Definitely kernel.  Looks to be landing in graphics changes.  Not too surprising given the repro steps.

---

Git bisect blames:

5eaa1c36cd2eb76bc2fe871d3b5240443dcdc4e0 is the first bad commit
commit 5eaa1c36cd2eb76bc2fe871d3b5240443dcdc4e0
Author: Dave Airlie <airlied@redhat.com>
Date:   Fri Apr 15 15:10:42 2016 +1000

    UPSTREAM: drm/modes: stop handling framebuffer special
    
    Since ref counting is in the object now we can just call the
    normal interfaces.
    
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 027b3f8ba9277410c3191d72d1ed2c6146d8a668)
    from topic/drm-misc-2016-04-29
    Signed-off-by: Tarun <tarun.vyas@intel.com>
    
    BUG=b:36446508
    TEST=No regressions in KBL and APL based devices
    
    Change-Id: I7e6e9f4485759153abdef381bdbba1c194a0ffd3
    Reviewed-on: https://chromium-review.googlesource.com/459949
    Commit-Ready: Sean Paul <seanpaul@chromium.org>
    Tested-by: Sean Paul <seanpaul@chromium.org>
    Reviewed-by: Sean Paul <seanpaul@chromium.org>

---

Adding intel, this is one of their backports

This works for me to "fix" the problem:

$ git diff d2cc64e3f3be..fbcb3ab08e68 > allofit.patch
$ patch -p1 -R < allofit.patch

If this is blocking anyone else's development (like it was mine), you can just grab:

  https://chromium-review.googlesource.com/505152
  TEST-ONLY: Revert all those pesky DRM backports

;-)

I'm guessing this will be fixed with:

commit 1e8985a835fdffc99f823c25ace54833656c505a
Author: Tomi Valkeinen <tomi.valkeinen@ti.com>
Date:   Tue May 31 15:03:18 2016 +0300

    drm: fix fb refcount issue with atomic modesetting
    
    After commit 027b3f8ba9277410c3191d72d1ed2c6146d8a668 ("drm/modes: stop
    handling framebuffer special") extra fb refs are left around when doing
    atomic modesetting.
    
    The problem is that the new drm_property_change_valid_get() does not
    return anything in the '**ref' parameter, which causes
    drm_property_change_valid_put() to do nothing.
    
    For some reason this doesn't cause problems with legacy API.
    
    Also, previously the code only set the 'ref' variable for fbs, with this
    patch the 'ref' is set for all objects.
    
    Fixes: 027b3f8ba927 ("drm/modes: stop handling framebuffer special")
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Dave Airlie <airlied@redhat.com>



It's been backported here: https://chromium-review.googlesource.com/#/c/459990/, but hasn't made it through the CQ yet. I still have to test this hypothesis (building is slow), should have something soon.

@6: yup, that fixes it.  Thanks.

https://chromium-review.googlesource.com/#/c/459990/ has landed, marking fixed.

Verified with version 60.0.3101.0/9557.0.0 dev-channel kevin