<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEEDINFO " title="NEEDINFO - [Regression BDW] kernel panic in Intel i915 module, complete system freeze in 4.10-rc2" href="https://bugs.freedesktop.org/show_bug.cgi?id=99295#c7">Comment # 7</a> on <a class="bz_bug_link bz_status_NEEDINFO " title="NEEDINFO - [Regression BDW] kernel panic in Intel i915 module, complete system freeze in 4.10-rc2" href="https://bugs.freedesktop.org/show_bug.cgi?id=99295">bug 99295</a> from <a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> Chris Wilson</a> <pre>From <a class="bz_bug_link bz_status_NEW " title="NEW - XVMC on nv43 class card broken with recent mesa + kernel." href="show_bug.cgi?id=99584">bug 99584</a>: It looks like we are hitting a use-after-free in gen8_ppgtt_alloc_page_directories with some pdp state. One possible theory from looking at the log is that the shrinker kicks in and starts swinging its axe, evicting one or more vma's, which results in said pdp being freed, I guess we didn't have anything else inserted in that range, which is why it was freed. But all of this could have happened while we were in the middle of allocating a va range for another vma which just so happens to touch the same pdp, and so with a little bad timing the free could have happened just after we check if we need to allocate a new pdp, resulting in all kinds of brokenness. It looks like something similar could also happen with a pd.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> <li>You are on the CC list for the bug.</li> <li>You are the assignee for the bug.</li> </ul> </body> </html>