Hi guys,

I think I know what's going on here. The syzbot bisect is actually not 100% correct, the patch in question just makes the problem appear for the console buffer as well.

What seems to happen is that we export some BO as DMA-buf and then close all handles to the buffer.

The DMA-buf of the BO then gets destroyed, but the BO can be kept around because it is referenced by the console (for example) or used as plane in KMS etc....

If we then create a new GEM handle for that BO again and re-export it by DMA-buf we run into the warning below because the object already has some DMA-buf assigned to it.

Any ideas how to fix this?

Regards, Christian.

Am 15.10.23 um 05:37 schrieb syzbot:

Hello,

syzbot found the following issue on:

HEAD commit: 1c8b86a3799f Merge tag 'xsa441-6.6-tag' of git://git.kerne.. git tree: upstream console+strace: https://syzkaller.appspot.com/x/log.txt?x=13005e31680000 kernel config: https://syzkaller.appspot.com/x/.config?x=32d0b9b42ceb8b10 dashboard link: https://syzkaller.appspot.com/bug?extid=0da81ccba2345eeb7f48 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c48345680000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=101b3679680000

Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/45e9377886e9/disk-1c8b86a3.raw.... vmlinux: https://storage.googleapis.com/syzbot-assets/9511a41a6d1e/vmlinux-1c8b86a3.x... kernel image: https://storage.googleapis.com/syzbot-assets/fac07e1c3c1a/bzImage-1c8b86a3.x...

The issue was bisected to:

commit 85e26dd5100a182bf8448050427539c0a66ab793 Author: Christian König christian.koenig@amd.com Date: Thu Jan 26 09:24:26 2023 +0000

 drm/client: fix circular reference counting issue

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14cf17f1680000 final oops: https://syzkaller.appspot.com/x/report.txt?x=16cf17f1680000 console output: https://syzkaller.appspot.com/x/log.txt?x=12cf17f1680000

IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+0da81ccba2345eeb7f48@syzkaller.appspotmail.com Fixes: 85e26dd5100a ("drm/client: fix circular reference counting issue")

------------[ cut here ]------------ WARNING: CPU: 0 PID: 5040 at drivers/gpu/drm/drm_prime.c:326 drm_gem_prime_fd_to_handle drivers/gpu/drm/drm_prime.c:326 [inline] WARNING: CPU: 0 PID: 5040 at drivers/gpu/drm/drm_prime.c:326 drm_prime_fd_to_handle_ioctl+0x555/0x600 drivers/gpu/drm/drm_prime.c:374 Modules linked in: CPU: 0 PID: 5040 Comm: syz-executor405 Not tainted 6.6.0-rc5-syzkaller-00055-g1c8b86a3799f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 RIP: 0010:drm_gem_prime_fd_to_handle drivers/gpu/drm/drm_prime.c:326 [inline] RIP: 0010:drm_prime_fd_to_handle_ioctl+0x555/0x600 drivers/gpu/drm/drm_prime.c:374 Code: 89 df e8 0e 9b 26 fd f0 48 ff 03 e9 7e fd ff ff e8 b0 dc d0 fc 4c 89 f7 44 89 eb e8 75 73 8b 05 e9 da fe ff ff e8 9b dc d0 fc <0f> 0b e9 5d fd ff ff e8 3f 94 26 fd e9 3a fc ff ff 48 8b 7c 24 08 RSP: 0018:ffffc90003a5fc70 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888018f14c00 RCX: 0000000000000000 RDX: ffff88801d691dc0 RSI: ffffffff84b6ea15 RDI: ffff8881476f3928 RBP: ffff88801fac5400 R08: 0000000000000007 R09: fffffffffffff000 R10: ffff8881476f3800 R11: 0000000000000000 R12: ffffc90003a5fe10 R13: ffff8881476f3800 R14: ffff88801c590c10 R15: 0000000000000000 FS: 00005555555d6380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555db75f4058 CR3: 0000000072209000 CR4: 0000000000350ef0 Call Trace:

<TASK> drm_ioctl_kernel+0x280/0x4c0 drivers/gpu/drm/drm_ioctl.c:789 drm_ioctl+0x5cb/0xbf0 drivers/gpu/drm/drm_ioctl.c:892 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f0c8214be69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6f4156f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0c8214be69 RDX: 0000000020000000 RSI: 00000000c00c642e RDI: 0000000000000003 RBP: 0000000000000000 R08: 00000000000000a0 R09: 00000000000000a0 R10: 00000000000000a0 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0c821c3820 R14: 00007fff6f415720 R15: 00007fff6f415710 </TASK>

---

This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the bug is already fixed, let syzbot know by replying with: #syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with: #syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with: #syz undup