From mboxrd@z Thu Jan  1 00:00:00 1970
From: Jani Nikula <jani.nikula@linux.intel.com>
Subject: Re: [PATCH] drm/i915: Fix a use after free,
	and unbalanced refcounting
Date: Fri, 27 Feb 2015 09:31:47 +0200
Message-ID: <87y4njajz0.fsf@intel.com>
References: <1424363447-16296-1-git-send-email-nicholas.hoath@intel.com>
 <BFEE8FEC12424048AF1805991D65FA91197420C8@irsmsx105.ger.corp.intel.com>
 <87egpfphss.fsf@intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Return-path: <intel-gfx-bounces@lists.freedesktop.org>
Received: from mga02.intel.com (mga02.intel.com [134.134.136.20])
 by gabe.freedesktop.org (Postfix) with ESMTP id E7ADB6E891
 for <intel-gfx@lists.freedesktop.org>; Thu, 26 Feb 2015 23:32:42 -0800 (PST)
In-Reply-To: <87egpfphss.fsf@intel.com>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
 <mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
 <mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Errors-To: intel-gfx-bounces@lists.freedesktop.org
Sender: "Intel-gfx" <intel-gfx-bounces@lists.freedesktop.org>
To: "Daniel, Thomas" <thomas.daniel@intel.com>, "Hoath,
 Nicholas" <nicholas.hoath@intel.com>, "intel-gfx@lists.freedesktop.org" <intel-gfx@lists.freedesktop.org>
List-Id: intel-gfx@lists.freedesktop.org

T24gVHVlLCAyNCBGZWIgMjAxNSwgSmFuaSBOaWt1bGEgPGphbmkubmlrdWxhQGxpbnV4LmludGVs
LmNvbT4gd3JvdGU6Cj4gT24gTW9uLCAyMyBGZWIgMjAxNSwgIkRhbmllbCwgVGhvbWFzIiA8dGhv
bWFzLmRhbmllbEBpbnRlbC5jb20+IHdyb3RlOgo+Pj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0t
LS0KPj4+IEZyb206IEludGVsLWdmeCBbbWFpbHRvOmludGVsLWdmeC1ib3VuY2VzQGxpc3RzLmZy
ZWVkZXNrdG9wLm9yZ10gT24gQmVoYWxmIE9mCj4+PiBOaWNrIEhvYXRoCj4+PiBTZW50OiBUaHVy
c2RheSwgRmVicnVhcnkgMTksIDIwMTUgNDozMSBQTQo+Pj4gVG86IGludGVsLWdmeEBsaXN0cy5m
cmVlZGVza3RvcC5vcmcKPj4+IFN1YmplY3Q6IFtJbnRlbC1nZnhdIFtQQVRDSF0gZHJtL2k5MTU6
IEZpeCBhIHVzZSBhZnRlciBmcmVlLCBhbmQgdW5iYWxhbmNlZAo+Pj4gcmVmY291bnRpbmcKPj4+
IAo+Pj4gQnVnemlsbGE6IGh0dHBzOi8vYnVncy5mcmVlZGVza3RvcC5vcmcvc2hvd19idWcuY2dp
P2lkPTg4NjUyCj4+PiAKPj4+IFdoZW4gY29udmVydGluZyBmcm9tIGltcGxpY2l0bHkgdHJhY2tl
ZCBleGVjbGlzdCBxdWV1ZSBpdGVtcyB0byByZWYgY291bnRlZAo+Pj4gcmVxdWVzdHMsIG5vdCBh
bGwgZnJlZXMgb2YgcmVxdWVzdHMgd2VyZSByZXBsYWNlZCB3aXRoIHVucmVmcywgYW5kIGV4dHJh
bmVvdXMKPj4+IHJlZnMvdW5yZWZzIG9mIGNvbnRleHRzIHdlcmUgYWRkZWQuCj4+PiBDb3JyZWN0
IHRoZSB1bmJhbGFuY2VkIHJlZmNvdW50ICYgcmVwbGFjZSB0aGUgZnJlZXMuCj4+PiBSZW1vdmUg
YSBub2lzeSB3YXJuaW5nIHdoZW4gaGl0dGluZyB0aGUgcmVxdWVzdCBjcmVhdGlvbiBwYXRoLgo+
Pj4gCj4+PiBkcm1faTkxNV9nZW1fcmVxdWVzdCBhbmQgaW50ZWxfY29udGV4dCBhcmUgYm90aCBr
cmVmIHJlZmVyZW5jZSBjb3VudGVkCj4+PiBzdHJ1Y3R1cmVzLiBVcG9uIGFsbG9jYXRpb24sIGRy
bV9pOTE1X2dlbV9yZXF1ZXN0J3MgcmVmIGNvdW50IHNob3VsZCBiZQo+Pj4gYnVtcGVkIHVzaW5n
IGtyZWZfaW5pdC4gV2hlbiBhIGNvbnRleHQgaXMgYXNzaWduZWQgdG8gdGhlIHJlcXVlc3QsCj4+
PiB0aGUgY29udGV4dCdzIHJlZmVyZW5jZSBjb3VudCBzaG91bGQgYmUgYnVtcGVkIHVzaW5nCj4+
PiBpOTE1X2dlbV9jb250ZXh0X3JlZmVyZW5jZS4KPj4+IGk5MTVfZ2VtX3JlcXVlc3RfcmVmZXJl
bmNlIHdpbGwgcmVkdWNlIHRoZSBjb250ZXh0IHJlZmVyZW5jZSBjb3VudCB3aGVuCj4+PiB0aGUg
cmVxdWVzdCBpcyBmcmVlZC4KPj4+IAo+Pj4gUHJvYmxlbSBpbnRyb2R1Y2VkIGluCj4+PiBjb21t
aXQgNmQzZDgyNzRiYzQ1ZGU0YmFiYjYyZDY0NTYyZDkyYWY5ODRkZDIzOAo+Pj4gQXV0aG9yOiAg
ICAgTmljayBIb2F0aCA8bmljaG9sYXMuaG9hdGhAaW50ZWwuY29tPgo+Pj4gQXV0aG9yRGF0ZTog
VGh1IEphbiAxNSAxMzoxMDozOSAyMDE1ICswMDAwCj4+PiAKPj4+ICAgICAgZHJtL2k5MTU6IFN1
YnN1bWUgaW50ZWxfY3R4X3N1Ym1pdF9yZXF1ZXN0IGluIHRvIGRybV9pOTE1X2dlbV9yZXF1ZXN0
Cj4+PiAKPj4+IHYyOiBBZGRlZCBjb21tZW50cyBleHBsYWluaW5nIGhvdyB0aGUgY3R4IHBvaW50
ZXIgYW5kIHRoZSByZXF1ZXN0IG9iamVjdAo+Pj4gc2hvdWxkCj4+PiBiZSByZWYtY291bnRlZC4g
UmVtb3ZlZCBub2lzeSB3YXJuaW5nLgo+Pj4gCj4+PiB2MzogQ2xlYW5lZCB1cCB0aGUgbGFuZ3Vh
Z2UgdXNlZCBpbiB0aGUgY29tbWl0ICYgdGhlIGhlYWRlcgo+Pj4gZGVzY3JpcHRpb24gKFRoYW5r
cyBEYXZpZCBHb3Jkb24pCj4+PiAKPj4+IFNpZ25lZC1vZmYtYnk6IE5pY2sgSG9hdGggPG5pY2hv
bGFzLmhvYXRoQGludGVsLmNvbT4KPj4+IC0tLQo+Pj4gIGRyaXZlcnMvZ3B1L2RybS9pOTE1L2k5
MTVfZHJ2LmggIHwgMTEgKysrKysrKysrKy0KPj4+ICBkcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1
X2dlbS5jICB8ICAzICstLQo+Pj4gIGRyaXZlcnMvZ3B1L2RybS9pOTE1L2ludGVsX2xyYy5jIHwg
IDggKysrKy0tLS0KPj4+ICA0IGZpbGVzIGNoYW5nZWQsIDE2IGluc2VydGlvbnMoKyksIDggZGVs
ZXRpb25zKC0pCj4+PiAKPj4+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1
X2Rydi5oIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaTkxNV9kcnYuaAo+Pj4gaW5kZXggMmRlZGQ0
My4uOTU2ZmUyNiAxMDA2NDQKPj4+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVfZHJ2
LmgKPj4+ICsrKyBiL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2k5MTVfZHJ2LmgKPj4+IEBAIC0yMTIx
LDYgKzIxMjEsOSBAQCB2b2lkIGk5MTVfZ2VtX3RyYWNrX2ZiKHN0cnVjdCBkcm1faTkxNV9nZW1f
b2JqZWN0Cj4+PiAqb2xkLAo+Pj4gICAqIG51bWJlciBjb21wYXJpc29ucyBvbiBidWZmZXIgbGFz
dF9yZWFkfHdyaXRlX3NlcW5vLiBJdCBhbHNvIGFsbG93cyBhbgo+Pj4gICAqIGVtaXNzaW9uIHRp
bWUgdG8gYmUgYXNzb2NpYXRlZCB3aXRoIHRoZSByZXF1ZXN0IGZvciB0cmFja2luZyBob3cgZmFy
IGFoZWFkCj4+PiAgICogb2YgdGhlIEdQVSB0aGUgc3VibWlzc2lvbiBpcy4KPj4+ICsgKgo+Pj4g
KyAqIFRoZSByZXF1ZXN0cyBhcmUgcmVmZXJlbmNlIGNvdW50ZWQsIHNvIHVwb24gY3JlYXRpb24g
dGhleSBzaG91bGQgaGF2ZSBhbgo+Pj4gKyAqIGluaXRpYWwgcmVmZXJlbmNlIHRha2VuIHVzaW5n
IGtyZWZfaW5pdAo+Pj4gICAqLwo+Pj4gIHN0cnVjdCBkcm1faTkxNV9nZW1fcmVxdWVzdCB7Cj4+
PiAgCXN0cnVjdCBrcmVmIHJlZjsKPj4+IEBAIC0yMTQ0LDcgKzIxNDcsMTYgQEAgc3RydWN0IGRy
bV9pOTE1X2dlbV9yZXF1ZXN0IHsKPj4+ICAJLyoqIFBvc2l0aW9uIGluIHRoZSByaW5nYnVmZmVy
IG9mIHRoZSBlbmQgb2YgdGhlIHdob2xlIHJlcXVlc3QgKi8KPj4+ICAJdTMyIHRhaWw7Cj4+PiAK
Pj4+IC0JLyoqIENvbnRleHQgcmVsYXRlZCB0byB0aGlzIHJlcXVlc3QgKi8KPj4+ICsJLyoqCj4+
PiArCSAqIENvbnRleHQgcmVsYXRlZCB0byB0aGlzIHJlcXVlc3QKPj4+ICsJICogQ29udGV4dHMg
YXJlIHJlZmNvdW50ZWQsIHNvIHdoZW4gdGhpcyByZXF1ZXN0IGlzIGFzc29jaWF0ZWQgd2l0aCBh
Cj4+PiArCSAqIGNvbnRleHQsIHdlIG11c3QgaW5jcmVtZW50IHRoZSBjb250ZXh0J3MgcmVmY291
bnQsIHRvIGd1YXJhbnRlZSB0aGF0Cj4+PiArCSAqIGl0IHBlcnNpc3RzIHdoaWxlIGFueSByZXF1
ZXN0IGlzIGxpbmtlZCB0byBpdC4gUmVxdWVzdHMgdGhlbXNlbHZlcwo+Pj4gKwkgKiBhcmUgYWxz
byByZWZjb3VudGVkLCBzbyB0aGUgcmVxdWVzdCB3aWxsIG9ubHkgYmUgZnJlZWQgd2hlbiB0aGUg
bGFzdAo+Pj4gKwkgKiByZWZlcmVuY2UgdG8gaXQgaXMgZGlzbWlzc2VkLCBhbmQgdGhlIGNvZGUg
aW4KPj4+ICsJICogaTkxNV9nZW1fcmVxdWVzdF9mcmVlKCkgd2lsbCB0aGVuIGRlY3JlbWVudCB0
aGUgcmVmY291bnQgb24gdGhlCj4+PiArCSAqIGNvbnRleHQuCj4+PiArCSAqLwo+Pj4gIAlzdHJ1
Y3QgaW50ZWxfY29udGV4dCAqY3R4Owo+Pj4gCj4+PiAgCS8qKiBCYXRjaCBidWZmZXIgcmVsYXRl
ZCB0byB0aGlzIHJlcXVlc3QgaWYgYW55ICovCj4+PiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUv
ZHJtL2k5MTUvaTkxNV9nZW0uYwo+Pj4gYi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pOTE1X2dlbS5j
Cj4+PiBpbmRleCA2MTEzNGFiLi45OTZmNjBmIDEwMDY0NAo+Pj4gLS0tIGEvZHJpdmVycy9ncHUv
ZHJtL2k5MTUvaTkxNV9nZW0uYwo+Pj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaTkxNV9n
ZW0uYwo+Pj4gQEAgLTI2NjQsOCArMjY2NCw3IEBAIHN0YXRpYyB2b2lkIGk5MTVfZ2VtX3Jlc2V0
X3JpbmdfY2xlYW51cChzdHJ1Y3QKPj4+IGRybV9pOTE1X3ByaXZhdGUgKmRldl9wcml2LAo+Pj4g
IAkJaWYgKHN1Ym1pdF9yZXEtPmN0eCAhPSByaW5nLT5kZWZhdWx0X2NvbnRleHQpCj4+PiAgCQkJ
aW50ZWxfbHJfY29udGV4dF91bnBpbihyaW5nLCBzdWJtaXRfcmVxLT5jdHgpOwo+Pj4gCj4+PiAt
CQlpOTE1X2dlbV9jb250ZXh0X3VucmVmZXJlbmNlKHN1Ym1pdF9yZXEtPmN0eCk7Cj4+PiAtCQlr
ZnJlZShzdWJtaXRfcmVxKTsKPj4+ICsJCWk5MTVfZ2VtX3JlcXVlc3RfdW5yZWZlcmVuY2Uoc3Vi
bWl0X3JlcSk7Cj4+PiAgCX0KPj4+IAo+Pj4gIAkvKgo+Pj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMv
Z3B1L2RybS9pOTE1L2ludGVsX2xyYy5jIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaW50ZWxfbHJj
LmMKPj4+IGluZGV4IGFhZmNlZjMuLjYyYTJiMmEgMTAwNjQ0Cj4+PiAtLS0gYS9kcml2ZXJzL2dw
dS9kcm0vaTkxNS9pbnRlbF9scmMuYwo+Pj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUvaW50
ZWxfbHJjLmMKPj4+IEBAIC01MTIsMTggKzUxMiwxOSBAQCBzdGF0aWMgaW50IGV4ZWNsaXN0c19j
b250ZXh0X3F1ZXVlKHN0cnVjdAo+Pj4gaW50ZWxfZW5naW5lX2NzICpyaW5nLAo+Pj4gIAkJICog
SWYgdGhlcmUgaXNuJ3QgYSByZXF1ZXN0IGFzc29jaWF0ZWQgd2l0aCB0aGlzIHN1Ym1pc3Npb24s
Cj4+PiAgCQkgKiBjcmVhdGUgb25lIGFzIGEgdGVtcG9yYXJ5IGhvbGRlci4KPj4+ICAJCSAqLwo+
Pj4gLQkJV0FSTigxLCAiZXhlY2xpc3QgY29udGV4dCBzdWJtaXNzaW9uIHdpdGhvdXQgcmVxdWVz
dCIpOwo+Pj4gIAkJcmVxdWVzdCA9IGt6YWxsb2Moc2l6ZW9mKCpyZXF1ZXN0KSwgR0ZQX0tFUk5F
TCk7Cj4+PiAgCQlpZiAocmVxdWVzdCA9PSBOVUxMKQo+Pj4gIAkJCXJldHVybiAtRU5PTUVNOwo+
Pj4gIAkJcmVxdWVzdC0+cmluZyA9IHJpbmc7Cj4+PiAgCQlyZXF1ZXN0LT5jdHggPSB0bzsKPj4+
ICsJCWtyZWZfaW5pdCgmcmVxdWVzdC0+cmVmKTsKPj4+ICsJCXJlcXVlc3QtPnVuaXEgPSBkZXZf
cHJpdi0+cmVxdWVzdF91bmlxKys7Cj4+PiArCQlpOTE1X2dlbV9jb250ZXh0X3JlZmVyZW5jZShy
ZXF1ZXN0LT5jdHgpOwo+Pj4gIAl9IGVsc2Ugewo+Pj4gKwkJaTkxNV9nZW1fcmVxdWVzdF9yZWZl
cmVuY2UocmVxdWVzdCk7Cj4+PiAgCQlXQVJOX09OKHRvICE9IHJlcXVlc3QtPmN0eCk7Cj4+PiAg
CX0KPj4+ICAJcmVxdWVzdC0+dGFpbCA9IHRhaWw7Cj4+PiAtCWk5MTVfZ2VtX3JlcXVlc3RfcmVm
ZXJlbmNlKHJlcXVlc3QpOwo+Pj4gLQlpOTE1X2dlbV9jb250ZXh0X3JlZmVyZW5jZShyZXF1ZXN0
LT5jdHgpOwo+Pj4gCj4+PiAgCWludGVsX3J1bnRpbWVfcG1fZ2V0KGRldl9wcml2KTsKPj4+IAo+
Pj4gQEAgLTc0MCw3ICs3NDEsNiBAQCB2b2lkIGludGVsX2V4ZWNsaXN0c19yZXRpcmVfcmVxdWVz
dHMoc3RydWN0Cj4+PiBpbnRlbF9lbmdpbmVfY3MgKnJpbmcpCj4+PiAgCQlpZiAoY3R4X29iaiAm
JiAoY3R4ICE9IHJpbmctPmRlZmF1bHRfY29udGV4dCkpCj4+PiAgCQkJaW50ZWxfbHJfY29udGV4
dF91bnBpbihyaW5nLCBjdHgpOwo+Pj4gIAkJaW50ZWxfcnVudGltZV9wbV9wdXQoZGV2X3ByaXYp
Owo+Pj4gLQkJaTkxNV9nZW1fY29udGV4dF91bnJlZmVyZW5jZShjdHgpOwo+Pj4gIAkJbGlzdF9k
ZWwoJnJlcS0+ZXhlY2xpc3RfbGluayk7Cj4+PiAgCQlpOTE1X2dlbV9yZXF1ZXN0X3VucmVmZXJl
bmNlKHJlcSk7Cj4+PiAgCX0KPj4+IC0tCj4+PiAyLjEuMQo+PiBSZXZpZXdlZC1ieTogVGhvbWFz
IERhbmllbCA8dGhvbWFzLmRhbmllbEBpbnRlbC5jb20+Cj4KPiBQdXNoZWQgdG8gZHJtLWludGVs
LWZpeGVzLCB3aXRoIGFkZGl0aW9uYWwgci1iIGZyb20gRGFuaWVsLCB0aGFua3MgZm9yCj4gdGhl
IHBhdGNoIGFuZCByZXZpZXcuCgpCYWgsIFFBIGp1c3QgcmVvcGVuZWQgdGhlIGJ1Zy4gTmljaywg
cGxlYXNlIGxvb2sgaW50byBpdC4KCmh0dHBzOi8vYnVncy5mcmVlZGVza3RvcC5vcmcvc2hvd19i
dWcuY2dpP2lkPTg4NjUyCgpCUiwKSmFuaS4KCgoKPgo+IEJSLAo+IEphbmkuCj4KPgo+Pgo+PiBf
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+PiBJbnRlbC1n
ZnggbWFpbGluZyBsaXN0Cj4+IEludGVsLWdmeEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKPj4gaHR0
cDovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ludGVsLWdmeAo+Cj4g
LS0gCj4gSmFuaSBOaWt1bGEsIEludGVsIE9wZW4gU291cmNlIFRlY2hub2xvZ3kgQ2VudGVyCgot
LSAKSmFuaSBOaWt1bGEsIEludGVsIE9wZW4gU291cmNlIFRlY2hub2xvZ3kgQ2VudGVyCl9fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkludGVsLWdmeCBtYWls
aW5nIGxpc3QKSW50ZWwtZ2Z4QGxpc3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwOi8vbGlzdHMuZnJl
ZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vaW50ZWwtZ2Z4Cg==