<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_ASSIGNED " title="ASSIGNED - [all Bisected]igt/drv_module_reload causes major memory corruption and system hang" href="https://bugs.freedesktop.org/show_bug.cgi?id=88433#c7">Comment # 7</a> on <a class="bz_bug_link bz_status_ASSIGNED " title="ASSIGNED - [all Bisected]igt/drv_module_reload causes major memory corruption and system hang" href="https://bugs.freedesktop.org/show_bug.cgi?id=88433">bug 88433</a> from <a class="email" href="mailto:matthew.d.roper@intel.com" title="Matt Roper <matthew.d.roper@intel.com>"> Matt Roper</a> <pre>(In reply to Ander Conselvan de Oliveira from <a href="show_bug.cgi?id=88433#c6">comment #6</a>) > (In reply to Ander Conselvan de Oliveira from <a href="show_bug.cgi?id=88433#c5">comment #5</a>) > > (In reply to Jani Nikula from <a href="show_bug.cgi?id=88433#c4">comment #4</a>) > > > Please always assign to bisected bad commit author! I'm also CC'ing Ander > > > for being the reviewer. > > > > > > At a very quick glance, only intel_plane_duplicate_state looks suspicious. > > > Is plane->state always valid when non-NULL? > > > > > > Matt, Ander? > > > > It should, but maybe I missed something in the review. But the error > > checking in intel_plane_duplicate_state() and callers seems to be correct. > > Perhaps the bug is in the plane helpers. > > Actually the problem is somewhere with intel_plane_destroy. > intel_plane_state_destroy doesn't set the plane to NULL and then something > bad happens when drm_plane_cleanup tries to destroy it again. Yep, Ander's analysis looks correct. When I first wrote the patchset, the DRM core wasn't cleaning up plane state, so I had to call the state destruction in intel_plane_destroy() so that we wouldn't leak it on driver unload. But the core got updated to do the destruction before my patches actually landed and I didn't notice before this series got merged, so we're now doing a double kfree() (and possibly a double framebuffer unreference as well). The fix is to just not cleanup the plane state in the driver anymore since the core will handle it for us. I'll send a patch for that shortly.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> <li>You are on the CC list for the bug.</li> </ul> </body> </html>