From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon-CC+yJ3UmIYqDUpFQwHEjaQ@public.gmane.org Subject: [Bug 104161] New: refcount_t: increment on 0; use-after-free. Date: Thu, 07 Dec 2017 11:03:59 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0626097167==" Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: nouveau-bounces-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Sender: "Nouveau" To: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org List-Id: nouveau.vger.kernel.org --===============0626097167== Content-Type: multipart/alternative; boundary="15126446391.0719CB.13045"; charset="UTF-8" --15126446391.0719CB.13045 Date: Thu, 7 Dec 2017 11:03:59 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D104161 Bug ID: 104161 Summary: refcount_t: increment on 0; use-after-free. Product: xorg Version: git Hardware: x86-64 (AMD64) OS: Linux (All) Status: NEW Severity: normal Priority: medium Component: Driver/nouveau Assignee: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Reporter: sgilles-8yXg+M/94Z32fBVCVOL8/A@public.gmane.org QA Contact: xorg-team-go0+a7rfsptAfugRpC6u6w@public.gmane.org Created attachment 136033 --> https://bugs.freedesktop.org/attachment.cgi?id=3D136033&action=3Dedit dmesg including trace(s) I'm using current (within 24 hours) versions of libdrm, mesa, and the mainl= ine kernel, with xf86-video-nouveau-1.0.15. This shows up early in dmesg. The driver appears usable afterwards. --=20 You are receiving this mail because: You are the assignee for the bug.= --15126446391.0719CB.13045 Date: Thu, 7 Dec 2017 11:03:59 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated
Bug ID 104161
Summary refcount_t: increment on 0; use-after-free.
Product xorg
Version git
Hardware x86-64 (AMD64)
OS Linux (All)
Status NEW
Severity normal
Priority medium
Component Driver/nouveau
Assignee nouveau@lists.freedesktop.org
Reporter sgilles@math.umd.edu
QA Contact xorg-team@lists.x.org 

Created attachment 1360=
33 [details]
dmesg including trace(s)

I'm using current (within 24 hours) versions of libdrm, mesa, and the mainl=
ine
kernel, with xf86-video-nouveau-1.0.15. This shows up early in dmesg. The
driver appears usable afterwards.

You are receiving this mail because:
  • You are the assignee for the bug.
= --15126446391.0719CB.13045-- --===============0626097167== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTm91dmVhdSBt YWlsaW5nIGxpc3QKTm91dmVhdUBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cHM6Ly9saXN0cy5m cmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9ub3V2ZWF1Cg== --===============0626097167==--