From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932914AbdA0OSk (ORCPT ); Fri, 27 Jan 2017 09:18:40 -0500 Received: from mail-wj0-f193.google.com ([209.85.210.193]:36417 "EHLO mail-wj0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932285AbdA0OSf (ORCPT ); Fri, 27 Jan 2017 09:18:35 -0500 Date: Fri, 27 Jan 2017 15:09:59 +0100 From: Daniel Vetter To: Chris Wilson , Andrey Ryabinin , Daniel Vetter , Jani Nikula , David Airlie , intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Jesse Barnes Subject: Re: [Intel-gfx] [PATCH] drm/i915: fix use-after-free in page_flip_completed() Message-ID: <20170127140959.x7a5u5h77d6vb7fc@phenom.ffwll.local> Mail-Followup-To: Chris Wilson , Andrey Ryabinin , Daniel Vetter , Jani Nikula , David Airlie , intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Jesse Barnes References: <20170126143211.24013-1-aryabinin@virtuozzo.com> <20170126144620.GH19521@nuc-i3427.alporthouse.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170126144620.GH19521@nuc-i3427.alporthouse.com> X-Operating-System: Linux phenom 4.8.0-1-amd64 User-Agent: NeoMutt/20161126 (1.7.1) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jan 26, 2017 at 02:46:20PM +0000, Chris Wilson wrote: > On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote: > > page_flip_completed() dereferences 'work' variable after executing > > queue_work(). This is not safe as the 'work' item might be already freed > > by queued work: > > > > BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr ffff8803dc010f90 > > Call Trace: > > __asan_report_load8_noabort+0x59/0x80 > > page_flip_completed+0x3ff/0x490 > > intel_finish_page_flip_mmio+0xe3/0x130 > > intel_pipe_handle_vblank+0x2d/0x40 > > gen8_irq_handler+0x4a7/0xed0 > > __handle_irq_event_percpu+0xf6/0x860 > > handle_irq_event_percpu+0x6b/0x160 > > handle_irq_event+0xc7/0x1b0 > > handle_edge_irq+0x1f4/0xa50 > > handle_irq+0x41/0x70 > > do_IRQ+0x9a/0x200 > > common_interrupt+0x89/0x89 > > > > Freed: > > kfree+0x113/0x4d0 > > intel_unpin_work_fn+0x29a/0x3b0 > > process_one_work+0x79e/0x1b70 > > worker_thread+0x611/0x1460 > > kthread+0x241/0x3a0 > > ret_from_fork+0x27/0x40 > > > > Move queue_work() after trace_i915_flip_complete() to fix this. > > > > Fixes: e5510fac98a7 ("drm/i915: add tracepoints for flip requests & completions") > > Signed-off-by: Andrey Ryabinin > > That's old, and indeed does seem to be present from that commit and not > exposed by something later. > > Cc: # v2.6.36+ > Reviewed-by: Chris Wilson Applied, thanks for patch&review. -Daniel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch