Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-11 Thread Huang Rui
On Mon, Sep 10, 2018 at 09:10:00PM +0800, Koenig, Christian wrote: > Am 10.09.2018 um 15:05 schrieb Tom St Denis: > > On 2018-09-10 9:04 a.m., Christian König wrote: > >> Hi Tom, > >> > >> I'm talking about adding new printks to figure out what the heck is > >> going wrong here. > >> > >> Thanks,

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Christian König
Am 10.09.2018 um 15:05 schrieb Tom St Denis: On 2018-09-10 9:04 a.m., Christian König wrote: Hi Tom, I'm talking about adding new printks to figure out what the heck is going wrong here. Thanks, Christian. Hi Christian, Sure, if you want to send me a simple patch that adds more printk I'l

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Tom St Denis
On 2018-09-10 9:04 a.m., Christian König wrote: Hi Tom, I'm talking about adding new printks to figure out what the heck is going wrong here. Thanks, Christian. Hi Christian, Sure, if you want to send me a simple patch that adds more printk I'll gladly give it a try (doubly so since my wo

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Christian König
Hi Tom, I'm talking about adding new printks to figure out what the heck is going wrong here. Thanks, Christian. Am 10.09.2018 um 14:59 schrieb Tom St Denis: Hi Christian, Are you adding new traces or turning on existing ones?  Would you like me to try them out in my setup? Tom On 2018-

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Tom St Denis
Hi Christian, Are you adding new traces or turning on existing ones? Would you like me to try them out in my setup? Tom On 2018-09-10 8:49 a.m., Christian König wrote: Am 10.09.2018 um 14:05 schrieb Huang Rui: On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: Am 10.09.201

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Christian König
Am 10.09.2018 um 14:05 schrieb Huang Rui: On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: Am 10.09.2018 um 11:23 schrieb Huang Rui: On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: Hi Ray, well those patches doesn't make sense, the pointer is only local to t

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Huang Rui
On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: > Am 10.09.2018 um 11:23 schrieb Huang Rui: > > On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: > >> Hi Ray, > >> > >> well those patches doesn't make sense, the pointer is only local to > >> the function. > > You'r

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Huang Rui
On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: > Am 10.09.2018 um 11:23 schrieb Huang Rui: > > On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: > >> Hi Ray, > >> > >> well those patches doesn't make sense, the pointer is only local to > >> the function. > > You'r

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Christian König
Am 10.09.2018 um 11:23 schrieb Huang Rui: On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: Hi Ray, well those patches doesn't make sense, the pointer is only local to the function. You're right. I narrowed it with gdb dump from ttm_bo_bulk_move_lru_tail+0x2b, the use-after-free

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Huang Rui
On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: > Hi Ray, > > well those patches doesn't make sense, the pointer is only local to > the function. You're right. I narrowed it with gdb dump from ttm_bo_bulk_move_lru_tail+0x2b, the use-after-free should be in below codes: man = &b

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Christian König
Hi Ray, well those patches doesn't make sense, the pointer is only local to the function. Regards, Christian. Am 10.09.2018 um 10:57 schrieb Huang Rui: It avoids to be refered again after freed. Signed-off-by: Huang Rui Cc: Christian König Cc: Tom StDenis --- drivers/gpu/drm/ttm/ttm_bo

[PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

2018-09-10 Thread Huang Rui
It avoids to be refered again after freed. Signed-off-by: Huang Rui Cc: Christian K??nig Cc: Tom StDenis --- drivers/gpu/drm/ttm/ttm_bo.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 138c989..d3ef5f8 100644 --- a/drivers/