mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
a581483b1e
This fixes the following KASAN splash on module reload:
[ 145.136327] ==================================================================
[ 145.136502] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136514] Read of size 8 at addr ffff888216641830 by task kworker/1:1/134
[ 145.136535] CPU: 1 PID: 134 Comm: kworker/1:1 Tainted: G U T 5.5.0-rc7-valkyria+ #5783
[ 145.136539] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1 07/27/2016
[ 145.136546] Workqueue: events drm_connector_free_work_fn
[ 145.136551] Call Trace:
[ 145.136560] dump_stack+0xa1/0xe0
[ 145.136571] print_address_description.constprop.0+0x1e/0x210
[ 145.136639] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136703] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136710] __kasan_report.cold+0x1b/0x37
[ 145.136790] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136863] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136870] kasan_report+0x27/0x30
[ 145.136881] __asan_report_load8_noabort+0x1c/0x20
[ 145.136946] intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136954] drm_connector_free_work_fn+0xd1/0x100
[ 145.136967] process_one_work+0x86e/0x1610
[ 145.136987] ? pwq_dec_nr_in_flight+0x2f0/0x2f0
[ 145.137004] ? move_linked_works+0x128/0x2c0
[ 145.137021] worker_thread+0x63e/0xc90
[ 145.137048] kthread+0x2f6/0x3f0
[ 145.137054] ? calculate_sigpending+0x81/0xa0
[ 145.137059] ? process_one_work+0x1610/0x1610
[ 145.137064] ? kthread_bind+0x40/0x40
[ 145.137075] ret_from_fork+0x24/0x30
[ 145.137111] Allocated by task 0:
[ 145.137119] (stack is not available)
[ 145.137137] Freed by task 5053:
[ 145.137147] save_stack+0x28/0x90
[ 145.137152] __kasan_slab_free+0x136/0x180
[ 145.137157] kasan_slab_free+0x26/0x30
[ 145.137161] kfree+0xe6/0x350
[ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915]
[ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0
[ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915]
[ 145.137403] i915_driver_remove+0xc4/0x130 [i915]
[ 145.137482] i915_pci_remove+0x3e/0x90 [i915]
[ 145.137489] pci_device_remove+0x108/0x2d0
[ 145.137494] device_release_driver_internal+0x1e6/0x4a0
[ 145.137499] driver_detach+0xcb/0x198
[ 145.137503] bus_remove_driver+0xde/0x204
[ 145.137508] driver_unregister+0x6d/0xa0
[ 145.137513] pci_unregister_driver+0x2e/0x230
[ 145.137576] i915_exit+0x1f/0x26 [i915]
[ 145.137157] kasan_slab_free+0x26/0x30
[ 145.137161] kfree+0xe6/0x350
[ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915]
[ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0
[ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915]
[ 145.137403] i915_driver_remove+0xc4/0x130 [i915]
[ 145.137482] i915_pci_remove+0x3e/0x90 [i915]
[ 145.137489] pci_device_remove+0x108/0x2d0
[ 145.137494] device_release_driver_internal+0x1e6/0x4a0
[ 145.137499] driver_detach+0xcb/0x198
[ 145.137503] bus_remove_driver+0xde/0x204
[ 145.137508] driver_unregister+0x6d/0xa0
[ 145.137513] pci_unregister_driver+0x2e/0x230
[ 145.137576] i915_exit+0x1f/0x26 [i915]
[ 145.137581] __x64_sys_delete_module+0x35b/0x470
[ 145.137586] do_syscall_64+0x99/0x4e0
[ 145.137591] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 145.137606] The buggy address belongs to the object at ffff888216640000
which belongs to the cache kmalloc-8k of size 8192
[ 145.137618] The buggy address is located 6192 bytes inside of
8192-byte region [ffff888216640000, ffff888216642000)
[ 145.137630] The buggy address belongs to the page:
[ 145.137640] page:ffffea0008599000 refcount:1 mapcount:0 mapping:ffff888107c02a80 index:0xffff888216644000 compound_mapcount: 0
[ 145.137647] raw: 0200000000010200 0000000000000000 0000000100000001 ffff888107c02a80
[ 145.137652] raw: ffff888216644000 0000000080020001 00000001ffffffff 0000000000000000
[ 145.137656] page dumped because: kasan: bad access detected
[ 145.137668] Memory state around the buggy address:
[ 145.137678] ffff888216641700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137687] ffff888216641780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137697] >ffff888216641800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137706] ^
[ 145.137715] ffff888216641880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137724] ffff888216641900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 145.137733] ==================================================================
[ 145.137742] Disabling lock debugging due to kernel taint
Changes since v1:
- Add fixes tags.
- Use early unregister.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| display | ||
| gem | ||
| gt | ||
| gvt | ||
| selftests | ||
| .gitignore | ||
| i915_active.c | ||
| i915_active.h | ||
| i915_active_types.h | ||
| i915_buddy.c | ||
| i915_buddy.h | ||
| i915_cmd_parser.c | ||
| i915_config.c | ||
| i915_debugfs.c | ||
| i915_debugfs.h | ||
| i915_debugfs_params.c | ||
| i915_debugfs_params.h | ||
| i915_drv.c | ||
| i915_drv.h | ||
| i915_fixed.h | ||
| i915_gem.c | ||
| i915_gem.h | ||
| i915_gem_evict.c | ||
| i915_gem_gtt.c | ||
| i915_gem_gtt.h | ||
| i915_getparam.c | ||
| i915_globals.c | ||
| i915_globals.h | ||
| i915_gpu_error.c | ||
| i915_gpu_error.h | ||
| i915_ioc32.c | ||
| i915_ioc32.h | ||
| i915_irq.c | ||
| i915_irq.h | ||
| i915_memcpy.c | ||
| i915_memcpy.h | ||
| i915_mm.c | ||
| i915_params.c | ||
| i915_params.h | ||
| i915_pci.c | ||
| i915_perf.c | ||
| i915_perf.h | ||
| i915_perf_types.h | ||
| i915_pmu.c | ||
| i915_pmu.h | ||
| i915_priolist_types.h | ||
| i915_pvinfo.h | ||
| i915_query.c | ||
| i915_query.h | ||
| i915_reg.h | ||
| i915_request.c | ||
| i915_request.h | ||
| i915_scatterlist.c | ||
| i915_scatterlist.h | ||
| i915_scheduler.c | ||
| i915_scheduler.h | ||
| i915_scheduler_types.h | ||
| i915_selftest.h | ||
| i915_suspend.c | ||
| i915_suspend.h | ||
| i915_sw_fence.c | ||
| i915_sw_fence.h | ||
| i915_sw_fence_work.c | ||
| i915_sw_fence_work.h | ||
| i915_switcheroo.c | ||
| i915_switcheroo.h | ||
| i915_syncmap.c | ||
| i915_syncmap.h | ||
| i915_sysfs.c | ||
| i915_sysfs.h | ||
| i915_trace.h | ||
| i915_trace_points.c | ||
| i915_user_extensions.c | ||
| i915_user_extensions.h | ||
| i915_utils.c | ||
| i915_utils.h | ||
| i915_vgpu.c | ||
| i915_vgpu.h | ||
| i915_vma.c | ||
| i915_vma.h | ||
| i915_vma_types.h | ||
| intel_device_info.c | ||
| intel_device_info.h | ||
| intel_dram.c | ||
| intel_dram.h | ||
| intel_gvt.c | ||
| intel_gvt.h | ||
| intel_memory_region.c | ||
| intel_memory_region.h | ||
| intel_pch.c | ||
| intel_pch.h | ||
| intel_pm.c | ||
| intel_pm.h | ||
| intel_region_lmem.c | ||
| intel_region_lmem.h | ||
| intel_runtime_pm.c | ||
| intel_runtime_pm.h | ||
| intel_sideband.c | ||
| intel_sideband.h | ||
| intel_uncore.c | ||
| intel_uncore.h | ||
| intel_wakeref.c | ||
| intel_wakeref.h | ||
| intel_wopcm.c | ||
| intel_wopcm.h | ||
| Kconfig | ||
| Kconfig.debug | ||
| Kconfig.profile | ||
| Kconfig.unstable | ||
| Makefile | ||
| vlv_suspend.c | ||
| vlv_suspend.h | ||