[Bug 106084] [CI] igt at .* - BUG kmalloc-2048 (Tainted: G U W ): Poison overwritten

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=106084

--- Comment #7 from Martin Peres <martin.peres at free.fr> ---
(In reply to Guenter Roeck from comment #5)
> Same problem seen with v4.17-rc2 when inserting a USB Type-C dongle.
> 
> [...]
> 
> (gdb) l *xhci_free_virt_device+0x33b
> 0xffffffff8191b855 is in xhci_free_virt_device
> (/mnt/host/source/src/third_party/kernel/v4.14/drivers/usb/host/xhci-mem.c:
> 916).
> 911		if (dev->in_ctx)
> 912			xhci_free_container_ctx(xhci, dev->in_ctx);
> 913		if (dev->out_ctx)
> 914			xhci_free_container_ctx(xhci, dev->out_ctx);
> 915	
> 916		if (dev->udev && dev->udev->slot_id)
> 917			dev->udev->slot_id = 0;
> 918		kfree(xhci->devs[slot_id]);
> 919		xhci->devs[slot_id] = NULL;
> 920	}
> 
> 
> It appears that dev->udev has been freed.

Thanks for your analysis!

> 
> Wonder why this is filed against drm ?

It is filed against DRM because it has been caught by Intel GFX CI, and I am
crawling under the failures found in there, so I first file them on DRM before
to give a chance to DRM devs to check out the bugs, and report them to the
right people. If they don't, then I do it when the storm passes and I get to
pick up some bugs and drive them to fixes.

FYI, here are all the bugs tracked by our CI system:
https://intel-gfx-ci.01.org/cibuglog/

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are on the CC list for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20180425/71b9feea/attachment-0001.html>