Received-SPF: pass (google.com: domain of linux-kernel+bounces-13300-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+59dcc2e7283a6f5f5ba1@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [dri?] WARNING in drm_prime_destroy_file_private (2)
Date: Sat, 30 Dec 2023 09:03:50 +0800
Message-Id: <20231230010350.2074-1-hdanton@sina.com>
In-Reply-To: <000000000000f4faa2060d83f582@google.com>
References: <000000000000f4faa2060d83f582@google.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Wed, 27 Dec 2023 12:51:18 -0800
> HEAD commit:    5254c0cbc92d Merge tag 'block-6.7-2023-12-22' of git://git..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=155d5fd6e80000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master

--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -287,6 +287,7 @@ void drm_file_free(struct drm_file *file
 	if (dev->driver->postclose)
 		dev->driver->postclose(dev, file);
 
+	drm_prime_del_handles(&file->prime);
 	drm_prime_destroy_file_private(&file->prime);
 
 	WARN_ON(!list_empty(&file->event_list));
--- a/drivers/gpu/drm/drm_internal.h
+++ b/drivers/gpu/drm/drm_internal.h
@@ -76,6 +76,7 @@ void drm_prime_init_file_private(struct
 void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv);
 void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv,
 				 uint32_t handle);
+void drm_prime_del_handles(struct drm_prime_file_private *prime_fpriv);
 
 /* drm_drv.c */
 struct drm_minor *drm_minor_acquire(unsigned int minor_id);
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -106,6 +106,8 @@ static int drm_prime_add_buf_handle(stru
 	get_dma_buf(dma_buf);
 	member->dma_buf = dma_buf;
 	member->handle = handle;
+	RB_CLEAR_NODE(&member->dmabuf_rb);
+	RB_CLEAR_NODE(&member->handle_rb);
 
 	rb = NULL;
 	p = &prime_fpriv->dmabufs.rb_node;
@@ -185,6 +187,27 @@ static int drm_prime_lookup_buf_handle(s
 	return -ENOENT;
 }
 
+void drm_prime_del_handles(struct drm_prime_file_private *prime_fpriv)
+{
+	struct drm_prime_member *member;
+	struct rb_node *rb;
+
+	mutex_lock(&prime_fpriv->lock);
+	for (;;) {
+		rb = rb_first(&prime_fpriv->dmabufs);
+		if (!rb)
+			break;
+		member = rb_entry(rb, struct drm_prime_member, handle_rb);
+
+		rb_erase(&member->handle_rb, &prime_fpriv->handles);
+		rb_erase(&member->dmabuf_rb, &prime_fpriv->dmabufs);
+
+		dma_buf_put(member->dma_buf);
+		kfree(member);
+	}
+	mutex_unlock(&prime_fpriv->lock);
+}
+
 void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv,
 				 uint32_t handle)
 {
--