From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dave Gordon Subject: Re: [PATCH] drm/i915: Fix a use after free, and unbalanced refcounting Date: Thu, 19 Feb 2015 11:23:08 +0000 Message-ID: <54E5C79C.3030902@intel.com> References: <1424268118-20909-1-git-send-email-nicholas.hoath@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTP id AA58C6E59D for ; Thu, 19 Feb 2015 03:23:23 -0800 (PST) In-Reply-To: <1424268118-20909-1-git-send-email-nicholas.hoath@intel.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" To: Nick Hoath , intel-gfx@lists.freedesktop.org List-Id: intel-gfx@lists.freedesktop.org T24gMTgvMDIvMTUgMTQ6MDEsIE5pY2sgSG9hdGggd3JvdGU6Cj4gQnVnemlsbGE6IGh0dHBzOi8v YnVncy5mcmVlZGVza3RvcC5vcmcvc2hvd19idWcuY2dpP2lkPTg4NjUyCj4gCj4gV2hlbiBjb252 ZXJ0aW5nIGZyb20gaW1wbGljaXRseSB0cmFja2VkIGV4ZWNsaXN0IHF1ZXVlIGl0ZW1zIHRvIHJl ZiBjb3VudGVkCj4gcmVxdWVzdHMsIG5vdCBhbGwgZnJlZXMgb2YgcmVxdWVzdHMgd2VyZSByZXBs YWNlZCB3aXRoIHVucmVmcywgYW5kIGV4dHJhbmVvdXMKPiByZWZzL3VucmVmcyBvZiBjb250ZXh0 cyB3ZXJlIGFkZGVkLgo+IENvcnJlY3QgdGhlIHVuYmFsYW5jZWQgcmVmY291bnQgJiByZXBsYWNl IHRoZSBmcmVlcy4KPiBSZW1vdmUgYSBub2lzeSB3YXJuaW5nIHdoZW4gaGl0dGluZyB0aGUgcmVx dWVzdCBjcmVhdGlvbiBwYXRoLgo+IAo+IGRybV9pOTE1X2dlbV9yZXF1ZXN0IGFuZCBpbnRlbF9j b250ZXh0IGFyZSBib3RoIGtyZWYgcmVmZXJlbmNlIGNvdW50ZWQKPiBzdHJ1Y3R1cmVzLiBVcG9u IGFsbG9jYXRpb24sIGRybV9pOTE1X2dlbV9yZXF1ZXN0J3MgcmVmIGNvdW50IHNob3VsZCBiZQo+ IGJ1bXBlZCB1c2luZyBrcmVmX2luaXQuIFdoZW4gYSBjb250ZXh0IGlzIGFzc2lnbmVkIHRvIHRo ZSByZXF1ZXN0LAo+IHRoZSBjb250ZXh0J3MgcmVmZXJlbmNlIGNvdW50IHNob3VsZCBiZSBidW1w ZWQgdXNpbmcgaTkxNV9nZW1fY29udGV4dF9yZWZlcmVuY2UuCj4gaTkxNV9nZW1fcmVxdWVzdF9y ZWZlcmVuY2Ugd2lsbCByZWR1Y2UgdGhlIGNvbnRleHQgcmVmZXJlbmNlIGNvdW50IHdoZW4KCnMv aTkxNV9nZW1fcmVxdWVzdF9yZWZlcmVuY2UvaTkxNV9nZW1fcmVxdWVzdF9mcmVlLyA/Cgo+IHRo ZSByZXF1ZXN0IGlzIGZyZWVkLgo+IAo+IFByb2JsZW0gaW50cm9kdWNlZCBpbjoKPiBjb21taXQg NmQzZDgyNzRiYzQ1ZGU0YmFiYjYyZDY0NTYyZDkyYWY5ODRkZDIzOAo+IEF1dGhvcjogICAgIE5p Y2sgSG9hdGggPG5pY2hvbGFzLmhvYXRoQGludGVsLmNvbT4KPiBBdXRob3JEYXRlOiBUaHUgSmFu IDE1IDEzOjEwOjM5IDIwMTUgKzAwMDAKPiAKPiAgICAgZHJtL2k5MTU6IFN1YnN1bWUgaW50ZWxf Y3R4X3N1Ym1pdF9yZXF1ZXN0IGluIHRvIGRybV9pOTE1X2dlbV9yZXF1ZXN0Cj4gCj4gdjI6IEFk ZGVkIGNvbW1lbnRzIGV4cGxhaW5pbmcgaG93IHRoZSBjdHggcG9pbnRlciBhbmQgdGhlIHJlcXVl c3Qgb2JqZWN0IHNob3VsZAo+IGJlIHJlZi1jb3VudGVkLiBSZW1vdmVkIG5vaXN5IHdhcm5pbmcu Cj4gCj4gU2lnbmVkLW9mZi1ieTogTmljayBIb2F0aCA8bmljaG9sYXMuaG9hdGhAaW50ZWwuY29t Pgo+IC0tLQo+ICBkcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2Rydi5oICB8IDExICsrKysrKysr KystCj4gIGRyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVfZ2VtLmMgIHwgIDMgKy0tCj4gIGRyaXZl cnMvZ3B1L2RybS9pOTE1L2ludGVsX2xyYy5jIHwgIDggKysrKy0tLS0KPiAgNCBmaWxlcyBjaGFu Z2VkLCAxNiBpbnNlcnRpb25zKCspLCA4IGRlbGV0aW9ucygtKQo+IAo+IGRpZmYgLS1naXQgYS9k cml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2Rydi5oIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaTkx NV9kcnYuaAo+IGluZGV4IDJkZWRkNDMuLjk1NmZlMjYgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9n cHUvZHJtL2k5MTUvaTkxNV9kcnYuaAo+ICsrKyBiL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVf ZHJ2LmgKPiBAQCAtMjEyMSw2ICsyMTIxLDkgQEAgdm9pZCBpOTE1X2dlbV90cmFja19mYihzdHJ1 Y3QgZHJtX2k5MTVfZ2VtX29iamVjdCAqb2xkLAo+ICAgKiBudW1iZXIgY29tcGFyaXNvbnMgb24g YnVmZmVyIGxhc3RfcmVhZHx3cml0ZV9zZXFuby4gSXQgYWxzbyBhbGxvd3MgYW4KPiAgICogZW1p c3Npb24gdGltZSB0byBiZSBhc3NvY2lhdGVkIHdpdGggdGhlIHJlcXVlc3QgZm9yIHRyYWNraW5n IGhvdyBmYXIgYWhlYWQKPiAgICogb2YgdGhlIEdQVSB0aGUgc3VibWlzc2lvbiBpcy4KPiArICoK PiArICogVGhlIHJlcXVlc3RzIGFyZSByZWZlcmVuY2UgY291bnRlZCwgc28gdXBvbiBjcmVhdGlv biB0aGV5IHNob3VsZCBoYXZlIGFuCj4gKyAqIGluaXRpYWwgcmVmZXJlbmNlIHRha2VuIHVzaW5n IGtyZWZfaW5pdAo+ICAgKi8KPiAgc3RydWN0IGRybV9pOTE1X2dlbV9yZXF1ZXN0IHsKPiAgCXN0 cnVjdCBrcmVmIHJlZjsKPiBAQCAtMjE0NCw3ICsyMTQ3LDEzIEBAIHN0cnVjdCBkcm1faTkxNV9n ZW1fcmVxdWVzdCB7Cj4gIAkvKiogUG9zaXRpb24gaW4gdGhlIHJpbmdidWZmZXIgb2YgdGhlIGVu ZCBvZiB0aGUgd2hvbGUgcmVxdWVzdCAqLwo+ICAJdTMyIHRhaWw7Cj4gIAo+IC0JLyoqIENvbnRl eHQgcmVsYXRlZCB0byB0aGlzIHJlcXVlc3QgKi8KPiArCS8qKgo+ICsJICogQ29udGV4dCByZWxh dGVkIHRvIHRoaXMgcmVxdWVzdAo+ICsJICogaW50ZWxfY29udGV4dCBpcyByZWZlcmVuY2UgY291 bnRlZCwgc28gb24gYXR0YWNobWVudCB0byB0aGlzCj4gKwkgKiByZXF1ZXN0LCB0aGUgY29udGV4 dCBzaG91bGQgYmUgaTkxNV9nZW1fY29udGV4dF9yZWZlcmVuY2UnZC4KPiArCSAqIFdoZW4gdGhp cyByZXF1ZXN0IGhhcyBpdHMgcmVmZXJlbmNlIGNvdW50IGNsZWFyZWQsIHRoZSBjbGVhbnVwCj4g KwkgKiBjb2RlIGluIGk5MTVfZ2VtX3JlcXVlc3RfZnJlZSB3aWxsIGRlZmVyZW5jZSB0aGUgY29u dGV4dC4KCnMvZGVmZXJlbmNlL3VucmVmZXJlbmNlLwoKT3IgbWF5YmUgcmVwbGFjZSB0aGUgY29t bWVudCB3aXRoIHRoaXMgdmVyc2lvbiwgaWYgeW91IHRoaW5rIGl0J3MgbmljZXI6CgpDb250ZXh0 IHJlbGF0ZWQgdG8gdGhpcyByZXF1ZXN0CkNvbnRleHRzIGFyZSByZWZjb3VudGVkLCBzbyB3aGVu IHRoaXMgcmVxdWVzdCBpcyBhc3NvY2lhdGVkIHdpdGggYQpjb250ZXh0LCB3ZSBtdXN0IGluY3Jl bWVudCB0aGUgY29udGV4dCdzIHJlZmNvdW50LCB0byBndWFyYW50ZWUgdGhhdCBpdApwZXJzaXN0 cyB3aGlsZSBhbnkgcmVxdWVzdCBpcyBsaW5rZWQgdG8gaXQuIFJlcXVlc3RzIHRoZW1zZWx2ZXMg YXJlIGFsc28KcmVmY291bnRlZCwgc28gdGhlIHJlcXVlc3Qgd2lsbCBvbmx5IGJlIGZyZWVkIHdo ZW4gdGhlIGxhc3QgcmVmZXJlbmNlIHRvCml0IGlzIGRpc21pc3NlZCwgYW5kIHRoZSBjb2RlIGlu IGk5MTVfZ2VtX3JlcXVlc3RfZnJlZSgpIHdpbGwgdGhlbgpkZWNyZW1lbnQgdGhlIHJlZmNvdW50 IG9uIHRoZSBjb250ZXh0LgoKLkRhdmUuCgo+ICsJICovCj4gIAlzdHJ1Y3QgaW50ZWxfY29udGV4 dCAqY3R4Owo+ICAKPiAgCS8qKiBCYXRjaCBidWZmZXIgcmVsYXRlZCB0byB0aGlzIHJlcXVlc3Qg aWYgYW55ICovCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVfZ2VtLmMg Yi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dlbS5jCj4gaW5kZXggNjExMzRhYi4uOTk2ZjYw ZiAxMDA2NDQKPiAtLS0gYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dlbS5jCj4gKysrIGIv ZHJpdmVycy9ncHUvZHJtL2k5MTUvaTkxNV9nZW0uYwo+IEBAIC0yNjY0LDggKzI2NjQsNyBAQCBz dGF0aWMgdm9pZCBpOTE1X2dlbV9yZXNldF9yaW5nX2NsZWFudXAoc3RydWN0IGRybV9pOTE1X3By aXZhdGUgKmRldl9wcml2LAo+ICAJCWlmIChzdWJtaXRfcmVxLT5jdHggIT0gcmluZy0+ZGVmYXVs dF9jb250ZXh0KQo+ICAJCQlpbnRlbF9scl9jb250ZXh0X3VucGluKHJpbmcsIHN1Ym1pdF9yZXEt PmN0eCk7Cj4gIAo+IC0JCWk5MTVfZ2VtX2NvbnRleHRfdW5yZWZlcmVuY2Uoc3VibWl0X3JlcS0+ Y3R4KTsKPiAtCQlrZnJlZShzdWJtaXRfcmVxKTsKPiArCQlpOTE1X2dlbV9yZXF1ZXN0X3VucmVm ZXJlbmNlKHN1Ym1pdF9yZXEpOwo+ICAJfQo+ICAKPiAgCS8qCj4gZGlmZiAtLWdpdCBhL2RyaXZl cnMvZ3B1L2RybS9pOTE1L2ludGVsX2xyYy5jIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaW50ZWxf bHJjLmMKPiBpbmRleCBhYWZjZWYzLi42MmEyYjJhIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvZ3B1 L2RybS9pOTE1L2ludGVsX2xyYy5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaW50ZWxf bHJjLmMKPiBAQCAtNTEyLDE4ICs1MTIsMTkgQEAgc3RhdGljIGludCBleGVjbGlzdHNfY29udGV4 dF9xdWV1ZShzdHJ1Y3QgaW50ZWxfZW5naW5lX2NzICpyaW5nLAo+ICAJCSAqIElmIHRoZXJlIGlz bid0IGEgcmVxdWVzdCBhc3NvY2lhdGVkIHdpdGggdGhpcyBzdWJtaXNzaW9uLAo+ICAJCSAqIGNy ZWF0ZSBvbmUgYXMgYSB0ZW1wb3JhcnkgaG9sZGVyLgo+ICAJCSAqLwo+IC0JCVdBUk4oMSwgImV4 ZWNsaXN0IGNvbnRleHQgc3VibWlzc2lvbiB3aXRob3V0IHJlcXVlc3QiKTsKPiAgCQlyZXF1ZXN0 ID0ga3phbGxvYyhzaXplb2YoKnJlcXVlc3QpLCBHRlBfS0VSTkVMKTsKPiAgCQlpZiAocmVxdWVz dCA9PSBOVUxMKQo+ICAJCQlyZXR1cm4gLUVOT01FTTsKPiAgCQlyZXF1ZXN0LT5yaW5nID0gcmlu ZzsKPiAgCQlyZXF1ZXN0LT5jdHggPSB0bzsKPiArCQlrcmVmX2luaXQoJnJlcXVlc3QtPnJlZik7 Cj4gKwkJcmVxdWVzdC0+dW5pcSA9IGRldl9wcml2LT5yZXF1ZXN0X3VuaXErKzsKPiArCQlpOTE1 X2dlbV9jb250ZXh0X3JlZmVyZW5jZShyZXF1ZXN0LT5jdHgpOwo+ICAJfSBlbHNlIHsKPiArCQlp OTE1X2dlbV9yZXF1ZXN0X3JlZmVyZW5jZShyZXF1ZXN0KTsKPiAgCQlXQVJOX09OKHRvICE9IHJl cXVlc3QtPmN0eCk7Cj4gIAl9Cj4gIAlyZXF1ZXN0LT50YWlsID0gdGFpbDsKPiAtCWk5MTVfZ2Vt X3JlcXVlc3RfcmVmZXJlbmNlKHJlcXVlc3QpOwo+IC0JaTkxNV9nZW1fY29udGV4dF9yZWZlcmVu Y2UocmVxdWVzdC0+Y3R4KTsKPiAgCj4gIAlpbnRlbF9ydW50aW1lX3BtX2dldChkZXZfcHJpdik7 Cj4gIAo+IEBAIC03NDAsNyArNzQxLDYgQEAgdm9pZCBpbnRlbF9leGVjbGlzdHNfcmV0aXJlX3Jl cXVlc3RzKHN0cnVjdCBpbnRlbF9lbmdpbmVfY3MgKnJpbmcpCj4gIAkJaWYgKGN0eF9vYmogJiYg KGN0eCAhPSByaW5nLT5kZWZhdWx0X2NvbnRleHQpKQo+ICAJCQlpbnRlbF9scl9jb250ZXh0X3Vu cGluKHJpbmcsIGN0eCk7Cj4gIAkJaW50ZWxfcnVudGltZV9wbV9wdXQoZGV2X3ByaXYpOwo+IC0J CWk5MTVfZ2VtX2NvbnRleHRfdW5yZWZlcmVuY2UoY3R4KTsKPiAgCQlsaXN0X2RlbCgmcmVxLT5l eGVjbGlzdF9saW5rKTsKPiAgCQlpOTE1X2dlbV9yZXF1ZXN0X3VucmVmZXJlbmNlKHJlcSk7Cj4g IAl9Cj4gCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpJ bnRlbC1nZnggbWFpbGluZyBsaXN0CkludGVsLWdmeEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0 cDovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ludGVsLWdmeAo=