Comment 30 for bug 1946368

I'm seeing this on Impish on my machine. Kernel is 5.13.0-1008-raspi #9-Ubuntu. Desktop comes up but then randomly freezes with the following in dmesg:

[ 283.872220] [drm:drm_atomic_helper_wait_for_flip_done [drm_kms_helper]] *ERROR* [CRTC:83:crtc-4] flip_done timed out
[ 283.872223] [drm:drm_crtc_commit_wait [drm]] *ERROR* flip_done timed out
[ 283.872490] [drm:drm_atomic_helper_wait_for_dependencies [drm_kms_helper]] *ERROR* [CRTC:83:crtc-4] commit wait timed out
[ 294.112288] [drm:drm_crtc_commit_wait [drm]] *ERROR* flip_done timed out
[ 294.112576] [drm:drm_atomic_helper_wait_for_dependencies [drm_kms_helper]] *ERROR* [PLANE:211:plane-26] commit wait timed out
[ 304.352387] [drm:drm_crtc_commit_wait [drm]] *ERROR* flip_done timed out
[ 304.352664] vc4-drm gpu: [drm] *ERROR* Timed out waiting for commit
[ 304.369388] ------------[ cut here ]------------
[ 304.369406] refcount_t: underflow; use-after-free.
[ 304.369447] WARNING: CPU: 1 PID: 22 at lib/refcount.c:87 refcount_dec_not_one+0xa0/0xbc
[ 304.369478] Modules linked in: nfnetlink rfcomm cmac algif_hash algif_skcipher af_alg hci_uart btqca btrtl btbcm btintel bnep snd_soc_hdmi_codec btsdio bluetooth ecdh_generic ecc vc4 brcmfmac brcmutil input_leds snd_soc_core cfg80211 snd_compress snd_pcm_dmaengine snd_bcm2835(C) snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi raspberrypi_hwmon snd_seq bcm2835_v4l2(C) bcm2835_codec(C) videobuf2_vmalloc snd_seq_device bcm2835_isp(C) v4l2_mem2mem bcm2835_mmal_vchiq(C) videobuf2_dma_contig snd_timer videobuf2_memops vc_sm_cma(C) videobuf2_v4l2 videobuf2_common videodev snd bcm2835_gpiomem mc rpivid_mem uio_pdrv_genirq uio sch_fq_codel ip_tables x_tables autofs4 btrfs blake2b_generic xor xor_neon zstd_compress raid6_pq libcrc32c hid_generic usbhid dm_mirror dm_region_hash dm_log spidev v3d crct10dif_ce gpu_sched dwc2 i2c_brcmstb drm_kms_helper roles udc_core i2c_bcm2835 syscopyarea sysfillrect sysimgblt fb_sys_fops spi_bcm2835 cec drm xhci_pci xhci_pci_renesas phy_generic ac97_bus
[ 304.369880] aes_arm64
[ 304.369891] CPU: 1 PID: 22 Comm: kworker/1:0 Tainted: G C 5.13.0-1008-raspi #9-Ubuntu
[ 304.369902] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)
[ 304.369909] Workqueue: events drm_mode_rmfb_work_fn [drm]
[ 304.370077] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
[ 304.370087] pc : refcount_dec_not_one+0xa0/0xbc
[ 304.370098] lr : refcount_dec_not_one+0xa0/0xbc
[ 304.370106] sp : ffff8000100ebb50
[ 304.370110] x29: ffff8000100ebb50 x28: ffff5d76a5c53a00 x27: ffff5d7644e78000
[ 304.370129] x26: ffff5d7644e78000 x25: 0000000000000006 x24: ffff5d7691b91a80
[ 304.370145] x23: ffffdeb5d3dda018 x22: ffff5d76a4ff2980 x21: ffff5d764f18f480
[ 304.370161] x20: ffff5d76a5d835ac x19: ffff5d76a5d83400 x18: 0000000000000000
[ 304.370177] x17: 0000000000000000 x16: ffffdeb62d842574 x15: 0000000000000000
[ 304.370192] x14: 0000000000000000 x13: 0000000000000030 x12: 0000000000004000
[ 304.370208] x11: ffffdeb62e8fdfd0 x10: 00000000fffff000 x9 : ffffdeb62d309f64
[ 304.370223] x8 : 00000000ffffefff x7 : ffffdeb62e8fdfd0 x6 : 0000000000000000
[ 304.370239] x5 : ffff5d76f799f948 x4 : 0000000000000000 x3 : 0000000000000027
[ 304.370254] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff5d76402add00
[ 304.370270] Call trace:
[ 304.370274] refcount_dec_not_one+0xa0/0xbc
[ 304.370283] vc4_bo_dec_usecnt+0x2c/0x120 [vc4]
[ 304.370340] vc4_cleanup_fb+0x3c/0x4c [vc4]
[ 304.370389] drm_atomic_helper_cleanup_planes+0x74/0xa0 [drm_kms_helper]
[ 304.370479] vc4_atomic_commit_tail+0x24c/0x36c [vc4]
[ 304.370528] commit_tail+0xac/0x190 [drm_kms_helper]
[ 304.370612] drm_atomic_helper_commit+0x168/0x380 [drm_kms_helper]
[ 304.370692] drm_atomic_commit+0x58/0x70 [drm]
[ 304.370847] atomic_remove_fb+0x2a8/0x2f4 [drm]
[ 304.370998] drm_framebuffer_remove+0x164/0x18c [drm]
[ 304.371148] drm_mode_rmfb_work_fn+0x50/0x70 [drm]
[ 304.371297] process_one_work+0x200/0x4d0
[ 304.371311] worker_thread+0x2c8/0x470
[ 304.371319] kthread+0x12c/0x140
[ 304.371328] ret_from_fork+0x10/0x3c
[ 304.371339] ---[ end trace 6ac80fe19eebcafd ]---