From mboxrd@z Thu Jan  1 00:00:00 1970
From: Jani Nikula <jani.nikula@linux.intel.com>
Subject: Re: [PATCH] drm/i915: Fix a use after free,
	and unbalanced refcounting
Date: Tue, 24 Feb 2015 15:20:35 +0200
Message-ID: <87egpfphss.fsf@intel.com>
References: <1424363447-16296-1-git-send-email-nicholas.hoath@intel.com>
 <BFEE8FEC12424048AF1805991D65FA91197420C8@irsmsx105.ger.corp.intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Return-path: <intel-gfx-bounces@lists.freedesktop.org>
Received: from mga03.intel.com (mga03.intel.com [134.134.136.65])
 by gabe.freedesktop.org (Postfix) with ESMTP id EE74389E50
 for <intel-gfx@lists.freedesktop.org>; Tue, 24 Feb 2015 05:19:23 -0800 (PST)
In-Reply-To: <BFEE8FEC12424048AF1805991D65FA91197420C8@irsmsx105.ger.corp.intel.com>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
 <mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
 <mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Errors-To: intel-gfx-bounces@lists.freedesktop.org
Sender: "Intel-gfx" <intel-gfx-bounces@lists.freedesktop.org>
To: "Daniel, Thomas" <thomas.daniel@intel.com>, "Hoath,
 Nicholas" <nicholas.hoath@intel.com>, "intel-gfx@lists.freedesktop.org" <intel-gfx@lists.freedesktop.org>
List-Id: intel-gfx@lists.freedesktop.org

T24gTW9uLCAyMyBGZWIgMjAxNSwgIkRhbmllbCwgVGhvbWFzIiA8dGhvbWFzLmRhbmllbEBpbnRl
bC5jb20+IHdyb3RlOgo+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQo+PiBGcm9tOiBJbnRl
bC1nZnggW21haWx0bzppbnRlbC1nZngtYm91bmNlc0BsaXN0cy5mcmVlZGVza3RvcC5vcmddIE9u
IEJlaGFsZiBPZgo+PiBOaWNrIEhvYXRoCj4+IFNlbnQ6IFRodXJzZGF5LCBGZWJydWFyeSAxOSwg
MjAxNSA0OjMxIFBNCj4+IFRvOiBpbnRlbC1nZnhAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCj4+IFN1
YmplY3Q6IFtJbnRlbC1nZnhdIFtQQVRDSF0gZHJtL2k5MTU6IEZpeCBhIHVzZSBhZnRlciBmcmVl
LCBhbmQgdW5iYWxhbmNlZAo+PiByZWZjb3VudGluZwo+PiAKPj4gQnVnemlsbGE6IGh0dHBzOi8v
YnVncy5mcmVlZGVza3RvcC5vcmcvc2hvd19idWcuY2dpP2lkPTg4NjUyCj4+IAo+PiBXaGVuIGNv
bnZlcnRpbmcgZnJvbSBpbXBsaWNpdGx5IHRyYWNrZWQgZXhlY2xpc3QgcXVldWUgaXRlbXMgdG8g
cmVmIGNvdW50ZWQKPj4gcmVxdWVzdHMsIG5vdCBhbGwgZnJlZXMgb2YgcmVxdWVzdHMgd2VyZSBy
ZXBsYWNlZCB3aXRoIHVucmVmcywgYW5kIGV4dHJhbmVvdXMKPj4gcmVmcy91bnJlZnMgb2YgY29u
dGV4dHMgd2VyZSBhZGRlZC4KPj4gQ29ycmVjdCB0aGUgdW5iYWxhbmNlZCByZWZjb3VudCAmIHJl
cGxhY2UgdGhlIGZyZWVzLgo+PiBSZW1vdmUgYSBub2lzeSB3YXJuaW5nIHdoZW4gaGl0dGluZyB0
aGUgcmVxdWVzdCBjcmVhdGlvbiBwYXRoLgo+PiAKPj4gZHJtX2k5MTVfZ2VtX3JlcXVlc3QgYW5k
IGludGVsX2NvbnRleHQgYXJlIGJvdGgga3JlZiByZWZlcmVuY2UgY291bnRlZAo+PiBzdHJ1Y3R1
cmVzLiBVcG9uIGFsbG9jYXRpb24sIGRybV9pOTE1X2dlbV9yZXF1ZXN0J3MgcmVmIGNvdW50IHNo
b3VsZCBiZQo+PiBidW1wZWQgdXNpbmcga3JlZl9pbml0LiBXaGVuIGEgY29udGV4dCBpcyBhc3Np
Z25lZCB0byB0aGUgcmVxdWVzdCwKPj4gdGhlIGNvbnRleHQncyByZWZlcmVuY2UgY291bnQgc2hv
dWxkIGJlIGJ1bXBlZCB1c2luZwo+PiBpOTE1X2dlbV9jb250ZXh0X3JlZmVyZW5jZS4KPj4gaTkx
NV9nZW1fcmVxdWVzdF9yZWZlcmVuY2Ugd2lsbCByZWR1Y2UgdGhlIGNvbnRleHQgcmVmZXJlbmNl
IGNvdW50IHdoZW4KPj4gdGhlIHJlcXVlc3QgaXMgZnJlZWQuCj4+IAo+PiBQcm9ibGVtIGludHJv
ZHVjZWQgaW4KPj4gY29tbWl0IDZkM2Q4Mjc0YmM0NWRlNGJhYmI2MmQ2NDU2MmQ5MmFmOTg0ZGQy
MzgKPj4gQXV0aG9yOiAgICAgTmljayBIb2F0aCA8bmljaG9sYXMuaG9hdGhAaW50ZWwuY29tPgo+
PiBBdXRob3JEYXRlOiBUaHUgSmFuIDE1IDEzOjEwOjM5IDIwMTUgKzAwMDAKPj4gCj4+ICAgICAg
ZHJtL2k5MTU6IFN1YnN1bWUgaW50ZWxfY3R4X3N1Ym1pdF9yZXF1ZXN0IGluIHRvIGRybV9pOTE1
X2dlbV9yZXF1ZXN0Cj4+IAo+PiB2MjogQWRkZWQgY29tbWVudHMgZXhwbGFpbmluZyBob3cgdGhl
IGN0eCBwb2ludGVyIGFuZCB0aGUgcmVxdWVzdCBvYmplY3QKPj4gc2hvdWxkCj4+IGJlIHJlZi1j
b3VudGVkLiBSZW1vdmVkIG5vaXN5IHdhcm5pbmcuCj4+IAo+PiB2MzogQ2xlYW5lZCB1cCB0aGUg
bGFuZ3VhZ2UgdXNlZCBpbiB0aGUgY29tbWl0ICYgdGhlIGhlYWRlcgo+PiBkZXNjcmlwdGlvbiAo
VGhhbmtzIERhdmlkIEdvcmRvbikKPj4gCj4+IFNpZ25lZC1vZmYtYnk6IE5pY2sgSG9hdGggPG5p
Y2hvbGFzLmhvYXRoQGludGVsLmNvbT4KPj4gLS0tCj4+ICBkcml2ZXJzL2dwdS9kcm0vaTkxNS9p
OTE1X2Rydi5oICB8IDExICsrKysrKysrKystCj4+ICBkcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1
X2dlbS5jICB8ICAzICstLQo+PiAgZHJpdmVycy9ncHUvZHJtL2k5MTUvaW50ZWxfbHJjLmMgfCAg
OCArKysrLS0tLQo+PiAgNCBmaWxlcyBjaGFuZ2VkLCAxNiBpbnNlcnRpb25zKCspLCA4IGRlbGV0
aW9ucygtKQo+PiAKPj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVfZHJ2
LmggYi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2Rydi5oCj4+IGluZGV4IDJkZWRkNDMuLjk1
NmZlMjYgMTAwNjQ0Cj4+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVfZHJ2LmgKPj4g
KysrIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaTkxNV9kcnYuaAo+PiBAQCAtMjEyMSw2ICsyMTIx
LDkgQEAgdm9pZCBpOTE1X2dlbV90cmFja19mYihzdHJ1Y3QgZHJtX2k5MTVfZ2VtX29iamVjdAo+
PiAqb2xkLAo+PiAgICogbnVtYmVyIGNvbXBhcmlzb25zIG9uIGJ1ZmZlciBsYXN0X3JlYWR8d3Jp
dGVfc2Vxbm8uIEl0IGFsc28gYWxsb3dzIGFuCj4+ICAgKiBlbWlzc2lvbiB0aW1lIHRvIGJlIGFz
c29jaWF0ZWQgd2l0aCB0aGUgcmVxdWVzdCBmb3IgdHJhY2tpbmcgaG93IGZhciBhaGVhZAo+PiAg
ICogb2YgdGhlIEdQVSB0aGUgc3VibWlzc2lvbiBpcy4KPj4gKyAqCj4+ICsgKiBUaGUgcmVxdWVz
dHMgYXJlIHJlZmVyZW5jZSBjb3VudGVkLCBzbyB1cG9uIGNyZWF0aW9uIHRoZXkgc2hvdWxkIGhh
dmUgYW4KPj4gKyAqIGluaXRpYWwgcmVmZXJlbmNlIHRha2VuIHVzaW5nIGtyZWZfaW5pdAo+PiAg
ICovCj4+ICBzdHJ1Y3QgZHJtX2k5MTVfZ2VtX3JlcXVlc3Qgewo+PiAgCXN0cnVjdCBrcmVmIHJl
ZjsKPj4gQEAgLTIxNDQsNyArMjE0NywxNiBAQCBzdHJ1Y3QgZHJtX2k5MTVfZ2VtX3JlcXVlc3Qg
ewo+PiAgCS8qKiBQb3NpdGlvbiBpbiB0aGUgcmluZ2J1ZmZlciBvZiB0aGUgZW5kIG9mIHRoZSB3
aG9sZSByZXF1ZXN0ICovCj4+ICAJdTMyIHRhaWw7Cj4+IAo+PiAtCS8qKiBDb250ZXh0IHJlbGF0
ZWQgdG8gdGhpcyByZXF1ZXN0ICovCj4+ICsJLyoqCj4+ICsJICogQ29udGV4dCByZWxhdGVkIHRv
IHRoaXMgcmVxdWVzdAo+PiArCSAqIENvbnRleHRzIGFyZSByZWZjb3VudGVkLCBzbyB3aGVuIHRo
aXMgcmVxdWVzdCBpcyBhc3NvY2lhdGVkIHdpdGggYQo+PiArCSAqIGNvbnRleHQsIHdlIG11c3Qg
aW5jcmVtZW50IHRoZSBjb250ZXh0J3MgcmVmY291bnQsIHRvIGd1YXJhbnRlZSB0aGF0Cj4+ICsJ
ICogaXQgcGVyc2lzdHMgd2hpbGUgYW55IHJlcXVlc3QgaXMgbGlua2VkIHRvIGl0LiBSZXF1ZXN0
cyB0aGVtc2VsdmVzCj4+ICsJICogYXJlIGFsc28gcmVmY291bnRlZCwgc28gdGhlIHJlcXVlc3Qg
d2lsbCBvbmx5IGJlIGZyZWVkIHdoZW4gdGhlIGxhc3QKPj4gKwkgKiByZWZlcmVuY2UgdG8gaXQg
aXMgZGlzbWlzc2VkLCBhbmQgdGhlIGNvZGUgaW4KPj4gKwkgKiBpOTE1X2dlbV9yZXF1ZXN0X2Zy
ZWUoKSB3aWxsIHRoZW4gZGVjcmVtZW50IHRoZSByZWZjb3VudCBvbiB0aGUKPj4gKwkgKiBjb250
ZXh0Lgo+PiArCSAqLwo+PiAgCXN0cnVjdCBpbnRlbF9jb250ZXh0ICpjdHg7Cj4+IAo+PiAgCS8q
KiBCYXRjaCBidWZmZXIgcmVsYXRlZCB0byB0aGlzIHJlcXVlc3QgaWYgYW55ICovCj4+IGRpZmYg
LS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dlbS5jCj4+IGIvZHJpdmVycy9ncHUv
ZHJtL2k5MTUvaTkxNV9nZW0uYwo+PiBpbmRleCA2MTEzNGFiLi45OTZmNjBmIDEwMDY0NAo+PiAt
LS0gYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dlbS5jCj4+ICsrKyBiL2RyaXZlcnMvZ3B1
L2RybS9pOTE1L2k5MTVfZ2VtLmMKPj4gQEAgLTI2NjQsOCArMjY2NCw3IEBAIHN0YXRpYyB2b2lk
IGk5MTVfZ2VtX3Jlc2V0X3JpbmdfY2xlYW51cChzdHJ1Y3QKPj4gZHJtX2k5MTVfcHJpdmF0ZSAq
ZGV2X3ByaXYsCj4+ICAJCWlmIChzdWJtaXRfcmVxLT5jdHggIT0gcmluZy0+ZGVmYXVsdF9jb250
ZXh0KQo+PiAgCQkJaW50ZWxfbHJfY29udGV4dF91bnBpbihyaW5nLCBzdWJtaXRfcmVxLT5jdHgp
Owo+PiAKPj4gLQkJaTkxNV9nZW1fY29udGV4dF91bnJlZmVyZW5jZShzdWJtaXRfcmVxLT5jdHgp
Owo+PiAtCQlrZnJlZShzdWJtaXRfcmVxKTsKPj4gKwkJaTkxNV9nZW1fcmVxdWVzdF91bnJlZmVy
ZW5jZShzdWJtaXRfcmVxKTsKPj4gIAl9Cj4+IAo+PiAgCS8qCj4+IGRpZmYgLS1naXQgYS9kcml2
ZXJzL2dwdS9kcm0vaTkxNS9pbnRlbF9scmMuYyBiL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2ludGVs
X2xyYy5jCj4+IGluZGV4IGFhZmNlZjMuLjYyYTJiMmEgMTAwNjQ0Cj4+IC0tLSBhL2RyaXZlcnMv
Z3B1L2RybS9pOTE1L2ludGVsX2xyYy5jCj4+ICsrKyBiL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2lu
dGVsX2xyYy5jCj4+IEBAIC01MTIsMTggKzUxMiwxOSBAQCBzdGF0aWMgaW50IGV4ZWNsaXN0c19j
b250ZXh0X3F1ZXVlKHN0cnVjdAo+PiBpbnRlbF9lbmdpbmVfY3MgKnJpbmcsCj4+ICAJCSAqIElm
IHRoZXJlIGlzbid0IGEgcmVxdWVzdCBhc3NvY2lhdGVkIHdpdGggdGhpcyBzdWJtaXNzaW9uLAo+
PiAgCQkgKiBjcmVhdGUgb25lIGFzIGEgdGVtcG9yYXJ5IGhvbGRlci4KPj4gIAkJICovCj4+IC0J
CVdBUk4oMSwgImV4ZWNsaXN0IGNvbnRleHQgc3VibWlzc2lvbiB3aXRob3V0IHJlcXVlc3QiKTsK
Pj4gIAkJcmVxdWVzdCA9IGt6YWxsb2Moc2l6ZW9mKCpyZXF1ZXN0KSwgR0ZQX0tFUk5FTCk7Cj4+
ICAJCWlmIChyZXF1ZXN0ID09IE5VTEwpCj4+ICAJCQlyZXR1cm4gLUVOT01FTTsKPj4gIAkJcmVx
dWVzdC0+cmluZyA9IHJpbmc7Cj4+ICAJCXJlcXVlc3QtPmN0eCA9IHRvOwo+PiArCQlrcmVmX2lu
aXQoJnJlcXVlc3QtPnJlZik7Cj4+ICsJCXJlcXVlc3QtPnVuaXEgPSBkZXZfcHJpdi0+cmVxdWVz
dF91bmlxKys7Cj4+ICsJCWk5MTVfZ2VtX2NvbnRleHRfcmVmZXJlbmNlKHJlcXVlc3QtPmN0eCk7
Cj4+ICAJfSBlbHNlIHsKPj4gKwkJaTkxNV9nZW1fcmVxdWVzdF9yZWZlcmVuY2UocmVxdWVzdCk7
Cj4+ICAJCVdBUk5fT04odG8gIT0gcmVxdWVzdC0+Y3R4KTsKPj4gIAl9Cj4+ICAJcmVxdWVzdC0+
dGFpbCA9IHRhaWw7Cj4+IC0JaTkxNV9nZW1fcmVxdWVzdF9yZWZlcmVuY2UocmVxdWVzdCk7Cj4+
IC0JaTkxNV9nZW1fY29udGV4dF9yZWZlcmVuY2UocmVxdWVzdC0+Y3R4KTsKPj4gCj4+ICAJaW50
ZWxfcnVudGltZV9wbV9nZXQoZGV2X3ByaXYpOwo+PiAKPj4gQEAgLTc0MCw3ICs3NDEsNiBAQCB2
b2lkIGludGVsX2V4ZWNsaXN0c19yZXRpcmVfcmVxdWVzdHMoc3RydWN0Cj4+IGludGVsX2VuZ2lu
ZV9jcyAqcmluZykKPj4gIAkJaWYgKGN0eF9vYmogJiYgKGN0eCAhPSByaW5nLT5kZWZhdWx0X2Nv
bnRleHQpKQo+PiAgCQkJaW50ZWxfbHJfY29udGV4dF91bnBpbihyaW5nLCBjdHgpOwo+PiAgCQlp
bnRlbF9ydW50aW1lX3BtX3B1dChkZXZfcHJpdik7Cj4+IC0JCWk5MTVfZ2VtX2NvbnRleHRfdW5y
ZWZlcmVuY2UoY3R4KTsKPj4gIAkJbGlzdF9kZWwoJnJlcS0+ZXhlY2xpc3RfbGluayk7Cj4+ICAJ
CWk5MTVfZ2VtX3JlcXVlc3RfdW5yZWZlcmVuY2UocmVxKTsKPj4gIAl9Cj4+IC0tCj4+IDIuMS4x
Cj4gUmV2aWV3ZWQtYnk6IFRob21hcyBEYW5pZWwgPHRob21hcy5kYW5pZWxAaW50ZWwuY29tPgoK
UHVzaGVkIHRvIGRybS1pbnRlbC1maXhlcywgd2l0aCBhZGRpdGlvbmFsIHItYiBmcm9tIERhbmll
bCwgdGhhbmtzIGZvcgp0aGUgcGF0Y2ggYW5kIHJldmlldy4KCkJSLApKYW5pLgoKCj4KPiBfX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+IEludGVsLWdmeCBt
YWlsaW5nIGxpc3QKPiBJbnRlbC1nZnhAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCj4gaHR0cDovL2xp
c3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ludGVsLWdmeAoKLS0gCkphbmkg
TmlrdWxhLCBJbnRlbCBPcGVuIFNvdXJjZSBUZWNobm9sb2d5IENlbnRlcgpfX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpJbnRlbC1nZnggbWFpbGluZyBsaXN0
CkludGVsLWdmeEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cDovL2xpc3RzLmZyZWVkZXNrdG9w
Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ludGVsLWdmeAo=