From mboxrd@z Thu Jan 1 00:00:00 1970 From: Boris Brezillon Subject: Re: [BUG] drm: vc4: refcount_t: increment on 0; use-after-free. Date: Wed, 22 Nov 2017 18:51:11 +0100 Message-ID: <20171122185111.0ffa7fca@bbrezillon> References: <499324124.39558.1511369015110@email.1und1.de> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail.free-electrons.com (mail.free-electrons.com [62.4.15.54]) by gabe.freedesktop.org (Postfix) with ESMTP id 41B346E3AF for ; Wed, 22 Nov 2017 17:51:13 +0000 (UTC) In-Reply-To: <499324124.39558.1511369015110@email.1und1.de> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Stefan Wahren Cc: David Airlie , dri-devel@lists.freedesktop.org, Daniel Vetter List-Id: dri-devel@lists.freedesktop.org SGkgU3RlZmFuLAoKT24gV2VkLCAyMiBOb3YgMjAxNyAxNzo0MzozNSArMDEwMCAoQ0VUKQpTdGVm YW4gV2FocmVuIDxzdGVmYW4ud2FocmVuQGkyc2UuY29tPiB3cm90ZToKCj4gSGkgQm9yaXMsCj4g aWYgaSBib290IFJhc3BiZXJyeSBQaSAzIChBUk02NCwgZGVmY29uZmlnLCBsaW51eC1uZXh0LTIw MTcxMTIyKSB3aXRoIHN1ZmZpY2llbnQgQ01BIG1lbW9yeSAoMzIgTUIpLCBpJ2xsIGdldCB0aGlz IHdhcm5pbmcgZHVyaW5nIGJvb3Q6Cj4gCj4gWyAgICA3LjYyMzUxMF0gdmM0LWRybSBzb2M6Z3B1 OiBib3VuZCAzZjkwMjAwMC5oZG1pIChvcHMgdmM0X2hkbWlfb3BzIFt2YzRdKQo+IFsgICAgNy42 MzI0NTNdIHZjNC1kcm0gc29jOmdwdTogYm91bmQgM2Y4MDYwMDAudmVjIChvcHMgdmM0X3ZlY19v cHMgW3ZjNF0pCj4gWyAgICA3LjYzOTcwN10gdmM0LWRybSBzb2M6Z3B1OiBib3VuZCAzZjQwMDAw MC5odnMgKG9wcyB2YzRfaHZzX29wcyBbdmM0XSkKPiBbICAgIDcuNjQ3MzY0XSB2YzQtZHJtIHNv YzpncHU6IGJvdW5kIDNmMjA2MDAwLnBpeGVsdmFsdmUgKG9wcyB2YzRfY3J0Y19vcHMgW3ZjNF0p Cj4gWyAgICA3LjY1NTQ1MV0gdmM0LWRybSBzb2M6Z3B1OiBib3VuZCAzZjIwNzAwMC5waXhlbHZh bHZlIChvcHMgdmM0X2NydGNfb3BzIFt2YzRdKQo+IFsgICAgNy42NjM0MTVdIHZjNC1kcm0gc29j OmdwdTogYm91bmQgM2Y4MDcwMDAucGl4ZWx2YWx2ZSAob3BzIHZjNF9jcnRjX29wcyBbdmM0XSkK PiBbICAgIDcuNzMwNTgwXSB2YzQtZHJtIHNvYzpncHU6IGJvdW5kIDNmYzAwMDAwLnYzZCAob3Bz IHZjNF92M2Rfb3BzIFt2YzRdKQo+IFsgICAgNy43NDM5NjVdIFtkcm1dIEluaXRpYWxpemVkIHZj NCAwLjAuMCAyMDE0MDYxNiBmb3Igc29jOmdwdSBvbiBtaW5vciAwCj4gWyAgICA3Ljc1MDg0MV0g W2RybV0gU3VwcG9ydHMgdmJsYW5rIHRpbWVzdGFtcCBjYWNoaW5nIFJldiAyICgyMS4xMC4yMDEz KS4KPiBbICAgIDcuNzU3NjIwXSBbZHJtXSBEcml2ZXIgc3VwcG9ydHMgcHJlY2lzZSB2Ymxhbmsg dGltZXN0YW1wIHF1ZXJ5Lgo+IFsgICAgNy44MTE3NzVdIC0tLS0tLS0tLS0tLVsgY3V0IGhlcmUg XS0tLS0tLS0tLS0tLQo+IFsgICAgNy44MTE3ODBdIHJlZmNvdW50X3Q6IGluY3JlbWVudCBvbiAw OyB1c2UtYWZ0ZXItZnJlZS4KPiBbICAgIDcuODExODgxXSBXQVJOSU5HOiBDUFU6IDIgUElEOiAy MTg4IGF0IGxpYi9yZWZjb3VudC5jOjE1MyByZWZjb3VudF9pbmMrMHg0NC8weDUwCj4gWyAgICA3 LjgxMTg4NF0gTW9kdWxlcyBsaW5rZWQgaW46IHZjNCgrKSBjZmc4MDIxMSBjZWMgZHJtX2ttc19o ZWxwZXIgc21zYzk1eHggdXNibmV0IGRybSByZmtpbGwgYnJjbXV0aWwgYmNtMjgzNV9ybmcgcm5n X2NvcmUgYmNtMjgzNV9kbWEgY3JjMzJfY2UgaTJjX2JjbTI4MzUgcHdtX2JjbTI4MzUgaXBfdGFi bGVzIHhfdGFibGVzIGlwdjYKPiBbICAgIDcuODExOTUwXSBDUFU6IDIgUElEOiAyMTg4IENvbW06 IHN5c3RlbWQtdWRldmQgTm90IHRhaW50ZWQgNC4xNC4wLW5leHQtMjAxNzExMjIgIzEKPiBbICAg IDcuODExOTUzXSBIYXJkd2FyZSBuYW1lOiBSYXNwYmVycnkgUGkgMyBNb2RlbCBCIFJldiAxLjIg KERUKQo+IFsgICAgNy44MTE5NThdIHRhc2s6IGZmZmY4MDAwMzZiOTFjMDAgdGFzay5zdGFjazog ZmZmZjAwMDAwZDZmMDAwMAo+IFsgICAgNy44MTE5NjddIHBzdGF0ZTogMjAwMDAwMDUgKG56Q3Yg ZGFpZiAtUEFOIC1VQU8pCj4gWyAgICA3LjgxMTk3NF0gcGMgOiByZWZjb3VudF9pbmMrMHg0NC8w eDUwCj4gWyAgICA3LjgxMTk4MV0gbHIgOiByZWZjb3VudF9pbmMrMHg0NC8weDUwCj4gWyAgICA3 LjgxMTk4NF0gc3AgOiBmZmZmMDAwMDBkNmYzMzAwCj4gWyAgICA3LjgxMTk4OF0geDI5OiBmZmZm MDAwMDBkNmYzMzAwIHgyODogMDAwMDAwMDAwMDAwMDAwMCAKPiBbICAgIDcuODExOTk2XSB4Mjc6 IDAwMDAwMDAwMDAwMDAwMDMgeDI2OiBmZmZmODAwMDM3MTA3ODAwIAo+IFsgICAgNy44MTIwMDRd IHgyNTogMDAwMDAwMDAwMDAwMDAwMSB4MjQ6IGZmZmY4MDAwMzVhZmRjMDAgCj4gWyAgICA3Ljgx MjAxMl0geDIzOiAwMDAwMDAwMDAwMDAwMDAwIHgyMjogZmZmZjgwMDAzNWRmYTYwMCAKPiBbICAg IDcuODEyMDIwXSB4MjE6IGZmZmY4MDAwMzVhZmQ5YjAgeDIwOiBmZmZmODAwMDM1YWZkOWE0IAo+ IFsgICAgNy44MTIwMjddIHgxOTogMDAwMDAwMDAwMDAwMDAwMCB4MTg6IDAwMDAwMDAwMDAwMDAw MDAgCj4gWyAgICA3LjgxMjAzNF0geDE3OiAwMDAwMDAwMDAwMDAwMDAxIHgxNjogMDAwMDAwMDAw MDAwMDAxOSAKPiBbICAgIDcuODEyMDQyXSB4MTU6IDAwMDAwMDAwMDAwMDAwMDEgeDE0OiAwMDAw MDAwMGZmZmZmZmYwIAo+IFsgICAgNy44MTIwNDldIHgxMzogZmZmZjAwMDAwOTBhZTg0MCB4MTI6 IGZmZmYwMDAwMDhmYTJkNTAgCj4gWyAgICA3LjgxMjA1N10geDExOiBmZmZmMDAwMDA4ZmEyMDAw IHgxMDogZmZmZjAwMDAwOTBhZDAwMCAKPiBbICAgIDcuODEyMDY0XSB4OSA6IDAwMDAwMDAwMDAw MDAwMDAgeDggOiBmZmZmMDAwMDA5MGI1YzJmIAo+IFsgICAgNy44MTIwNzJdIHg3IDogMDAwMDAw MDAwMDAwMDAwMCB4NiA6IDAwMDAwMDAwMDAxNWVlMDAgCj4gWyAgICA3LjgxMjA3OV0geDUgOiAw MDAwMDAwMDAwMDAwMDAwIHg0IDogMDAwMDAwMDAwMDAwMDAwMCAKPiBbICAgIDcuODEyMDg3XSB4 MyA6IGZmZmZmZmZmZmZmZmZmZmYgeDIgOiAwMDAwODAwMDMwMDQ3MDAwIAo+IFsgICAgNy44MTIw OTRdIHgxIDogZmZmZjgwMDAzNmI5MWMwMCB4MCA6IDAwMDAwMDAwMDAwMDAwMmIgCj4gWyAgICA3 LjgxMjEwMl0gQ2FsbCB0cmFjZToKPiBbICAgIDcuODEyMTA5XSAgcmVmY291bnRfaW5jKzB4NDQv MHg1MAo+IFsgICAgNy44MTIyMjZdICB2YzRfYm9faW5jX3VzZWNudCsweDg0LzB4ODggW3ZjNF0K PiBbICAgIDcuODEyMzEwXSAgdmM0X3ByZXBhcmVfZmIrMHg0MC8weGYwIFt2YzRdCj4gWyAgICA3 LjgxMjQ2MF0gIGRybV9hdG9taWNfaGVscGVyX3ByZXBhcmVfcGxhbmVzKzB4NTQvMHhmMCBbZHJt X2ttc19oZWxwZXJdCj4gWyAgICA3LjgxMjU0M10gIHZjNF9hdG9taWNfY29tbWl0KzB4ODgvMHgx MzAgW3ZjNF0KPiBbICAgIDcuODEyODY4XSAgZHJtX2F0b21pY19jb21taXQrMHg0OC8weDY4IFtk cm1dCj4gWyAgICA3LjgxMzAwMl0gIHJlc3RvcmVfZmJkZXZfbW9kZV9hdG9taWMrMHgxZDgvMHgx ZTggW2RybV9rbXNfaGVscGVyXQo+IFsgICAgNy44MTMxMTNdICByZXN0b3JlX2ZiZGV2X21vZGUr MHgyOC8weDE2MCBbZHJtX2ttc19oZWxwZXJdCj4gWyAgICA3LjgxMzIyM10gIGRybV9mYl9oZWxw ZXJfcmVzdG9yZV9mYmRldl9tb2RlX3VubG9ja2VkLnBhcnQuMjQrMHgyOC8weDkwIFtkcm1fa21z X2hlbHBlcl0KPiBbICAgIDcuODEzMzMxXSAgZHJtX2ZiX2hlbHBlcl9zZXRfcGFyKzB4NTQvMHhh OCBbZHJtX2ttc19oZWxwZXJdCj4gWyAgICA3LjgxMzM0Nl0gIGZiY29uX2luaXQrMHg0ZTgvMHg1 MzgKPiBbICAgIDcuODEzMzU3XSAgdmlzdWFsX2luaXQrMHhiNC8weDEwOAo+IFsgICAgNy44MTMz NjZdICBkb19iaW5kX2Nvbl9kcml2ZXIrMHgxYjgvMHgzYTAKPiBbICAgIDcuODEzMzczXSAgZG9f dGFrZV9vdmVyX2NvbnNvbGUrMHgxNTAvMHgxZDAKPiBbICAgIDcuODEzMzgwXSAgZG9fZmJjb25f dGFrZW92ZXIrMHg2Yy8weGYwCj4gWyAgICA3LjgxMzM4N10gIGZiY29uX2V2ZW50X25vdGlmeSsw eDhmYy8weDkyOAo+IFsgICAgNy44MTMzOTldICBub3RpZmllcl9jYWxsX2NoYWluKzB4NTAvMHg5 MAo+IFsgICAgNy44MTM0MDZdICBfX2Jsb2NraW5nX25vdGlmaWVyX2NhbGxfY2hhaW4rMHg0Yy8w eDkwCj4gWyAgICA3LjgxMzQxM10gIGJsb2NraW5nX25vdGlmaWVyX2NhbGxfY2hhaW4rMHgxNC8w eDIwCj4gWyAgICA3LjgxMzQyMF0gIGZiX25vdGlmaWVyX2NhbGxfY2hhaW4rMHgxYy8weDI4Cj4g WyAgICA3LjgxMzQyNl0gIHJlZ2lzdGVyX2ZyYW1lYnVmZmVyKzB4MWQwLzB4MmQ4Cj4gWyAgICA3 LjgxMzUzM10gIF9fZHJtX2ZiX2hlbHBlcl9pbml0aWFsX2NvbmZpZ19hbmRfdW5sb2NrKzB4MWU4 LzB4MzUwIFtkcm1fa21zX2hlbHBlcl0KPiBbICAgIDcuODEzNjM5XSAgZHJtX2ZiX2hlbHBlcl9p bml0aWFsX2NvbmZpZysweDQwLzB4NTggW2RybV9rbXNfaGVscGVyXQo+IFsgICAgNy44MTM3NDdd ICBkcm1fZmJkZXZfY21hX2luaXRfd2l0aF9mdW5jcysweDg4LzB4MTU4IFtkcm1fa21zX2hlbHBl cl0KPiBbICAgIDcuODEzODU1XSAgZHJtX2ZiZGV2X2NtYV9pbml0KzB4MTQvMHgyOCBbZHJtX2tt c19oZWxwZXJdCj4gWyAgICA3LjgxMzk0M10gIHZjNF9rbXNfbG9hZCsweGE0LzB4ZjAgW3ZjNF0K PiBbICAgIDcuODE0MDI2XSAgdmM0X2RybV9iaW5kKzB4MTAwLzB4MTY4IFt2YzRdCj4gWyAgICA3 LjgxNDAzOF0gIHRyeV90b19icmluZ191cF9tYXN0ZXIrMHgxNDQvMHgxYTgKPiBbICAgIDcuODE0 MDQ0XSAgY29tcG9uZW50X21hc3Rlcl9hZGRfd2l0aF9tYXRjaCsweDljLzB4ZTAKPiBbICAgIDcu ODE0MTI4XSAgdmM0X3BsYXRmb3JtX2RybV9wcm9iZSsweGI0LzB4ZjAgW3ZjNF0KPiBbICAgIDcu ODE0MTM3XSAgcGxhdGZvcm1fZHJ2X3Byb2JlKzB4NTgvMHhjMAo+IFsgICAgNy44MTQxNDZdICBk cml2ZXJfcHJvYmVfZGV2aWNlKzB4MjI0LzB4MzA4Cj4gWyAgICA3LjgxNDE1M10gIF9fZHJpdmVy X2F0dGFjaCsweGFjLzB4YjAKPiBbICAgIDcuODE0MTYxXSAgYnVzX2Zvcl9lYWNoX2RldisweDY0 LzB4YTAKPiBbICAgIDcuODE0MTY5XSAgZHJpdmVyX2F0dGFjaCsweDIwLzB4MjgKPiBbICAgIDcu ODE0MTc3XSAgYnVzX2FkZF9kcml2ZXIrMHgxMDgvMHgyMjgKPiBbICAgIDcuODE0MTg0XSAgZHJp dmVyX3JlZ2lzdGVyKzB4NjAvMHhmOAo+IFsgICAgNy44MTQxOTBdICBfX3BsYXRmb3JtX2RyaXZl cl9yZWdpc3RlcisweDQwLzB4NDgKPiBbICAgIDcuODE0Mjc0XSAgdmM0X2RybV9yZWdpc3Rlcisw eDM4LzB4MTAwMCBbdmM0XQo+IFsgICAgNy44MTQyODNdICBkb19vbmVfaW5pdGNhbGwrMHgzOC8w eDEyMAo+IFsgICAgNy44MTQyOTVdICBkb19pbml0X21vZHVsZSsweDU4LzB4MWI4Cj4gWyAgICA3 LjgxNDMwNF0gIGxvYWRfbW9kdWxlKzB4MWZhOC8weDIyODAKPiBbICAgIDcuODE0MzExXSAgU3lT X2Zpbml0X21vZHVsZSsweGMwLzB4ZDAKPiBbICAgIDcuODE0MzE4XSAgX19zeXNfdHJhY2VfcmV0 dXJuKzB4MC8weDQKPiBbICAgIDcuODE0MzI1XSAtLS1bIGVuZCB0cmFjZSAzMzQ4NTU0ZWI5MWUx OWExIF0tLS0KCkxvb2tzIGxpa2UgSSBkaWRuJ3QgdGVzdCB0aGlzIGNvZGUgd2l0aCBDT05GSUdf UkVGQ09VTlRfRlVMTCBlbmFibGVkIDotLy4KCkFueXdheSwgY2FuIHlvdSB0cnkgdG8gYXBwbHkg dGhlIGZvbGxvd2luZyBkaWZmIGFuZCBsZXQgbWUga25vdyBpZiBpdApmaXhlcyB0aGUgcHJvYmxl bT8KClRoYW5rcywKCkJvcmlzCgotLS0+OC0tLQpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJt L3ZjNC92YzRfYm8uYyBiL2RyaXZlcnMvZ3B1L2RybS92YzQvdmM0X2JvLmMKaW5kZXggNGFlNDVk N2RhYzQyLi4yZGVjYzhlMmM3OWYgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS92YzQvdmM0 X2JvLmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL3ZjNC92YzRfYm8uYwpAQCAtNjM3LDcgKzYzNyw4 IEBAIGludCB2YzRfYm9faW5jX3VzZWNudChzdHJ1Y3QgdmM0X2JvICpibykKICAgICAgICBtdXRl eF9sb2NrKCZiby0+bWFkdl9sb2NrKTsKICAgICAgICBzd2l0Y2ggKGJvLT5tYWR2KSB7CiAgICAg ICAgY2FzZSBWQzRfTUFEVl9XSUxMTkVFRDoKLSAgICAgICAgICAgICAgIHJlZmNvdW50X2luYygm Ym8tPnVzZWNudCk7CisgICAgICAgICAgICAgICBpZiAoIXJlZmNvdW50X2luY19ub3RfemVybygm Ym8tPnVzZWNudCkpCisgICAgICAgICAgICAgICAgICAgICAgIHJlZmNvdW50X3NldCgmYm8tPnVz ZWNudCwgMSk7CiAgICAgICAgICAgICAgICByZXQgPSAwOwogICAgICAgICAgICAgICAgYnJlYWs7 CiAgICAgICAgY2FzZSBWQzRfTUFEVl9ET05UTkVFRDoKCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCmRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKZHJpLWRldmVs QGxpc3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWls bWFuL2xpc3RpbmZvL2RyaS1kZXZlbAo=