Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

On Mon, Sep 10, 2018 at 09:10:00PM +0800, Koenig, Christian wrote: > Am 10.09.2018 um 15:05 schrieb Tom St Denis: > > On 2018-09-10 9:04 a.m., Christian König wrote: > >> Hi Tom, > >> > >> I'm talking about adding new printks to figure out what the heck is > >> going wrong here. > >> > >> Thanks,

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

Am 10.09.2018 um 15:05 schrieb Tom St Denis: On 2018-09-10 9:04 a.m., Christian König wrote: Hi Tom, I'm talking about adding new printks to figure out what the heck is going wrong here. Thanks, Christian. Hi Christian, Sure, if you want to send me a simple patch that adds more printk

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

On 2018-09-10 9:04 a.m., Christian König wrote: Hi Tom, I'm talking about adding new printks to figure out what the heck is going wrong here. Thanks, Christian. Hi Christian, Sure, if you want to send me a simple patch that adds more printk I'll gladly give it a try (doubly so since my

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

Hi Tom, I'm talking about adding new printks to figure out what the heck is going wrong here. Thanks, Christian. Am 10.09.2018 um 14:59 schrieb Tom St Denis: Hi Christian, Are you adding new traces or turning on existing ones?  Would you like me to try them out in my setup? Tom On

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

Hi Christian, Are you adding new traces or turning on existing ones? Would you like me to try them out in my setup? Tom On 2018-09-10 8:49 a.m., Christian König wrote: Am 10.09.2018 um 14:05 schrieb Huang Rui: On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: Am

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

Am 10.09.2018 um 14:05 schrieb Huang Rui: On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: Am 10.09.2018 um 11:23 schrieb Huang Rui: On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: Hi Ray, well those patches doesn't make sense, the pointer is only local to

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: > Am 10.09.2018 um 11:23 schrieb Huang Rui: > > On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: > >> Hi Ray, > >> > >> well those patches doesn't make sense, the pointer is only local to > >> the function. > >

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

On Mon, Sep 10, 2018 at 05:25:48PM +0800, Koenig, Christian wrote: > Am 10.09.2018 um 11:23 schrieb Huang Rui: > > On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: > >> Hi Ray, > >> > >> well those patches doesn't make sense, the pointer is only local to > >> the function. > >

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

Am 10.09.2018 um 11:23 schrieb Huang Rui: On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: Hi Ray, well those patches doesn't make sense, the pointer is only local to the function. You're right. I narrowed it with gdb dump from ttm_bo_bulk_move_lru_tail+0x2b, the

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

On Mon, Sep 10, 2018 at 11:00:04AM +0200, Christian König wrote: > Hi Ray, > > well those patches doesn't make sense, the pointer is only local to > the function. You're right. I narrowed it with gdb dump from ttm_bo_bulk_move_lru_tail+0x2b, the use-after-free should be in below codes: man =

Re: [PATCH 1/2] drm/ttm: set ttm_buffer_object pointer as null after it's freed

Hi Ray, well those patches doesn't make sense, the pointer is only local to the function. Regards, Christian. Am 10.09.2018 um 10:57 schrieb Huang Rui: It avoids to be refered again after freed. Signed-off-by: Huang Rui Cc: Christian König Cc: Tom StDenis ---