit message is clear and includes appropriate tags (Reported-by, Closes, Fixes, Signed-off-by). Good to merge with or without the nits addressed.

---
Generated by Claude Code Patch Reviewer