From mboxrd@z Thu Jan  1 00:00:00 1970
From: Nick Hoath <nicholas.hoath@intel.com>
Subject: Re: [PATCH] drm/i915: Fix a use after free,
 and unbalanced refcounting
Date: Thu, 19 Feb 2015 11:38:07 +0000
Message-ID: <54E5CB1F.1080805@intel.com>
References: <1424268118-20909-1-git-send-email-nicholas.hoath@intel.com>
 <54E5C79C.3030902@intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Content-Transfer-Encoding: base64
Return-path: <intel-gfx-bounces@lists.freedesktop.org>
Received: from mga03.intel.com (mga03.intel.com [134.134.136.65])
 by gabe.freedesktop.org (Postfix) with ESMTP id 65D0C6E59D
 for <intel-gfx@lists.freedesktop.org>; Thu, 19 Feb 2015 03:38:10 -0800 (PST)
In-Reply-To: <54E5C79C.3030902@intel.com>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
 <mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
 <mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Errors-To: intel-gfx-bounces@lists.freedesktop.org
Sender: "Intel-gfx" <intel-gfx-bounces@lists.freedesktop.org>
To: "Gordon, David S" <david.s.gordon@intel.com>, "intel-gfx@lists.freedesktop.org" <intel-gfx@lists.freedesktop.org>
List-Id: intel-gfx@lists.freedesktop.org

T24gMTkvMDIvMjAxNSAxMToyMywgR29yZG9uLCBEYXZpZCBTIHdyb3RlOgo+IE9uIDE4LzAyLzE1
IDE0OjAxLCBOaWNrIEhvYXRoIHdyb3RlOgo+PiBCdWd6aWxsYTogaHR0cHM6Ly9idWdzLmZyZWVk
ZXNrdG9wLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODg2NTIKPj4KPj4gV2hlbiBjb252ZXJ0aW5nIGZy
b20gaW1wbGljaXRseSB0cmFja2VkIGV4ZWNsaXN0IHF1ZXVlIGl0ZW1zIHRvIHJlZiBjb3VudGVk
Cj4+IHJlcXVlc3RzLCBub3QgYWxsIGZyZWVzIG9mIHJlcXVlc3RzIHdlcmUgcmVwbGFjZWQgd2l0
aCB1bnJlZnMsIGFuZCBleHRyYW5lb3VzCj4+IHJlZnMvdW5yZWZzIG9mIGNvbnRleHRzIHdlcmUg
YWRkZWQuCj4+IENvcnJlY3QgdGhlIHVuYmFsYW5jZWQgcmVmY291bnQgJiByZXBsYWNlIHRoZSBm
cmVlcy4KPj4gUmVtb3ZlIGEgbm9pc3kgd2FybmluZyB3aGVuIGhpdHRpbmcgdGhlIHJlcXVlc3Qg
Y3JlYXRpb24gcGF0aC4KPj4KPj4gZHJtX2k5MTVfZ2VtX3JlcXVlc3QgYW5kIGludGVsX2NvbnRl
eHQgYXJlIGJvdGgga3JlZiByZWZlcmVuY2UgY291bnRlZAo+PiBzdHJ1Y3R1cmVzLiBVcG9uIGFs
bG9jYXRpb24sIGRybV9pOTE1X2dlbV9yZXF1ZXN0J3MgcmVmIGNvdW50IHNob3VsZCBiZQo+PiBi
dW1wZWQgdXNpbmcga3JlZl9pbml0LiBXaGVuIGEgY29udGV4dCBpcyBhc3NpZ25lZCB0byB0aGUg
cmVxdWVzdCwKPj4gdGhlIGNvbnRleHQncyByZWZlcmVuY2UgY291bnQgc2hvdWxkIGJlIGJ1bXBl
ZCB1c2luZyBpOTE1X2dlbV9jb250ZXh0X3JlZmVyZW5jZS4KPj4gaTkxNV9nZW1fcmVxdWVzdF9y
ZWZlcmVuY2Ugd2lsbCByZWR1Y2UgdGhlIGNvbnRleHQgcmVmZXJlbmNlIGNvdW50IHdoZW4KPgo+
IHMvaTkxNV9nZW1fcmVxdWVzdF9yZWZlcmVuY2UvaTkxNV9nZW1fcmVxdWVzdF9mcmVlLyA/CgpJ
IG1lYW50IGk5MTVfZ2VtX3JlcXVlc3RfdW5yZWZlcmVuY2UsIGJ1dCBzaG91bGQgcHJvYmFibHkg
bWVudGlvbiB0aGF0IAppOTE1X2dlbV9yZXF1ZXN0X2ZyZWUgaXMgY2FsbGVkIHdoZW4gdGhlIHJl
cXVlc3QgcmVmZXJlbmNlIGNvdW50IHJlYWNoZXMgCnplcm8sIGFuZCBpdCBpcyB0aGF0IGZ1bmN0
aW9uIHdoaWNoIGRyb3BzIHRoZSBjb250ZXh0IHJlZmVyZW5jZSBjb3VudC4KCj4KPj4gdGhlIHJl
cXVlc3QgaXMgZnJlZWQuCj4+Cj4+IFByb2JsZW0gaW50cm9kdWNlZCBpbjoKPj4gY29tbWl0IDZk
M2Q4Mjc0YmM0NWRlNGJhYmI2MmQ2NDU2MmQ5MmFmOTg0ZGQyMzgKPj4gQXV0aG9yOiAgICAgTmlj
ayBIb2F0aCA8bmljaG9sYXMuaG9hdGhAaW50ZWwuY29tPgo+PiBBdXRob3JEYXRlOiBUaHUgSmFu
IDE1IDEzOjEwOjM5IDIwMTUgKzAwMDAKPj4KPj4gICAgICBkcm0vaTkxNTogU3Vic3VtZSBpbnRl
bF9jdHhfc3VibWl0X3JlcXVlc3QgaW4gdG8gZHJtX2k5MTVfZ2VtX3JlcXVlc3QKPj4KPj4gdjI6
IEFkZGVkIGNvbW1lbnRzIGV4cGxhaW5pbmcgaG93IHRoZSBjdHggcG9pbnRlciBhbmQgdGhlIHJl
cXVlc3Qgb2JqZWN0IHNob3VsZAo+PiBiZSByZWYtY291bnRlZC4gUmVtb3ZlZCBub2lzeSB3YXJu
aW5nLgo+Pgo+PiBTaWduZWQtb2ZmLWJ5OiBOaWNrIEhvYXRoIDxuaWNob2xhcy5ob2F0aEBpbnRl
bC5jb20+Cj4+IC0tLQo+PiAgIGRyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVfZHJ2LmggIHwgMTEg
KysrKysrKysrKy0KPj4gICBkcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dlbS5jICB8ICAzICst
LQo+PiAgIGRyaXZlcnMvZ3B1L2RybS9pOTE1L2ludGVsX2xyYy5jIHwgIDggKysrKy0tLS0KPj4g
ICA0IGZpbGVzIGNoYW5nZWQsIDE2IGluc2VydGlvbnMoKyksIDggZGVsZXRpb25zKC0pCj4+Cj4+
IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2Rydi5oIGIvZHJpdmVycy9n
cHUvZHJtL2k5MTUvaTkxNV9kcnYuaAo+PiBpbmRleCAyZGVkZDQzLi45NTZmZTI2IDEwMDY0NAo+
PiAtLS0gYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2Rydi5oCj4+ICsrKyBiL2RyaXZlcnMv
Z3B1L2RybS9pOTE1L2k5MTVfZHJ2LmgKPj4gQEAgLTIxMjEsNiArMjEyMSw5IEBAIHZvaWQgaTkx
NV9nZW1fdHJhY2tfZmIoc3RydWN0IGRybV9pOTE1X2dlbV9vYmplY3QgKm9sZCwKPj4gICAgKiBu
dW1iZXIgY29tcGFyaXNvbnMgb24gYnVmZmVyIGxhc3RfcmVhZHx3cml0ZV9zZXFuby4gSXQgYWxz
byBhbGxvd3MgYW4KPj4gICAgKiBlbWlzc2lvbiB0aW1lIHRvIGJlIGFzc29jaWF0ZWQgd2l0aCB0
aGUgcmVxdWVzdCBmb3IgdHJhY2tpbmcgaG93IGZhciBhaGVhZAo+PiAgICAqIG9mIHRoZSBHUFUg
dGhlIHN1Ym1pc3Npb24gaXMuCj4+ICsgKgo+PiArICogVGhlIHJlcXVlc3RzIGFyZSByZWZlcmVu
Y2UgY291bnRlZCwgc28gdXBvbiBjcmVhdGlvbiB0aGV5IHNob3VsZCBoYXZlIGFuCj4+ICsgKiBp
bml0aWFsIHJlZmVyZW5jZSB0YWtlbiB1c2luZyBrcmVmX2luaXQKPj4gICAgKi8KPj4gICBzdHJ1
Y3QgZHJtX2k5MTVfZ2VtX3JlcXVlc3Qgewo+PiAgIAlzdHJ1Y3Qga3JlZiByZWY7Cj4+IEBAIC0y
MTQ0LDcgKzIxNDcsMTMgQEAgc3RydWN0IGRybV9pOTE1X2dlbV9yZXF1ZXN0IHsKPj4gICAJLyoq
IFBvc2l0aW9uIGluIHRoZSByaW5nYnVmZmVyIG9mIHRoZSBlbmQgb2YgdGhlIHdob2xlIHJlcXVl
c3QgKi8KPj4gICAJdTMyIHRhaWw7Cj4+Cj4+IC0JLyoqIENvbnRleHQgcmVsYXRlZCB0byB0aGlz
IHJlcXVlc3QgKi8KPj4gKwkvKioKPj4gKwkgKiBDb250ZXh0IHJlbGF0ZWQgdG8gdGhpcyByZXF1
ZXN0Cj4+ICsJICogaW50ZWxfY29udGV4dCBpcyByZWZlcmVuY2UgY291bnRlZCwgc28gb24gYXR0
YWNobWVudCB0byB0aGlzCj4+ICsJICogcmVxdWVzdCwgdGhlIGNvbnRleHQgc2hvdWxkIGJlIGk5
MTVfZ2VtX2NvbnRleHRfcmVmZXJlbmNlJ2QuCj4+ICsJICogV2hlbiB0aGlzIHJlcXVlc3QgaGFz
IGl0cyByZWZlcmVuY2UgY291bnQgY2xlYXJlZCwgdGhlIGNsZWFudXAKPj4gKwkgKiBjb2RlIGlu
IGk5MTVfZ2VtX3JlcXVlc3RfZnJlZSB3aWxsIGRlZmVyZW5jZSB0aGUgY29udGV4dC4KPgo+IHMv
ZGVmZXJlbmNlL3VucmVmZXJlbmNlLwo+Cj4gT3IgbWF5YmUgcmVwbGFjZSB0aGUgY29tbWVudCB3
aXRoIHRoaXMgdmVyc2lvbiwgaWYgeW91IHRoaW5rIGl0J3MgbmljZXI6Cj4KPiBDb250ZXh0IHJl
bGF0ZWQgdG8gdGhpcyByZXF1ZXN0Cj4gQ29udGV4dHMgYXJlIHJlZmNvdW50ZWQsIHNvIHdoZW4g
dGhpcyByZXF1ZXN0IGlzIGFzc29jaWF0ZWQgd2l0aCBhCj4gY29udGV4dCwgd2UgbXVzdCBpbmNy
ZW1lbnQgdGhlIGNvbnRleHQncyByZWZjb3VudCwgdG8gZ3VhcmFudGVlIHRoYXQgaXQKPiBwZXJz
aXN0cyB3aGlsZSBhbnkgcmVxdWVzdCBpcyBsaW5rZWQgdG8gaXQuIFJlcXVlc3RzIHRoZW1zZWx2
ZXMgYXJlIGFsc28KPiByZWZjb3VudGVkLCBzbyB0aGUgcmVxdWVzdCB3aWxsIG9ubHkgYmUgZnJl
ZWQgd2hlbiB0aGUgbGFzdCByZWZlcmVuY2UgdG8KPiBpdCBpcyBkaXNtaXNzZWQsIGFuZCB0aGUg
Y29kZSBpbiBpOTE1X2dlbV9yZXF1ZXN0X2ZyZWUoKSB3aWxsIHRoZW4KPiBkZWNyZW1lbnQgdGhl
IHJlZmNvdW50IG9uIHRoZSBjb250ZXh0LgoKVGhhdCdzIGEgbG90IG1vcmUgdW5kZXJzdGFuZGFi
bGUgdGhhbiBteSB2ZXJzaW9uIDopCgo+Cj4gLkRhdmUuCj4KPj4gKwkgKi8KPj4gICAJc3RydWN0
IGludGVsX2NvbnRleHQgKmN0eDsKPj4KPj4gICAJLyoqIEJhdGNoIGJ1ZmZlciByZWxhdGVkIHRv
IHRoaXMgcmVxdWVzdCBpZiBhbnkgKi8KPj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9p
OTE1L2k5MTVfZ2VtLmMgYi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dlbS5jCj4+IGluZGV4
IDYxMTM0YWIuLjk5NmY2MGYgMTAwNjQ0Cj4+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2k5
MTVfZ2VtLmMKPj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaTkxNV9nZW0uYwo+PiBAQCAt
MjY2NCw4ICsyNjY0LDcgQEAgc3RhdGljIHZvaWQgaTkxNV9nZW1fcmVzZXRfcmluZ19jbGVhbnVw
KHN0cnVjdCBkcm1faTkxNV9wcml2YXRlICpkZXZfcHJpdiwKPj4gICAJCWlmIChzdWJtaXRfcmVx
LT5jdHggIT0gcmluZy0+ZGVmYXVsdF9jb250ZXh0KQo+PiAgIAkJCWludGVsX2xyX2NvbnRleHRf
dW5waW4ocmluZywgc3VibWl0X3JlcS0+Y3R4KTsKPj4KPj4gLQkJaTkxNV9nZW1fY29udGV4dF91
bnJlZmVyZW5jZShzdWJtaXRfcmVxLT5jdHgpOwo+PiAtCQlrZnJlZShzdWJtaXRfcmVxKTsKPj4g
KwkJaTkxNV9nZW1fcmVxdWVzdF91bnJlZmVyZW5jZShzdWJtaXRfcmVxKTsKPj4gICAJfQo+Pgo+
PiAgIAkvKgo+PiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL2k5MTUvaW50ZWxfbHJjLmMg
Yi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pbnRlbF9scmMuYwo+PiBpbmRleCBhYWZjZWYzLi42MmEy
YjJhIDEwMDY0NAo+PiAtLS0gYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pbnRlbF9scmMuYwo+PiAr
KysgYi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pbnRlbF9scmMuYwo+PiBAQCAtNTEyLDE4ICs1MTIs
MTkgQEAgc3RhdGljIGludCBleGVjbGlzdHNfY29udGV4dF9xdWV1ZShzdHJ1Y3QgaW50ZWxfZW5n
aW5lX2NzICpyaW5nLAo+PiAgIAkJICogSWYgdGhlcmUgaXNuJ3QgYSByZXF1ZXN0IGFzc29jaWF0
ZWQgd2l0aCB0aGlzIHN1Ym1pc3Npb24sCj4+ICAgCQkgKiBjcmVhdGUgb25lIGFzIGEgdGVtcG9y
YXJ5IGhvbGRlci4KPj4gICAJCSAqLwo+PiAtCQlXQVJOKDEsICJleGVjbGlzdCBjb250ZXh0IHN1
Ym1pc3Npb24gd2l0aG91dCByZXF1ZXN0Iik7Cj4+ICAgCQlyZXF1ZXN0ID0ga3phbGxvYyhzaXpl
b2YoKnJlcXVlc3QpLCBHRlBfS0VSTkVMKTsKPj4gICAJCWlmIChyZXF1ZXN0ID09IE5VTEwpCj4+
ICAgCQkJcmV0dXJuIC1FTk9NRU07Cj4+ICAgCQlyZXF1ZXN0LT5yaW5nID0gcmluZzsKPj4gICAJ
CXJlcXVlc3QtPmN0eCA9IHRvOwo+PiArCQlrcmVmX2luaXQoJnJlcXVlc3QtPnJlZik7Cj4+ICsJ
CXJlcXVlc3QtPnVuaXEgPSBkZXZfcHJpdi0+cmVxdWVzdF91bmlxKys7Cj4+ICsJCWk5MTVfZ2Vt
X2NvbnRleHRfcmVmZXJlbmNlKHJlcXVlc3QtPmN0eCk7Cj4+ICAgCX0gZWxzZSB7Cj4+ICsJCWk5
MTVfZ2VtX3JlcXVlc3RfcmVmZXJlbmNlKHJlcXVlc3QpOwo+PiAgIAkJV0FSTl9PTih0byAhPSBy
ZXF1ZXN0LT5jdHgpOwo+PiAgIAl9Cj4+ICAgCXJlcXVlc3QtPnRhaWwgPSB0YWlsOwo+PiAtCWk5
MTVfZ2VtX3JlcXVlc3RfcmVmZXJlbmNlKHJlcXVlc3QpOwo+PiAtCWk5MTVfZ2VtX2NvbnRleHRf
cmVmZXJlbmNlKHJlcXVlc3QtPmN0eCk7Cj4+Cj4+ICAgCWludGVsX3J1bnRpbWVfcG1fZ2V0KGRl
dl9wcml2KTsKPj4KPj4gQEAgLTc0MCw3ICs3NDEsNiBAQCB2b2lkIGludGVsX2V4ZWNsaXN0c19y
ZXRpcmVfcmVxdWVzdHMoc3RydWN0IGludGVsX2VuZ2luZV9jcyAqcmluZykKPj4gICAJCWlmIChj
dHhfb2JqICYmIChjdHggIT0gcmluZy0+ZGVmYXVsdF9jb250ZXh0KSkKPj4gICAJCQlpbnRlbF9s
cl9jb250ZXh0X3VucGluKHJpbmcsIGN0eCk7Cj4+ICAgCQlpbnRlbF9ydW50aW1lX3BtX3B1dChk
ZXZfcHJpdik7Cj4+IC0JCWk5MTVfZ2VtX2NvbnRleHRfdW5yZWZlcmVuY2UoY3R4KTsKPj4gICAJ
CWxpc3RfZGVsKCZyZXEtPmV4ZWNsaXN0X2xpbmspOwo+PiAgIAkJaTkxNV9nZW1fcmVxdWVzdF91
bnJlZmVyZW5jZShyZXEpOwo+PiAgIAl9Cj4+Cj4KCl9fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fCkludGVsLWdmeCBtYWlsaW5nIGxpc3QKSW50ZWwtZ2Z4QGxp
c3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4v
bGlzdGluZm8vaW50ZWwtZ2Z4Cg==