<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - [BXT] Everything using GPU gets stuck after running+killing parallel Media loads" href="https://bugs.freedesktop.org/show_bug.cgi?id=110848#c62">Comment # 62</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - [BXT] Everything using GPU gets stuck after running+killing parallel Media loads" href="https://bugs.freedesktop.org/show_bug.cgi?id=110848">bug 110848</a> from <a class="email" href="mailto:david.weinehall@intel.com" title="David Weinehall <david.weinehall@intel.com>"> David Weinehall</a> <pre>[ 2138.371643] ================================================================== [ 2138.371911] BUG: KASAN: use-after-free in per_file_stats+0x43/0x380 [i915] [ 2138.371924] Read of size 8 at addr ffff888223651000 by task cat/8293 [ 2138.371947] CPU: 0 PID: 8293 Comm: cat Not tainted 5.3.0-rc6-CI-Custom_4352+ #1 [ 2138.371953] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4205-ITX, BIOS P1.40 07/14/2017 [ 2138.371959] Call Trace: [ 2138.371974] dump_stack+0x7c/0xbb [ 2138.372099] ? per_file_stats+0x43/0x380 [i915] [ 2138.372108] print_address_description+0x73/0x3a0 [ 2138.372231] ? per_file_stats+0x43/0x380 [i915] [ 2138.372352] ? per_file_stats+0x43/0x380 [i915] [ 2138.372362] __kasan_report+0x14e/0x192 [ 2138.372489] ? per_file_stats+0x43/0x380 [i915] [ 2138.372502] kasan_report+0xe/0x20 [ 2138.372625] per_file_stats+0x43/0x380 [i915] [ 2138.372751] ? i915_panel_show+0x110/0x110 [i915] [ 2138.372761] idr_for_each+0xa7/0x160 [ 2138.372773] ? idr_get_next_ul+0x110/0x110 [ 2138.372782] ? do_raw_spin_lock+0x10a/0x1d0 [ 2138.372923] print_context_stats+0x264/0x510 [i915] [ 2138.373051] ? i915_interrupt_info+0x1140/0x1140 [i915] [ 2138.373065] ? preempt_count_sub+0x14/0xc0 [ 2138.373074] ? __mutex_lock+0x656/0xcb0 [ 2138.373092] ? __mutex_add_waiter+0x90/0x90 [ 2138.373121] ? seq_vprintf+0xb0/0xb0 [ 2138.373262] i915_gem_object_info+0xc8/0xe0 [i915] [ 2138.373276] seq_read+0x1a4/0x6b0 [ 2138.373306] full_proxy_read+0x8e/0xc0 [ 2138.373323] vfs_read+0xc3/0x1e0 [ 2138.373338] ksys_read+0x116/0x170 [ 2138.373348] ? kernel_write+0xb0/0xb0 [ 2138.373361] ? lockdep_hardirqs_off+0xb5/0x100 [ 2138.373368] ? mark_held_locks+0x1a/0x90 [ 2138.373385] do_syscall_64+0x72/0x260 [ 2138.373397] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2138.373405] RIP: 0033:0x7f7da3356081 [ 2138.373415] Code: fe ff ff 48 8d 3d 67 9c 0a 00 48 83 ec 08 e8 a6 4c 02 00 66 0f 1f 44 00 00 48 8d 05 81 08 2e 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 41 54 55 49 89 d4 53 [ 2138.373421] RSP: 002b:00007ffeed129258 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2138.373429] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f7da3356081 [ 2138.373435] RDX: 0000000000020000 RSI: 00007f7da381b000 RDI: 0000000000000003 [ 2138.373441] RBP: 0000000000020000 R08: 00000000ffffffff R09: 0000000000000000 [ 2138.373447] R10: 0000000000000022 R11: 0000000000000246 R12: 00007f7da381b000 [ 2138.373453] R13: 0000000000000003 R14: 00007f7da381b00f R15: 0000000000020000 [ 2138.373494] Allocated by task 7737: [ 2138.373507] __kasan_kmalloc.constprop.0+0xcb/0x130 [ 2138.373515] kmem_cache_alloc+0xdf/0x2d0 [ 2138.373641] i915_gem_object_create_shmem.part.1+0x1d/0x2c0 [i915] [ 2138.373767] i915_gem_create+0x96/0x140 [i915] [ 2138.373776] drm_ioctl_kernel+0x114/0x190 [ 2138.373783] drm_ioctl+0x4ba/0x580 [ 2138.373790] do_vfs_ioctl+0x134/0x9d0 [ 2138.373797] ksys_ioctl+0x3a/0x70 [ 2138.373803] __x64_sys_ioctl+0x3d/0x50 [ 2138.373810] do_syscall_64+0x72/0x260 [ 2138.373817] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2138.373832] Freed by task 187: [ 2138.373843] __kasan_slab_free+0x146/0x200 [ 2138.373851] kmem_cache_free+0xb3/0x390 [ 2138.373975] __i915_gem_free_object_rcu+0x3c/0x60 [i915] [ 2138.373982] rcu_core+0x326/0xa10 [ 2138.373990] __do_softirq+0x12f/0x618 [ 2138.374006] The buggy address belongs to the object at ffff888223650f00 which belongs to the cache drm_i915_gem_object of size 1136 [ 2138.374018] The buggy address is located 256 bytes inside of 1136-byte region [ffff888223650f00, ffff888223651370) [ 2138.374028] The buggy address belongs to the page: [ 2138.374040] page:ffffea00088d9400 refcount:1 mapcount:0 mapping:ffff888235ed5b80 index:0x0 compound_mapcount: 0 [ 2138.374050] flags: 0x8000000000010200(slab|head) [ 2138.374061] raw: 8000000000010200 0000000000000000 0000000100000001 ffff888235ed5b80 [ 2138.374068] raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000 [ 2138.374074] page dumped because: kasan: bad access detected [ 2138.374087] Memory state around the buggy address: [ 2138.374099] ffff888223650f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2138.374110] ffff888223650f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2138.374121] >ffff888223651000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2138.374130] ^ [ 2138.374141] ffff888223651080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2138.374152] ffff888223651100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2138.374161] ==================================================================</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are on the CC list for the bug.</li> <li>You are the assignee for the bug.</li> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>