Re: [Intel-gfx] [PATCH] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2.
On Wed, Feb 12, 2020 at 02:54:45PM +0100, Maarten Lankhorst wrote: > This fixes the following KASAN splash on module reload: > [ 145.136327] > == > [ 145.136502] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x74/0x80 > [i915] > [ 145.136514] Read of size 8 at addr 888216641830 by task kworker/1:1/134 > > [ 145.136535] CPU: 1 PID: 134 Comm: kworker/1:1 Tainted: G U T > 5.5.0-rc7-valkyria+ #5783 > [ 145.136539] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1 > 07/27/2016 > [ 145.136546] Workqueue: events drm_connector_free_work_fn > [ 145.136551] Call Trace: > [ 145.136560] dump_stack+0xa1/0xe0 > [ 145.136571] print_address_description.constprop.0+0x1e/0x210 > [ 145.136639] ? intel_hdmi_destroy+0x74/0x80 [i915] > [ 145.136703] ? intel_hdmi_destroy+0x74/0x80 [i915] > [ 145.136710] __kasan_report.cold+0x1b/0x37 > [ 145.136790] ? intel_hdmi_destroy+0x74/0x80 [i915] > [ 145.136863] ? intel_hdmi_destroy+0x74/0x80 [i915] > [ 145.136870] kasan_report+0x27/0x30 > [ 145.136881] __asan_report_load8_noabort+0x1c/0x20 > [ 145.136946] intel_hdmi_destroy+0x74/0x80 [i915] > [ 145.136954] drm_connector_free_work_fn+0xd1/0x100 > [ 145.136967] process_one_work+0x86e/0x1610 > [ 145.136987] ? pwq_dec_nr_in_flight+0x2f0/0x2f0 > [ 145.137004] ? move_linked_works+0x128/0x2c0 > [ 145.137021] worker_thread+0x63e/0xc90 > [ 145.137048] kthread+0x2f6/0x3f0 > [ 145.137054] ? calculate_sigpending+0x81/0xa0 > [ 145.137059] ? process_one_work+0x1610/0x1610 > [ 145.137064] ? kthread_bind+0x40/0x40 > [ 145.137075] ret_from_fork+0x24/0x30 > > [ 145.137111] Allocated by task 0: > [ 145.137119] (stack is not available) > > [ 145.137137] Freed by task 5053: > [ 145.137147] save_stack+0x28/0x90 > [ 145.137152] __kasan_slab_free+0x136/0x180 > [ 145.137157] kasan_slab_free+0x26/0x30 > [ 145.137161] kfree+0xe6/0x350 > [ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915] > [ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0 > [ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915] > [ 145.137403] i915_driver_remove+0xc4/0x130 [i915] > [ 145.137482] i915_pci_remove+0x3e/0x90 [i915] > [ 145.137489] pci_device_remove+0x108/0x2d0 > [ 145.137494] device_release_driver_internal+0x1e6/0x4a0 > [ 145.137499] driver_detach+0xcb/0x198 > [ 145.137503] bus_remove_driver+0xde/0x204 > [ 145.137508] driver_unregister+0x6d/0xa0 > [ 145.137513] pci_unregister_driver+0x2e/0x230 > [ 145.137576] i915_exit+0x1f/0x26 [i915] > [ 145.137157] kasan_slab_free+0x26/0x30 > [ 145.137161] kfree+0xe6/0x350 > [ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915] > [ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0 > [ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915] > [ 145.137403] i915_driver_remove+0xc4/0x130 [i915] > [ 145.137482] i915_pci_remove+0x3e/0x90 [i915] > [ 145.137489] pci_device_remove+0x108/0x2d0 > [ 145.137494] device_release_driver_internal+0x1e6/0x4a0 > [ 145.137499] driver_detach+0xcb/0x198 > [ 145.137503] bus_remove_driver+0xde/0x204 > [ 145.137508] driver_unregister+0x6d/0xa0 > [ 145.137513] pci_unregister_driver+0x2e/0x230 > [ 145.137576] i915_exit+0x1f/0x26 [i915] > [ 145.137581] __x64_sys_delete_module+0x35b/0x470 > [ 145.137586] do_syscall_64+0x99/0x4e0 > [ 145.137591] entry_SYSCALL_64_after_hwframe+0x49/0xbe > > [ 145.137606] The buggy address belongs to the object at 88821664 > which belongs to the cache kmalloc-8k of size 8192 > [ 145.137618] The buggy address is located 6192 bytes inside of > 8192-byte region [88821664, 888216642000) > [ 145.137630] The buggy address belongs to the page: > [ 145.137640] page:ea0008599000 refcount:1 mapcount:0 > mapping:888107c02a80 index:0x888216644000 compound_mapcount: 0 > [ 145.137647] raw: 02010200 00010001 > 888107c02a80 > [ 145.137652] raw: 888216644000 80020001 0001 > > [ 145.137656] page dumped because: kasan: bad access detected > > [ 145.137668] Memory state around the buggy address: > [ 145.137678] 888216641700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb > fb fb > [ 145.137687] 888216641780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb > fb fb > [ 145.137697] >888216641800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb > fb fb > [ 145.137706] ^ > [ 145.137715] 888216641880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb > fb fb > [ 145.137724] 888216641900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb > fb fb > [ 145.137733] > == > [ 145.137742] Disabling lock debugging due to kernel taint > > Changes since v1: > - Add fixes tags. > - Use early unregister. Yeah, much better than v1. Reviewed-by:
[Intel-gfx] [PATCH] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2.
This fixes the following KASAN splash on module reload:
[ 145.136327]
==
[ 145.136502] BUG: KASAN: use-after-free in intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136514] Read of size 8 at addr 888216641830 by task kworker/1:1/134
[ 145.136535] CPU: 1 PID: 134 Comm: kworker/1:1 Tainted: G U T
5.5.0-rc7-valkyria+ #5783
[ 145.136539] Hardware name: GIGABYTE GB-BKi3A-7100/MFLP3AP-00, BIOS F1
07/27/2016
[ 145.136546] Workqueue: events drm_connector_free_work_fn
[ 145.136551] Call Trace:
[ 145.136560] dump_stack+0xa1/0xe0
[ 145.136571] print_address_description.constprop.0+0x1e/0x210
[ 145.136639] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136703] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136710] __kasan_report.cold+0x1b/0x37
[ 145.136790] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136863] ? intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136870] kasan_report+0x27/0x30
[ 145.136881] __asan_report_load8_noabort+0x1c/0x20
[ 145.136946] intel_hdmi_destroy+0x74/0x80 [i915]
[ 145.136954] drm_connector_free_work_fn+0xd1/0x100
[ 145.136967] process_one_work+0x86e/0x1610
[ 145.136987] ? pwq_dec_nr_in_flight+0x2f0/0x2f0
[ 145.137004] ? move_linked_works+0x128/0x2c0
[ 145.137021] worker_thread+0x63e/0xc90
[ 145.137048] kthread+0x2f6/0x3f0
[ 145.137054] ? calculate_sigpending+0x81/0xa0
[ 145.137059] ? process_one_work+0x1610/0x1610
[ 145.137064] ? kthread_bind+0x40/0x40
[ 145.137075] ret_from_fork+0x24/0x30
[ 145.137111] Allocated by task 0:
[ 145.137119] (stack is not available)
[ 145.137137] Freed by task 5053:
[ 145.137147] save_stack+0x28/0x90
[ 145.137152] __kasan_slab_free+0x136/0x180
[ 145.137157] kasan_slab_free+0x26/0x30
[ 145.137161] kfree+0xe6/0x350
[ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915]
[ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0
[ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915]
[ 145.137403] i915_driver_remove+0xc4/0x130 [i915]
[ 145.137482] i915_pci_remove+0x3e/0x90 [i915]
[ 145.137489] pci_device_remove+0x108/0x2d0
[ 145.137494] device_release_driver_internal+0x1e6/0x4a0
[ 145.137499] driver_detach+0xcb/0x198
[ 145.137503] bus_remove_driver+0xde/0x204
[ 145.137508] driver_unregister+0x6d/0xa0
[ 145.137513] pci_unregister_driver+0x2e/0x230
[ 145.137576] i915_exit+0x1f/0x26 [i915]
[ 145.137157] kasan_slab_free+0x26/0x30
[ 145.137161] kfree+0xe6/0x350
[ 145.137242] intel_ddi_encoder_destroy+0x60/0x80 [i915]
[ 145.137252] drm_mode_config_cleanup+0x11d/0x8f0
[ 145.137329] intel_modeset_driver_remove+0x1f5/0x350 [i915]
[ 145.137403] i915_driver_remove+0xc4/0x130 [i915]
[ 145.137482] i915_pci_remove+0x3e/0x90 [i915]
[ 145.137489] pci_device_remove+0x108/0x2d0
[ 145.137494] device_release_driver_internal+0x1e6/0x4a0
[ 145.137499] driver_detach+0xcb/0x198
[ 145.137503] bus_remove_driver+0xde/0x204
[ 145.137508] driver_unregister+0x6d/0xa0
[ 145.137513] pci_unregister_driver+0x2e/0x230
[ 145.137576] i915_exit+0x1f/0x26 [i915]
[ 145.137581] __x64_sys_delete_module+0x35b/0x470
[ 145.137586] do_syscall_64+0x99/0x4e0
[ 145.137591] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 145.137606] The buggy address belongs to the object at 88821664
which belongs to the cache kmalloc-8k of size 8192
[ 145.137618] The buggy address is located 6192 bytes inside of
8192-byte region [88821664, 888216642000)
[ 145.137630] The buggy address belongs to the page:
[ 145.137640] page:ea0008599000 refcount:1 mapcount:0
mapping:888107c02a80 index:0x888216644000 compound_mapcount: 0
[ 145.137647] raw: 02010200 00010001
888107c02a80
[ 145.137652] raw: 888216644000 80020001 0001
[ 145.137656] page dumped because: kasan: bad access detected
[ 145.137668] Memory state around the buggy address:
[ 145.137678] 888216641700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[ 145.137687] 888216641780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[ 145.137697] >888216641800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[ 145.137706] ^
[ 145.137715] 888216641880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[ 145.137724] 888216641900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[ 145.137733]
==
[ 145.137742] Disabling lock debugging due to kernel taint
Changes since v1:
- Add fixes tags.
- Use early unregister.
Signed-off-by: Maarten Lankhorst
Fixes: 9c229127aee2 ("drm/i915: hdmi: add CEC notifier to intel_hdmi")
Cc: # v4.19+
---
drivers/gpu/drm/i915/display/intel_hdmi.c | 10 ++
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c
