kern/56804: panic: drm2 overreleasing kref

[prlw1%cam.ac.uk@localhost]

>Number:         56804
>Category:       kern
>Synopsis:       panic: drm2 overreleasing kref
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr 25 20:05:00 +0000 2022
>Originator:     Patrick Welche
>Release:        NetBSD-9.99.96/amd64 of 24 April 2022
>Organization:
>Environment:
>Description:
(Oddly AFAIK no one was logged in, just a pbulk run was happening)

System panicked: kernel diagostic assertion "(count <= old)" failed: file "../../../../external/bsd/drm2/include/linux/kref.h", line 89 overreleasing kref: 0 - 1


#0  0xffffffff802229c5 in cpu_reboot (howto=howto@entry=260, 
    bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:720
#1  0xffffffff80acfa94 in kern_reboot (howto=howto@entry=260, 
    bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:73
#2  0xffffffff80b1599d in vpanic (
    fmt=0xffffffff8101eab0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d overreleasing kref: %u - %u", ap=ap@entry=0xffff9504afe04b68)
    at ../../../../kern/subr_prf.c:293
#3  0xffffffff80c8e97f in kern_assert (
    fmt=fmt@entry=0xffffffff8101eab0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d overreleasing kref: %u - %u")
    at ../../../../../../lib/libkern/kern_assert.c:51
#4  0xffffffff80c3e715 in kref_sub (count=<optimized out>, 
    release=0xffffffff80c3d950 <ttm_bo_release>, kref=0xffff899b95809c60)
    at ../../../../external/bsd/drm2/include/linux/kref.h:89
#5  kref_put (release=0xffffffff80c3d950 <ttm_bo_release>, 
    kref=0xffff899b95809c60)
    at ../../../../external/bsd/drm2/include/linux/kref.h:140
#6  ttm_bo_put (bo=0xffff899b95809ac8)
    at ../../../../external/bsd/drm2/dist/drm/ttm/ttm_bo.c:702
#7  0xffffffff806dba39 in nouveau_bo_ref (pnvbo=<synthetic pointer>, ref=0x0)
    at ../../../../external/bsd/drm2/dist/drm/nouveau/nouveau_bo.h:73
#8  nouveau_gem_new (cli=<optimized out>, size=<optimized out>, 
    align=<optimized out>, domain=12, tile_mode=<optimized out>, 
    tile_flags=<optimized out>, pnvbo=pnvbo@entry=0xffff9504afe04c78)
    at ../../../../external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c:211
#9  0xffffffff806dbaa3 in nouveau_gem_ioctl_new (dev=<optimized out>, 
    data=0xffff9504afe04de0, file_priv=0xffff899a5a964608)
    at ../../../../external/bsd/drm2/dist/drm/nouveau/nouveau_gem.c:278
#10 0xffffffff8094b248 in drm_ioctl (fp=<optimized out>, cmd=<optimized out>, 
    data=0xffff9504afe04de0)
    at ../../../../external/bsd/drm2/dist/drm/drm_ioctl.c:906
#11 0xffffffff80914bb4 in drm_ioctl_shim (fp=<optimized out>, 
    cmd=<optimized out>, data=<optimized out>)
    at ../../../../external/bsd/drm2/drm/drm_cdevsw.c:391
#12 0xffffffff80b27af1 in sys_ioctl (l=<optimized out>, 
    uap=0xffff9504afe04f00, retval=<optimized out>)
    at ../../../../kern/sys_generic.c:673
#13 0xffffffff803fe62e in sy_call (rval=0xffff9504afe04eb0, 
    uap=0xffff9504afe04f00, l=0xffff899a558c02c0, 
    sy=0xffffffff814641b0 <sysent+1296>) at ../../../../sys/syscallvar.h:65
#14 sy_invoke (code=54, rval=0xffff9504afe04eb0, uap=0xffff9504afe04f00, 
    l=0xffff899a558c02c0, sy=0xffffffff814641b0 <sysent+1296>)
    at ../../../../sys/syscallvar.h:94
#15 syscall (frame=0xffff9504afe04f00)
    at ../../../../arch/x86/x86/syscall.c:138
#16 0xffffffff8020867d in handle_syscall ()

(netbsd.18.core)
>How-To-Repeat:

>Fix: