Re: [PATCH v2] drm/virtio: reclaim pending vbufs before tearing down vqs

[Dmitry Osipenko <dmitry.osipenko@collabora.com>]

On 8/2/26 19:35, Anuj Bolewar via B4 Relay wrote:
> From: Anuj Bolewar <bolewara@gmail.com>
> 
> virtio_gpu_free_vbufs() destroys the vbufs kmem_cache after the virtqueues
> have already been released. Commands that were queued but never completed
> by the device leave their vbuffers stranded in the virtqueue, so the cache
> still holds live objects when virtio_gpu_deinit() tears everything down.
> This triggers a WARNING in virtio_gpu_free_vbufs:
> 
>     BUG virtio-gpu-vbufs (Not tainted): Objects remaining in cache
>     on __kmem_cache_shutdown()
> 
> Drain any buffers still sitting in the control and cursor virtqueues in
> virtio_gpu_deinit() after the device has been reset and before the
> virtqueues are deleted, following the same pattern used by virtio_console's
> remove_vqs(). Each reclaimed buffer is released with free_vbuf(), dropping
> the reference on any GEM objects it holds. Pending RESOURCE_UNREF
> commands are handled as well: their resp_cb_data still references a GEM
> object, so it is cleaned up with virtio_gpu_cleanup_object() to avoid
> leaking it on teardown.
> 
> Reported-by: syzbot+06f9b2a53ba4a5a47644@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=06f9b2a53ba4a5a47644
> Signed-off-by: Anuj Bolewar <bolewara@gmail.com>
> ---
> This series fixes a syzbot-triggered WARNING in virtio_gpu_free_vbufs
> (cache object: virtio-gpu-vbufs) seen on device removal. Commands that
> are queued but never complete leave vbuffers stranded in the control and
> cursor virtqueues. virtio_gpu_deinit() reset the device and deleted the
> virtqueues without draining them, so a later kmem_cache_destroy() in
> virtio_gpu_release() ran with live objects still allocated.
> 
> Patch 1 drains the queues in virtio_gpu_deinit(): after the device reset
> and before del_vqs(), virtio_gpu_reclaim_vbufs() detaches every unused
> buffer from both virtqueues, releases their object arrays, and runs the
> pending resource-unref cleanup so the referenced GEM objects are freed
> rather than leaked. This mirrors the drain pattern used by
> virtio_console's remove_vqs().
> 
> Link: https://syzkaller.appspot.com/bug?extid=06f9b2a53ba4a5a47644
> ---
> Changes in v2:
> - Also release the GEM object referenced by vbuf->resp_cb_data when
>   reclaiming stranded buffers, so pending RESOURCE_UNREF commands do not
>   leak their underlying objects on teardown.
> - Link to v1: https://patch.msgid.link/20260802-virtio-gpu-reclaim-vbufs-v1-1-9947f18b20e2@gmail.com
> ---
>  drivers/gpu/drm/virtio/virtgpu_drv.h |  1 +
>  drivers/gpu/drm/virtio/virtgpu_kms.c |  1 +
>  drivers/gpu/drm/virtio/virtgpu_vq.c  | 15 +++++++++++++++
>  3 files changed, 17 insertions(+)

Applied to drm-misc-fixes, thanks!

-- 
Best regards,
Dmitry