On Thu, 2026-04-09 at 15:57 -0700, Deborah Brouwer wrote:
But the Rust Object<T> still has the sgt_res. So, at the end of free_callback(), KBox::from_raw(this) triggers SGTableMap::drop(), and that calls __drm_gem_shmem_free_sgt_locked() again for the same shmem object.
Thank you for testing this! Luckily I think the actual cause of this problem is quite simple - we just need to change the order of the struct members for Object to make sure that sgt_res is released before the actual object itself :)
Will make sure this gets fixed in the next respin