[BUG] drm/bochs: drm_gem_shmem_release() WARN on nonzero vmap_use_count when unbinding bochs-drm

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/192-warning-in-drm-gem-shmem-release/

  bochs-drm 0000:00:01.0: [drm]
drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
  WARNING: drivers/gpu/drm/drm_gem_shmem_helper.c:177 at
drm_gem_shmem_release+0x2d2/0x6d0
drivers/gpu/drm/drm_gem_shmem_helper.c:177, CPU#1: syz.1.397/14947
  RIP: 0010:drm_gem_shmem_release+0x5bb/0x6d0
drivers/gpu/drm/drm_gem_shmem_helper.c:177
  Call Trace:
   drm_gem_shmem_release+0x5bb/0x6d0 drivers/gpu/drm/drm_gem_shmem_helper.c:177
   drm_gem_shmem_free drivers/gpu/drm/drm_gem_shmem_helper.c:207 [inline]
   drm_gem_shmem_object_free+0x15/0x20 include/drm/drm_gem_shmem_helper.h:161
   drm_client_buffer_delete+0x189/0x2d0 drivers/gpu/drm/drm_client.c:201
   drm_fbdev_shmem_fb_destroy+0xac/0xd0 drivers/gpu/drm/drm_fbdev_shmem.c:67
   do_unregister_framebuffer drivers/video/fbdev/core/fbmem.c:561 [inline]
   unregister_framebuffer+0x2bd/0x3b0 drivers/video/fbdev/core/fbmem.c:606
   drm_client_dev_unregister+0x223/0x2d0 drivers/gpu/drm/drm_client_event.c:46
   drm_dev_unregister+0x44/0x730 drivers/gpu/drm/drm_drv.c:1155
   drm_dev_unplug+0x45/0xa0 drivers/gpu/drm/drm_drv.c:497
   bochs_pci_remove+0x3e/0x50 drivers/gpu/drm/tiny/bochs.c:785
   pci_device_remove+0xa3/0x250 drivers/pci/pci-driver.c:512
   unbind_store+0x1a1/0x1d0 drivers/base/bus.c:244

We do not have a reproducer for this one -- it was found by the fuzzer and we
have not been able to reproduce it deliberately.

Happy to test a patch if that would help.

Regards,