Re: [REGRESSION][ASAN] drm/client: Deprecate struct drm_client_buffer.gem

[Thomas Zimmermann <tzimmermann@suse.de>]

Hi

Am 31.10.25 um 16:49 schrieb Ian Forbes:
> On Mon, Oct 27, 2025 at 7:11 AM Thomas Zimmermann <tzimmermann@suse.de> wrote:
>> The client buffer's framebuffer holds a reference and pointer on
>> each of its GEM buffer objects. Thus the field gem in the client-
>> buffer struct is not necessary. Deprecated the field and convert
>> the client-buffer helpers to use the framebuffer's objects.
>>
>> In drm_client_buffer_delete(), do a possible vunmap before releasing
>> the framebuffer. Otherwise we'd eventually release the framebuffer
>> before unmaping its buffer objects.
>>
>> v2:
>> - avoid dependency on CONFIG_DRM_KMS_HELPER
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
>> ---
> This patch has caused a crash on vmwgfx with ASAN enabled.

A possible fix is available at 
https://lore.kernel.org/dri-devel/20251104103611.167821-1-tzimmermann@suse.de/T/#u

Best regards
Thomas

>
> [   22.286155] Console: switching to colour dummy device 80x25
> [   22.359287] vmwgfx 0000:00:0f.0: vgaarb: deactivate vga console
> [   22.388482] vmwgfx 0000:00:0f.0: [drm] FIFO at 0x00000000fb800000
> size is 8192 KiB
> [   22.390036] vmwgfx 0000:00:0f.0: [drm] VRAM at 0x00000000f0000000
> size is 131072 KiB
> [   22.391255] vmwgfx 0000:00:0f.0: [drm] Running on SVGA version 2.
> [   22.392209] vmwgfx 0000:00:0f.0: [drm] Capabilities: rect copy,
> cursor, cursor bypass, cursor bypass 2, 8bit emulation, alpha cursor,
> 3D, extended fifo, multimon, pitchlock, irq mask, display topology,
> gmr, traces, gmr2, screen object 2, command buffers, command buffers
> 2, gbobject, dx, hp cmd queue, no bb restriction, cap2 register,
> [   22.396463] vmwgfx 0000:00:0f.0: [drm] Capabilities2: grow otable,
> intra surface copy, dx2, gb memsize 2, screendma reg, otable ptdepth2,
> non ms to ms stretchblt, cursor mob, mshint, cb max size 4mb, dx3,
> frame type, trace full fb, extra regs, lo staging,
> [   22.400175] vmwgfx 0000:00:0f.0: [drm] DMA map mode: Caching DMA mappings.
> [   22.400224] audit: type=1130 audit(1761925118.444:63): pid=1 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
> msg='unit=systemd-fsck@dev-disk-by\x2duuid-AFBE\x2d8A94 comm="systemd"
> exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
> res=success'
> [   22.401320] vmwgfx 0000:00:0f.0: [drm] Legacy memory limits: VRAM =
> 4096 KiB, FIFO = 256 KiB, surface = 0 KiB
> [   22.406225] vmwgfx 0000:00:0f.0: [drm] MOB limits: max mob size =
> 1048576 KiB, max mob pages = 524288
> [   22.407602] vmwgfx 0000:00:0f.0: [drm] Max GMR ids is 64
> [   22.408398] vmwgfx 0000:00:0f.0: [drm] Max number of GMR pages is 65536
> [   22.409393] vmwgfx 0000:00:0f.0: [drm] Maximum display memory size
> is 262144 KiB
> [   22.419541] vmwgfx 0000:00:0f.0: [drm] Screen Target display unit initialized
> [   22.422876] vmwgfx 0000:00:0f.0: [drm] Fifo max 0x00040000 min
> 0x00001000 cap 0x0000077f
> [   22.426030] vmwgfx 0000:00:0f.0: [drm] Using command buffers with DMA pool.
> [   22.427664] vmwgfx 0000:00:0f.0: [drm] Available shader model: SM_5_1X.
> [   22.621336] [drm] Initialized vmwgfx 2.21.0 for 0000:00:0f.0 on minor 0
> [   22.627782] fbcon: vmwgfxdrmfb (fb0) is primary device
> [   22.640191] Console: switching to colour frame buffer device 160x50
> [   22.641788] Oops: general protection fault, probably for
> non-canonical address 0xdffffc000000001f: 0000 [#1] SMP KASAN NOPTI
> [   22.641795] KASAN: null-ptr-deref in range
> [0x00000000000000f8-0x00000000000000ff]
> [   22.641802] CPU: 6 UID: 0 PID: 134 Comm: kworker/6:1 Not tainted
> 6.18.0-rc2+ #63 PREEMPT(lazy)
> [   22.641809] Hardware name: VMware, Inc. VMware20,1/440BX Desktop
> Reference Platform, BIOS VMW201.00V.24928539.B64.2508260915 08/26/2025
> [   22.641812] Workqueue: events drm_fb_helper_damage_work
> [   22.641824] RIP: 0010:drm_gem_lock+0x25/0x50
> [   22.641831] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
> 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
> c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
> 01 e8
> [   22.641835] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
> [   22.641838] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
> [   22.641841] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
> [   22.641844] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
> [   22.641847] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
> [   22.641849] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
> [   22.641852] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
> knlGS:0000000000000000
> [   22.641855] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   22.641858] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
> [   22.641887] PKRU: 55555554
> [   22.641889] Call Trace:
> [   22.641891]  <TASK>
> [   22.641894]  drm_client_buffer_vmap_local+0x78/0x140
> [   22.641903]  drm_fbdev_ttm_helper_fb_dirty+0x20c/0x510 [drm_ttm_helper]
> [   22.641913]  ? __pfx_drm_fbdev_ttm_helper_fb_dirty+0x10/0x10 [drm_ttm_helper]
> [   22.641918]  ? __raw_spin_lock_irqsave+0x8c/0xf0
> [   22.641924]  ? __pfx___raw_spin_lock_irqsave+0x10/0x10
> [   22.641928]  ? __pfx_mutex_lock+0x10/0x10
> [   22.641936]  drm_fb_helper_fb_dirty+0x29a/0x5e0
> [   22.641942]  ? __pfx_drm_fb_helper_fb_dirty+0x10/0x10
> [   22.641946]  ? _raw_spin_lock_irq+0x8a/0xe0
> [   22.641950]  ? __pfx__raw_spin_lock_irq+0x10/0x10
> [   22.641955]  process_one_work+0x668/0xeb0
> [   22.641962]  worker_thread+0x5f6/0x1060
> [   22.641967]  ? __kthread_parkme+0x8d/0x170
> [   22.641972]  ? __pfx_worker_thread+0x10/0x10
> [   22.641976]  kthread+0x36f/0x710
> [   22.641980]  ? __pfx_kthread+0x10/0x10
> [   22.641983]  ? __pfx__raw_spin_lock_irq+0x10/0x10
> [   22.641987]  ? __pfx_kthread+0x10/0x10
> [   22.641990]  ret_from_fork+0x1c9/0x260
> [   22.641995]  ? __pfx_kthread+0x10/0x10
> [   22.641999]  ret_from_fork_asm+0x1a/0x30
> [   22.642004]  </TASK>
> [   22.642006] Modules linked in: vfat(+) snd_ac97_codec(+) vmxnet3(+)
> ac97_bus fat snd_seq snd_pcm gameport vmwgfx(+) snd_rawmidi
> snd_seq_device snd_timer drm_ttm_helper snd i2c_piix4 ttm i2c_smbus
> joydev soundcore loop nfnetlink vsock_loopback
> vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock zram
> vmw_vmci lz4hc_compress lz4_compress polyval_clmulni
> ghash_clmulni_intel ata_generic pata_acpi serio_raw fuse
> [   22.642056] ---[ end trace 0000000000000000 ]---
> [   22.642059] RIP: 0010:drm_gem_lock+0x25/0x50
> [   22.642063] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8
> 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48
> c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15
> 01 e8
> [   22.642066] RSP: 0018:ffff88810638fb78 EFLAGS: 00010202
> [   22.642069] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff9e694d16
> [   22.642072] RDX: 000000000000001f RSI: ffff88810638fbf0 RDI: 00000000000000f8
> [   22.642074] RBP: ffff88810638fbb0 R08: 0000000000000001 R09: ffffed1020c71f6d
> [   22.642077] R10: ffff88810638fb6f R11: 0000000000000006 R12: 0000000000000000
> [   22.642079] R13: ffff88810bfc6710 R14: ffff88810638fbf0 R15: ffff88810638fbf0
> [   22.642082] FS:  0000000000000000(0000) GS:ffff8882b6b3b000(0000)
> knlGS:0000000000000000
> [   22.642085] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   22.642087] CR2: 00007f7357b568a1 CR3: 0000000106a70006 CR4: 00000000007706f0
> [   22.642112] PKRU: 55555554

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)