<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [BAT][SKL][GVT-d] igt@drv_module_reload@basic-reload-inject produces a general protection fault"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101791#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [BAT][SKL][GVT-d] igt@drv_module_reload@basic-reload-inject produces a general protection fault"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101791">bug 101791</a>
from <span class="vcard"><a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> <span class="fn">Chris Wilson</span></a>
</span></b>
<pre>It's a use after free (kasan where are you!) in the async fbdev paths.
CI_DRM_2726 was:
mmit 346fb4e0b9660e2fe888f870608d287e1980f665
Author: Daniel Vetter <<a href="mailto:daniel.vetter@ffwll.ch">daniel.vetter@ffwll.ch</a>>
Date: Thu Jul 6 15:00:20 2017 +0200
drm/i915: Protect against deferred fbdev setup
We could probably hit this already with our current async fbdev init,
but it's much easier to hit this with the new deferred fbdev setup
that I'm working on polishing.
Cc: Maarten Lankhorst <<a href="mailto:maarten.lankhorst@linux.intel.com">maarten.lankhorst@linux.intel.com</a>>
Reported-by: Maarten Lankhorst <<a href="mailto:maarten.lankhorst@linux.intel.com">maarten.lankhorst@linux.intel.com</a>>
Reviewed-by: Maarten Lankhorst <<a href="mailto:maarten.lankhorst@linux.intel.com">maarten.lankhorst@linux.intel.com</a>>
Signed-off-by: Daniel Vetter <<a href="mailto:daniel.vetter@intel.com">daniel.vetter@intel.com</a>>
Link:
<a href="http://patchwork.freedesktop.org/patch/msgid/20170706130023.28417-2-daniel.vetter@ffwll.ch">http://patchwork.freedesktop.org/patch/msgid/20170706130023.28417-2-daniel.vetter@ffwll.ch</a>
commit 88be58be886f1215cc73dc8c273c985eecd7385c
Author: Daniel Vetter <<a href="mailto:daniel.vetter@ffwll.ch">daniel.vetter@ffwll.ch</a>>
Date: Thu Jul 6 15:00:19 2017 +0200
drm/i915/fbdev: Always forward hotplug events
With deferred fbdev setup we always need to forward hotplug events,
even if fbdev isn't fully set up yet. Otherwise the deferred setup
will neer happen.
Originally this check was added in
commit c45eb4fed12d278d3619f1904885bd0d7bcbf036 (tag:
drm-intel-next-fixes-2016-08-05)
Author: Chris Wilson <<a href="mailto:chris@chris-wilson.co.uk">chris@chris-wilson.co.uk</a>>
Date: Wed Jul 13 18:34:45 2016 +0100
drm/i915/fbdev: Check for the framebuffer before use
But the specific case of the hotplug function blowing up was fixed in
commit 50c3dc970a09b3b60422a58934cc27a413288bab
Author: Daniel Vetter <<a href="mailto:daniel.vetter@ffwll.ch">daniel.vetter@ffwll.ch</a>>
Date: Fri Jun 27 17:19:22 2014 +0200
drm/fb-helper: Fix hpd vs. initial config races
Cc: Maarten Lankhorst <<a href="mailto:maarten.lankhorst@linux.intel.com">maarten.lankhorst@linux.intel.com</a>>
Cc: Mika Kuoppala <<a href="mailto:mika.kuoppala@intel.com">mika.kuoppala@intel.com</a>>
Cc: Chris Wilson <<a href="mailto:chris@chris-wilson.co.uk">chris@chris-wilson.co.uk</a>>
Reviewed-by: Maarten Lankhorst <<a href="mailto:maarten.lankhorst@linux.intel.com">maarten.lankhorst@linux.intel.com</a>>
Signed-off-by: Daniel Vetter <<a href="mailto:daniel.vetter@intel.com">daniel.vetter@intel.com</a>>
Link:
<a href="http://patchwork.freedesktop.org/patch/msgid/20170706130023.28417-1-daniel.vetter@ffwll.ch">http://patchwork.freedesktop.org/patch/msgid/20170706130023.28417-1-daniel.vetter@ffwll.ch</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
<li>You are the QA Contact for the bug.</li>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>