2019-02-23 01:11:55

by Randy Dunlap

[permalink] [raw]
Subject: BUG: KASAN: use-after-free in intel_hdmi_destroy+0x79/0x80


This is 5.0-rc7 on an old Toshiba Portege laptop.
No hdmi or other external video.

Linux dragon.dunlab 5.0.0-rc7mod #3 SMP PREEMPT Wed Feb 20 00:05:17 PST 2019 x86_64 x86_64 x86_64 GNU/Linux

on openSUSE LEAP 15.0 distro.

Full boot log is attached.

--
~Randy


Attachments:
500rc7001.log (249.05 kB)

2019-02-25 13:40:56

by Jani Nikula

[permalink] [raw]
Subject: Re: [Intel-gfx] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x79/0x80

On Fri, 22 Feb 2019, Randy Dunlap <[email protected]> wrote:
> This is 5.0-rc7 on an old Toshiba Portege laptop.
> No hdmi or other external video.
>
> Linux dragon.dunlab 5.0.0-rc7mod #3 SMP PREEMPT Wed Feb 20 00:05:17 PST 2019 x86_64 x86_64 x86_64 GNU/Linux
>
> on openSUSE LEAP 15.0 distro.
>
> Full boot log is attached.

On a hunch, caused by 9c229127aee2 ("drm/i915: hdmi: add CEC notifier to
intel_hdmi") referencing the encoder in connector destroy hook. We
should probably move the cec_notifier_put() call in the encoder destroy
hook.

BR,
Jani.




--
Jani Nikula, Intel Open Source Graphics Center

2019-02-25 14:43:53

by Hans Verkuil

[permalink] [raw]
Subject: Re: [Intel-gfx] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x79/0x80

Hi Jani,

On 2/25/19 2:40 PM, Jani Nikula wrote:
> On Fri, 22 Feb 2019, Randy Dunlap <[email protected]> wrote:
>> This is 5.0-rc7 on an old Toshiba Portege laptop.
>> No hdmi or other external video.
>>
>> Linux dragon.dunlab 5.0.0-rc7mod #3 SMP PREEMPT Wed Feb 20 00:05:17 PST 2019 x86_64 x86_64 x86_64 GNU/Linux
>>
>> on openSUSE LEAP 15.0 distro.
>>
>> Full boot log is attached.
>
> On a hunch, caused by 9c229127aee2 ("drm/i915: hdmi: add CEC notifier to
> intel_hdmi") referencing the encoder in connector destroy hook. We
> should probably move the cec_notifier_put() call in the encoder destroy
> hook.

So the intel_encoder_destroy function is/can be called before the
intel_hdmi_destroy function? Sounds odd. I would expect that the
connectors are destroyed before the encoders.

In any case, I am happy to try it in another destroy hook, but I need
advice which hook I should use and how I get to the cec_notifier from
whatever structure pointer I have in that destroy hook.

I tried to figure it out, but I became very confused :-)

Regards,

Hans

2019-02-25 14:56:49

by Jani Nikula

[permalink] [raw]
Subject: Re: [Intel-gfx] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x79/0x80

On Mon, 25 Feb 2019, Hans Verkuil <[email protected]> wrote:
> Hi Jani,
>
> On 2/25/19 2:40 PM, Jani Nikula wrote:
>> On Fri, 22 Feb 2019, Randy Dunlap <[email protected]> wrote:
>>> This is 5.0-rc7 on an old Toshiba Portege laptop.
>>> No hdmi or other external video.
>>>
>>> Linux dragon.dunlab 5.0.0-rc7mod #3 SMP PREEMPT Wed Feb 20 00:05:17 PST 2019 x86_64 x86_64 x86_64 GNU/Linux
>>>
>>> on openSUSE LEAP 15.0 distro.
>>>
>>> Full boot log is attached.
>>
>> On a hunch, caused by 9c229127aee2 ("drm/i915: hdmi: add CEC notifier to
>> intel_hdmi") referencing the encoder in connector destroy hook. We
>> should probably move the cec_notifier_put() call in the encoder destroy
>> hook.
>
> So the intel_encoder_destroy function is/can be called before the
> intel_hdmi_destroy function? Sounds odd. I would expect that the
> connectors are destroyed before the encoders.
>
> In any case, I am happy to try it in another destroy hook, but I need
> advice which hook I should use and how I get to the cec_notifier from
> whatever structure pointer I have in that destroy hook.
>
> I tried to figure it out, but I became very confused :-)

It's... hairy.

Looks like in this case the destroy hook gets called via
drm_connector_free_work_fn() and __drm_connector_put_safe() the
documentation of which says, "Should only be used from the
connector_iter functions, where we never really expect to actually
release the connector when dropping our final reference."

Can and does happen anyway it seems. :/

BR,
Jani.

--
Jani Nikula, Intel Open Source Graphics Center