Messages in this thread | | | From | Jani Nikula <> | Subject | Re: [Intel-gfx] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x79/0x80 | Date | Mon, 25 Feb 2019 16:58:13 +0200 |
| |
On Mon, 25 Feb 2019, Hans Verkuil <hverkuil@xs4all.nl> wrote: > Hi Jani, > > On 2/25/19 2:40 PM, Jani Nikula wrote: >> On Fri, 22 Feb 2019, Randy Dunlap <rdunlap@infradead.org> wrote: >>> This is 5.0-rc7 on an old Toshiba Portege laptop. >>> No hdmi or other external video. >>> >>> Linux dragon.dunlab 5.0.0-rc7mod #3 SMP PREEMPT Wed Feb 20 00:05:17 PST 2019 x86_64 x86_64 x86_64 GNU/Linux >>> >>> on openSUSE LEAP 15.0 distro. >>> >>> Full boot log is attached. >> >> On a hunch, caused by 9c229127aee2 ("drm/i915: hdmi: add CEC notifier to >> intel_hdmi") referencing the encoder in connector destroy hook. We >> should probably move the cec_notifier_put() call in the encoder destroy >> hook. > > So the intel_encoder_destroy function is/can be called before the > intel_hdmi_destroy function? Sounds odd. I would expect that the > connectors are destroyed before the encoders. > > In any case, I am happy to try it in another destroy hook, but I need > advice which hook I should use and how I get to the cec_notifier from > whatever structure pointer I have in that destroy hook. > > I tried to figure it out, but I became very confused :-)
It's... hairy.
Looks like in this case the destroy hook gets called via drm_connector_free_work_fn() and __drm_connector_put_safe() the documentation of which says, "Should only be used from the connector_iter functions, where we never really expect to actually release the connector when dropping our final reference."
Can and does happen anyway it seems. :/
BR, Jani.
-- Jani Nikula, Intel Open Source Graphics Center
| |