kern/53834: drm2 DMA fd allocation issue

[tnn%NetBSD.org@localhost]

>Number:         53834
>Category:       kern
>Synopsis:       drm2 DMA fd allocation issue
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 04 20:55:00 +0000 2019
>Originator:     Tobias Nygren
>Release:        current
>Organization:
NetBSD
>Environment:
NetBSD drmdev 8.99.30 NetBSD 8.99.30 (GENERIC.drmdev-debug) #6: Fri Jan  4 20:01:54 UTC 2019  root@drmdev:/usr/src/sys/arch/amd64/compile/GENERIC.drmdev-debug amd64
>Description:
sys/external/bsd/drm2/linux/linux_dma_buf.c:dma_buf_fd() does
a fd_putfile() on a file descriptor newly allocated with fd_allocfile() with the refcnt set to 0.

This causes Xorg with radeondrm to be wedged in unkillable state or a kernel diagnostic assertion with a debug kernel:

panic: kernel diagnostic assertion "(ff->ff_refcnt & FR_MASK) > 0
" failed: file "../../../../kern/kern_descrip.c", line 433
vpanic() at netbsd:vpanic+0x16f
ch_voltag_convert_in() at netbsd:ch_voltag_convert_in
fd_putfile() at netbsd:fd_putfile+0x10f
linux_dma_buf_fd() at netbsd:linux_dma_buf_fd+0x96
drm_gem_prime_handle_to_fd() at netbsd:drm_gem_prime_handle_to_fd
+0x9b
drm_ioctl() at netbsd:drm_ioctl+0x23b

>How-To-Repeat:
Try to use an AMD R9 GPU that I bought ~5 years ago which has been sitting in it's box ever since because I couldn't get it to work back then.
>Fix:
I just deleted the call to fd_putfile() and now Xorg starts and glxgears works. Maybe it needs some refcnt things added too?

Index: linux_dma_buf.c
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/drm2/linux/linux_dma_buf.c,v
retrieving revision 1.4
diff -p -u -r1.4 linux_dma_buf.c
--- linux_dma_buf.c	27 Aug 2018 15:25:13 -0000	1.4
+++ linux_dma_buf.c	4 Jan 2019 20:43:40 -0000
@@ -119,7 +119,6 @@ dma_buf_fd(struct dma_buf *dmabuf, int f
 	fd_set_exclose(curlwp, fd, (flags & O_CLOEXEC) != 0);
 	fd_affix(curproc, file, fd);
 
-	fd_putfile(fd);
 	ret = fd;
 out0:	return ret;
 }