[BUG] drm/vkms: WARNING in drm_crtc_wait_one_vblank due to vblank timeout

Hi,

I am reporting a WARNING triggered by a syzkaller reproducer in the
DRM/VKMS path on Linux 7.2-rc3.

The warning is emitted from drm_crtc_wait_one_vblank() because waiting
for one vblank on CRTC 0 times out:

faux_driver vkms: [drm] ERROR [CRTC:45] flip_done timed out
faux_driver vkms: [drm] vblank wait timed out on crtc 0
WARNING: drivers/gpu/drm/drm_vblank.c:1329 at
drm_crtc_wait_one_vblank+0x2f3/0x560

This looks like a VKMS / DRM fb-helper / DRM vblank interaction issue.
The reproducer opens DRM devices, queries KMS resources and plane
resources, and then issues DRM_IOCTL_MODE_SETCRTC with the returned
CRTC/plane identifiers. After that, drm_fb_helper_damage_work() runs
from the events workqueue and waits for a vblank through
drm_client_modeset_wait_for_vblank(), but no vblank is observed before
the timeout. Since panic_on_warn is enabled, the warning is converted
into a kernel panic.

A similar vblank timeout warning in drm_crtc_wait_one_vblank() may
have been reported before, but I can still reproduce this issue on
Linux 7.2-rc3.

Reproducer:
syz reproducer: https://pastebin.com/raw/HeCMiVFR
console output: https://pastebin.com/raw/Y5CinzRS
kernel config: https://pastebin.com/raw/Lqbb3fQn

Kernel:
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full) (QEMU Ubuntu 24.10)

Crash log:

[ 78.750312][T10019] faux_driver vkms: [drm] ERROR [CRTC:45] flip_done timed out
[ 79.792561][ T793] faux_driver vkms: [drm] vblank wait timed out on crtc 0
[ 79.796488][ T793] WARNING: drivers/gpu/drm/drm_vblank.c:1329 at
drm_crtc_wait_one_vblank+0x2f3/0x560, CPU#1: kworker/1:2/793
[ 79.813855][ T793] Workqueue: events drm_fb_helper_damage_work
[ 79.849602][ T793] <TASK>
[ 79.855848][ T793] drm_client_modeset_wait_for_vblank+0xf1/0x130
[ 79.857114][ T793] drm_fb_helper_damage_work+0x2e1/0xae0
[ 79.860522][ T793] process_scheduled_works+0x5ed/0x1c90
[ 79.864431][ T793] worker_thread+0x5be/0xd20
[ 79.866835][ T793] kthread+0x404/0x530
[ 79.867639][ T793] ret_from_fork+0x7c5/0xde0
[ 79.872873][ T793] ret_from_fork_asm+0x1a/0x30
[ 79.873717][ T793] </TASK>
[ 79.874264][ T793] Kernel panic - not syncing: kernel: panic_on_warn set ...


Thanks