From: Daniel Vetter <daniel@ffwll.ch>
To: Chris Wilson <chris@chris-wilson.co.uk>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Daniel Vetter <daniel.vetter@intel.com>,
Jani Nikula <jani.nikula@linux.intel.com>,
David Airlie <airlied@linux.ie>,
intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
linux-kernel@vger.kernel.org,
Jesse Barnes <jbarnes@virtuousgeek.org>
Subject: Re: [Intel-gfx] [PATCH] drm/i915: fix use-after-free in page_flip_completed()
Date: Fri, 27 Jan 2017 15:09:59 +0100 [thread overview]
Message-ID: <20170127140959.x7a5u5h77d6vb7fc@phenom.ffwll.local> (raw)
In-Reply-To: <20170126144620.GH19521@nuc-i3427.alporthouse.com>
On Thu, Jan 26, 2017 at 02:46:20PM +0000, Chris Wilson wrote:
> On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote:
> > page_flip_completed() dereferences 'work' variable after executing
> > queue_work(). This is not safe as the 'work' item might be already freed
> > by queued work:
> >
> > BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr ffff8803dc010f90
> > Call Trace:
> > __asan_report_load8_noabort+0x59/0x80
> > page_flip_completed+0x3ff/0x490
> > intel_finish_page_flip_mmio+0xe3/0x130
> > intel_pipe_handle_vblank+0x2d/0x40
> > gen8_irq_handler+0x4a7/0xed0
> > __handle_irq_event_percpu+0xf6/0x860
> > handle_irq_event_percpu+0x6b/0x160
> > handle_irq_event+0xc7/0x1b0
> > handle_edge_irq+0x1f4/0xa50
> > handle_irq+0x41/0x70
> > do_IRQ+0x9a/0x200
> > common_interrupt+0x89/0x89
> >
> > Freed:
> > kfree+0x113/0x4d0
> > intel_unpin_work_fn+0x29a/0x3b0
> > process_one_work+0x79e/0x1b70
> > worker_thread+0x611/0x1460
> > kthread+0x241/0x3a0
> > ret_from_fork+0x27/0x40
> >
> > Move queue_work() after trace_i915_flip_complete() to fix this.
> >
> > Fixes: e5510fac98a7 ("drm/i915: add tracepoints for flip requests & completions")
> > Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
>
> That's old, and indeed does seem to be present from that commit and not
> exposed by something later.
>
> Cc: <stable@vger.kernel.org> # v2.6.36+
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Applied, thanks for patch&review.
-Daniel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
prev parent reply other threads:[~2017-01-27 14:18 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-26 14:32 Andrey Ryabinin
2017-01-26 14:46 ` Chris Wilson
2017-01-27 14:09 ` Daniel Vetter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170127140959.x7a5u5h77d6vb7fc@phenom.ffwll.local \
--to=daniel@ffwll.ch \
--cc=airlied@linux.ie \
--cc=aryabinin@virtuozzo.com \
--cc=chris@chris-wilson.co.uk \
--cc=daniel.vetter@intel.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jani.nikula@linux.intel.com \
--cc=jbarnes@virtuousgeek.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®