On 8/2/26 19:35, Anuj Bolewar via B4 Relay wrote: > From: Anuj Bolewar <[email protected]> > > virtio_gpu_free_vbufs() destroys the vbufs kmem_cache after the virtqueues > have already been released. Commands that were queued but never completed > by the device leave their vbuffers stranded in the virtqueue, so the cache > still holds live objects when virtio_gpu_deinit() tears everything down. > This triggers a WARNING in virtio_gpu_free_vbufs: > > BUG virtio-gpu-vbufs (Not tainted): Objects remaining in cache > on __kmem_cache_shutdown() > > Drain any buffers still sitting in the control and cursor virtqueues in > virtio_gpu_deinit() after the device has been reset and before the > virtqueues are deleted, following the same pattern used by virtio_console's > remove_vqs(). Each reclaimed buffer is released with free_vbuf(), dropping > the reference on any GEM objects it holds. Pending RESOURCE_UNREF > commands are handled as well: their resp_cb_data still references a GEM > object, so it is cleaned up with virtio_gpu_cleanup_object() to avoid > leaking it on teardown. > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=06f9b2a53ba4a5a47644 > Signed-off-by: Anuj Bolewar <[email protected]> > --- > This series fixes a syzbot-triggered WARNING in virtio_gpu_free_vbufs > (cache object: virtio-gpu-vbufs) seen on device removal. Commands that > are queued but never complete leave vbuffers stranded in the control and > cursor virtqueues. virtio_gpu_deinit() reset the device and deleted the > virtqueues without draining them, so a later kmem_cache_destroy() in > virtio_gpu_release() ran with live objects still allocated. > > Patch 1 drains the queues in virtio_gpu_deinit(): after the device reset > and before del_vqs(), virtio_gpu_reclaim_vbufs() detaches every unused > buffer from both virtqueues, releases their object arrays, and runs the > pending resource-unref cleanup so the referenced GEM objects are freed > rather than leaked. This mirrors the drain pattern used by > virtio_console's remove_vqs(). > > Link: https://syzkaller.appspot.com/bug?extid=06f9b2a53ba4a5a47644 > --- > Changes in v2: > - Also release the GEM object referenced by vbuf->resp_cb_data when > reclaiming stranded buffers, so pending RESOURCE_UNREF commands do not > leak their underlying objects on teardown. > - Link to v1: > https://patch.msgid.link/[email protected] > --- > drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + > drivers/gpu/drm/virtio/virtgpu_kms.c | 1 + > drivers/gpu/drm/virtio/virtgpu_vq.c | 15 +++++++++++++++ > 3 files changed, 17 insertions(+)
Applied to drm-misc-fixes, thanks! -- Best regards, Dmitry
