Re: [Intel-gfx] [PATCH] drm/i915: fix use-after-free in page_flip_completed()

2017-01-27 Thread Daniel Vetter
On Thu, Jan 26, 2017 at 02:46:20PM +, Chris Wilson wrote: > On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote: > > page_flip_completed() dereferences 'work' variable after executing > > queue_work(). This is not safe as the 'work' item might be already freed > > by queued work: >

Re: [Intel-gfx] [PATCH] drm/i915: fix use-after-free in page_flip_completed()

2017-01-27 Thread Daniel Vetter
On Thu, Jan 26, 2017 at 02:46:20PM +, Chris Wilson wrote: > On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote: > > page_flip_completed() dereferences 'work' variable after executing > > queue_work(). This is not safe as the 'work' item might be already freed > > by queued work: >

Re: [PATCH] drm/i915: fix use-after-free in page_flip_completed()

2017-01-26 Thread Chris Wilson
On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote: > page_flip_completed() dereferences 'work' variable after executing > queue_work(). This is not safe as the 'work' item might be already freed > by queued work: > > BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490

Re: [PATCH] drm/i915: fix use-after-free in page_flip_completed()

2017-01-26 Thread Chris Wilson
On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote: > page_flip_completed() dereferences 'work' variable after executing > queue_work(). This is not safe as the 'work' item might be already freed > by queued work: > > BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490

[PATCH] drm/i915: fix use-after-free in page_flip_completed()

2017-01-26 Thread Andrey Ryabinin
page_flip_completed() dereferences 'work' variable after executing queue_work(). This is not safe as the 'work' item might be already freed by queued work: BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr 8803dc010f90 Call Trace:

[PATCH] drm/i915: fix use-after-free in page_flip_completed()

2017-01-26 Thread Andrey Ryabinin
page_flip_completed() dereferences 'work' variable after executing queue_work(). This is not safe as the 'work' item might be already freed by queued work: BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr 8803dc010f90 Call Trace: