Chris Wilson dde7b00e4c drm/i915: Fix use after free in lpe_audio_platdev_destroy() ... [31908.547136] BUG: KASAN: use-after-free in intel_lpe_audio_teardown+0x78/0xb0 [i915] at addr ffff8801f7788358 [31908.547297] Read of size 8 by task drv_selftest/3781 [31908.547405] CPU: 0 PID: 3781 Comm: drv_selftest Tainted: G BU W 4.10.0+ #451 [31908.547553] Hardware name: / , BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015 [31908.547682] Call Trace: [31908.547772] dump_stack+0x68/0x9f [31908.547857] kasan_object_err+0x1c/0x70 [31908.547947] kasan_report_error+0x1f1/0x4f0 [31908.548038] ? kfree+0xaa/0x170 [31908.548121] kasan_report+0x34/0x40 [31908.548211] ? klist_children_get+0x20/0x30 [31908.548472] ? intel_lpe_audio_teardown+0x78/0xb0 [i915] [31908.548567] __asan_load8+0x5e/0x70 [31908.548824] intel_lpe_audio_teardown+0x78/0xb0 [i915] [31908.549080] intel_audio_deinit+0x28/0x80 [i915] [31908.549315] i915_driver_unload+0xe4/0x360 [i915] [31908.549551] ? i915_driver_load+0x1d70/0x1d70 [i915] [31908.549651] ? trace_hardirqs_on+0xd/0x10 [31908.549885] i915_pci_remove+0x23/0x30 [i915] [31908.549978] pci_device_remove+0x5c/0x100 [31908.550069] device_release_driver_internal+0x1db/0x2e0 [31908.550165] driver_detach+0x68/0xc0 [31908.550256] bus_remove_driver+0x8b/0x150 [31908.550346] driver_unregister+0x3e/0x60 [31908.550439] pci_unregister_driver+0x1d/0x110 [31908.550531] ? find_module_all+0x7a/0xa0 [31908.550791] i915_exit+0x1a/0x87 [i915] [31908.550881] SyS_delete_module+0x264/0x2c0 [31908.550971] ? free_module+0x430/0x430 [31908.551064] ? trace_hardirqs_off_caller+0x16/0x110 [31908.551159] ? trace_hardirqs_on_caller+0x16/0x280 [31908.551256] ? trace_hardirqs_on_thunk+0x1a/0x1c [31908.551350] entry_SYSCALL_64_fastpath+0x1c/0xb1 [31908.551440] RIP: 0033:0x7f1d67312ec7 [31908.551520] RSP: 002b:00007ffebe34e888 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [31908.551650] RAX: ffffffffffffffda RBX: ffffffff811123f6 RCX: 00007f1d67312ec7 [31908.551743] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000560d0af476b8 [31908.551837] RBP: ffff880233d87f98 R08: 0000000000000000 R09: 00007ffebe34e8b8 [31908.551930] R10: 00007f1d68adf8c0 R11: 0000000000000206 R12: 0000000000000000 [31908.552023] R13: 0000560d0af46440 R14: 0000000000000034 R15: 00007ffebe34d860 [31908.552121] ? trace_hardirqs_off_caller+0x16/0x110 [31908.552217] Object at ffff8801f7788000, in cache kmalloc-2048 size: 2048 [31908.552306] Allocated: [31908.552377] PID = 3781 [31908.552456] save_stack_trace+0x16/0x20 [31908.552539] kasan_kmalloc+0xee/0x190 [31908.552627] __kmalloc+0xdb/0x1b0 [31908.552713] platform_device_alloc+0x27/0x90 [31908.552804] platform_device_register_full+0x36/0x220 [31908.553066] intel_lpe_audio_init+0x41e/0x570 [i915] [31908.553320] intel_audio_init+0xd/0x40 [i915] [31908.553552] i915_driver_load+0x13f5/0x1d70 [i915] [31908.553788] i915_pci_probe+0x65/0xe0 [i915] [31908.553881] pci_device_probe+0xda/0x140 [31908.553969] driver_probe_device+0x400/0x660 [31908.554058] __driver_attach+0x11c/0x120 [31908.554147] bus_for_each_dev+0xe6/0x150 [31908.554237] driver_attach+0x26/0x30 [31908.554325] bus_add_driver+0x26b/0x3b0 [31908.554412] driver_register+0xce/0x190 [31908.554502] __pci_register_driver+0xaf/0xc0 [31908.554589] 0xffffffffa0550063 [31908.554675] do_one_initcall+0x8b/0x1e0 [31908.554764] do_init_module+0x102/0x325 [31908.554852] load_module+0x3aad/0x45e0 [31908.554944] SyS_finit_module+0x169/0x1a0 [31908.555033] entry_SYSCALL_64_fastpath+0x1c/0xb1 [31908.555119] Freed: [31908.555188] PID = 3781 [31908.555266] save_stack_trace+0x16/0x20 [31908.555349] kasan_slab_free+0xb0/0x180 [31908.555436] kfree+0xaa/0x170 [31908.555520] platform_device_release+0x76/0x80 [31908.555610] device_release+0x45/0xe0 [31908.555698] kobject_put+0x11f/0x260 [31908.555785] put_device+0x12/0x20 [31908.555871] platform_device_unregister+0x1b/0x20 [31908.556135] intel_lpe_audio_teardown+0x5c/0xb0 [i915] [31908.556390] intel_audio_deinit+0x28/0x80 [i915] [31908.556622] i915_driver_unload+0xe4/0x360 [i915] [31908.556858] i915_pci_remove+0x23/0x30 [i915] [31908.556948] pci_device_remove+0x5c/0x100 [31908.557037] device_release_driver_internal+0x1db/0x2e0 [31908.557129] driver_detach+0x68/0xc0 [31908.557217] bus_remove_driver+0x8b/0x150 [31908.557304] driver_unregister+0x3e/0x60 [31908.557394] pci_unregister_driver+0x1d/0x110 [31908.557653] i915_exit+0x1a/0x87 [i915] [31908.557741] SyS_delete_module+0x264/0x2c0 [31908.557834] entry_SYSCALL_64_fastpath+0x1c/0xb1 [31908.557919] Memory state around the buggy address: [31908.558005] ffff8801f7788200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558127] ffff8801f7788280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558255] >ffff8801f7788300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558374] ^ [31908.558467] ffff8801f7788380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558595] ffff8801f7788400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb v2: Just leak the memory (8 bytes) as freeing it ourselves is not safe, and we need to coordinate a proper fix in platform_device itself. Fixes: eef57324d9 ("drm/i915: setup bridge for HDMI LPE audio driver") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99952 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Cc: Jerome Anand <jerome.anand@intel.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Takashi Iwai <tiwai@suse.de> Link: http://patchwork.freedesktop.org/patch/msgid/20170412080251.30648-1-chris@chris-wilson.co.uk Reviewed-by: Takashi Iwai <tiwai@suse.de> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> (cherry picked from commit 48ae80741d) Signed-off-by: Jani Nikula <jani.nikula@intel.com>		2017-04-26 16:28:15 +03:00
..
amd	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
arc	drm: remove drm_vblank_no_hw_counter assignment from driver code	2017-02-07 21:43:55 +01:00
arm	drm: convert drivers to use of_graph_get_remote_node	2017-04-06 17:00:27 -04:00
armada	drm: Add acquire ctx parameter to ->page_flip(_target)	2017-03-29 09:50:38 +02:00
ast	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
atmel-hlcdc	drm: convert drivers to use drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
bochs	drm/ttm: add io_mem_pfn callback	2017-04-04 23:33:42 -04:00
bridge	drm: bridge: analogix: Destroy connector & encoder when unbinding	2017-04-07 13:28:32 -04:00
cirrus	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
etnaviv	Linux 4.11-rc6	2017-04-11 07:40:42 +10:00
exynos	drm: convert drivers to use drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
fsl-dcu	drm: convert drivers to use drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
gma500	drm: Add acquire ctx to ->gamma_set hook	2017-04-06 10:21:55 +02:00
hisilicon	drm: convert drivers to use drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
i2c
i810	drm/i810: drop device_is_agp callback	2017-01-26 10:44:43 +01:00
i915	drm/i915: Fix use after free in lpe_audio_platdev_destroy()	2017-04-26 16:28:15 +03:00
imx	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
lib	drm: Add a simple generator of random permutations	2016-12-27 12:34:00 +01:00
mediatek	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
meson	drm: convert drivers to use of_graph_get_remote_node	2017-04-06 17:00:27 -04:00
mga	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
mgag200	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
msm	Merge branch 'msm-next' of git://people.freedesktop.org/~robclark/linux into drm-next	2017-04-11 07:47:02 +10:00
mxsfb	drm: convert drivers to use drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
nouveau	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
omapdrm	drm: omap: use common OF graph helpers	2017-04-06 17:00:27 -04:00
panel	drm/panel: Changes for v4.12-rc1	2017-04-13 06:17:40 +10:00
qxl	drm/ttm: add io_mem_pfn callback	2017-04-04 23:33:42 -04:00
r128	gpu: drm: drivers: Convert printk(KERN_<LEVEL> to pr_<level>	2017-03-01 09:44:11 +01:00
radeon	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
rcar-du	drm: rcar-du: Add HDMI outputs to R8A7795 device description	2017-04-04 17:04:21 +03:00
rockchip	drm/rockchip: Shutdown all crtcs when unbinding drm	2017-04-07 13:28:32 -04:00
savage	drm: Change the return type of the unload hook to void	2017-01-09 11:25:22 +01:00
selftests	drm: kselftest: fix spelling mistake: "misalinged" -> "misaligned"	2017-02-26 22:54:47 +01:00
shmobile	drm: Add acquire ctx parameter to ->page_flip(_target)	2017-03-29 09:50:38 +02:00
sis	drm: Improve drm_mm search (and fix topdown allocation) with rbtrees	2017-02-03 11:10:32 +01:00
sti	drm: Create DEFINE_DRM_GEM_CMA_FOPS and roll it out to drivers	2017-03-14 14:38:34 +01:00
sun4i	drm: convert drivers to use drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
tdfx
tegra	drm/tegra: Don't use modeset_lock_crtc	2017-03-27 17:50:47 +02:00
tilcdc	drm: convert drivers to use of_graph_get_remote_node	2017-04-06 17:00:27 -04:00
tinydrm	drm/atomic: Introduce drm_atomic_helper_shutdown	2017-03-27 09:43:58 +02:00
ttm	Linux 4.11-rc6	2017-04-11 07:40:42 +10:00
udl	drm: Add acquire ctx parameter to ->page_flip(_target)	2017-03-29 09:50:38 +02:00
vc4	Linux 4.11-rc6	2017-04-11 07:40:42 +10:00
vgem	Pointer for Markus's image conversion work.	2017-03-14 15:07:33 +01:00
via	drm/via: use get_user_pages_unlocked()	2017-02-28 10:00:50 +01:00
virtio	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
vmwgfx	Merge tag 'drm-misc-next-2017-04-07' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-11 07:41:10 +10:00
zte	drm: zte: remove leftover 'inf' from struct zx_hdmi	2017-03-22 13:44:42 +08:00
ati_pcigart.c
drm_agpsupport.c	drm/i810: drop device_is_agp callback	2017-01-26 10:44:43 +01:00
drm_atomic_helper.c	drm/atomic: Add connector atomic_check function, v2.	2017-04-06 17:00:27 -04:00
drm_atomic.c	drm: extract legacy framebuffer remove	2017-04-06 10:22:43 +02:00
drm_auth.c	drm/core: Use recommened kerneldoc for struct member refs	2017-01-25 16:22:42 +01:00
drm_blend.c	drm/blend: Use new atomic iterator macros.	2017-03-06 11:43:43 +01:00
drm_bridge.c	drm/bridge: Use recommened kerneldoc for struct member refs	2017-01-02 09:17:26 +01:00
drm_bufs.c
drm_cache.c	gpu: drm: core: Convert printk(KERN_<LEVEL> to pr_<level>	2017-02-28 14:32:19 +01:00
drm_color_mgmt.c	drm/atomic-helper: Remove legacy backoff hack from gamma_set	2017-04-06 10:22:35 +02:00
drm_connector.c	drm: Rename connector list iterator API	2017-02-28 16:16:48 +01:00
drm_context.c
drm_crtc_helper_internal.h
drm_crtc_helper.c	drm: Add acquire ctx parameter to ->set_config	2017-03-29 09:56:25 +02:00
drm_crtc_internal.h	drm: extract legacy framebuffer remove	2017-04-06 10:22:43 +02:00
drm_crtc.c	drm: Take mode_config.mutex in setcrtc ioctl	2017-04-06 22:49:50 +02:00
drm_debugfs_crc.c	Revert "drm: Don't allow interruptions when opening debugfs/crc"	2017-04-07 16:18:28 -04:00
drm_debugfs.c	drm/debugfs: Add kerneldoc	2017-03-24 09:36:06 +01:00
drm_dma.c
drm_dp_aux_dev.c
drm_dp_dual_mode_helper.c	drm: Add name for DRM_DP_DUAL_MODE_LSPCON	2017-02-23 11:06:12 -05:00
drm_dp_helper.c	drm/dp: Add missing description to parameter	2017-03-07 16:38:16 -05:00
drm_dp_mst_topology.c	drm/dp: Split drm_dp_mst_allocate_vcpi	2017-03-22 21:47:44 +01:00
drm_drv.c	Linux 4.10-rc8	2017-02-23 12:10:12 +10:00
drm_dumb_buffers.c	drm/kms-core: Use recommened kerneldoc for struct member refs	2017-01-25 16:30:34 +01:00
drm_edid_load.c	drm: move edid property update and add modes out of edid firmware loader	2017-02-21 15:41:24 +02:00
drm_edid.c	Linux 4.11-rc3	2017-03-23 12:05:13 +10:00
drm_encoder_slave.c	drm/kms-core: Use recommened kerneldoc for struct member refs	2017-01-25 16:30:34 +01:00
drm_encoder.c	drm: Rename connector list iterator API	2017-02-28 16:16:48 +01:00
drm_fb_cma_helper.c	drm: Add mode_config .get_format_info() hook	2017-03-22 19:45:00 +02:00
drm_fb_helper.c	drm/fb-helper: Extract _legacy kms functions	2017-04-06 10:23:06 +02:00
drm_file.c	drm/gem: Add DEFINE_DRM_GEM_FOPS	2017-03-14 14:38:34 +01:00
drm_flip_work.c
drm_fourcc.c	Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux into drm-misc-next	2017-03-23 08:15:55 +01:00
drm_framebuffer.c	drm: extract legacy framebuffer remove	2017-04-06 10:22:43 +02:00
drm_gem_cma_helper.c	Pointer for Markus's image conversion work.	2017-03-14 15:07:33 +01:00
drm_gem.c	drm: Introduce drm_gem_object_{get,put}()	2017-02-28 16:16:43 +01:00
drm_global.c	drm: Update TTM initialization documentation	2016-12-30 12:52:10 +01:00
drm_hashtab.c
drm_info.c	locking/atomic, kref: Add kref_read()	2017-01-14 11:37:18 +01:00
drm_internal.h	drm/debugfs: Add kerneldoc	2017-03-24 09:36:06 +01:00
drm_ioc32.c	drm: document drm_ioctl.[hc]	2017-04-04 20:47:54 +02:00
drm_ioctl.c	drm: Pass CRTC ID in userspace vblank events	2017-04-04 20:59:12 +01:00
drm_irq.c	drm: Pass CRTC ID in userspace vblank events	2017-04-04 20:59:12 +01:00
drm_kms_helper_common.c	drm: Remove drmP.h include from drm_kms_helper_common.c	2017-03-09 16:18:02 +01:00
drm_legacy.h	drm: compile drm_vm.c only when needed	2017-01-06 11:03:07 +01:00
drm_lock.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
drm_memory.c
drm_mipi_dsi.c
drm_mm.c	drm: Micro-optimise drm_mm_for_each_node_in_range()	2017-02-06 16:57:37 +01:00
drm_mode_config.c	drm: Rename connector list iterator API	2017-02-28 16:16:48 +01:00
drm_mode_object.c	Pointer for Markus's image conversion work.	2017-03-14 15:07:33 +01:00
drm_modes.c	drm: Rename drm_mode_object_get()	2017-02-28 16:14:53 +01:00
drm_modeset_helper.c	drm: Add mode_config .get_format_info() hook	2017-03-22 19:45:00 +02:00
drm_modeset_lock.c	drm: Remove drm_modeset_legacy_acquire_ctx and crtc->acquire_ctx	2017-04-05 09:26:45 +02:00
drm_of.c	drm: of: introduce drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
drm_panel.c	drm/panel: Constify device node argument to of_drm_find_panel()	2017-01-04 08:30:37 +01:00
drm_pci.c	drm: Extract drm_pci.h	2017-03-09 16:18:02 +01:00
drm_plane_helper.c	drm: Add acquire ctx parameter to ->set_config	2017-03-29 09:56:25 +02:00
drm_plane.c	drm: Only take cursor locks when the cursor plane exists	2017-04-07 13:28:32 -04:00
drm_prime.c	drm: Extract drm_prime.h	2017-03-09 16:18:02 +01:00
drm_print.c	drm: drm_printer: add __printf validation	2017-02-26 21:43:08 +01:00
drm_probe_helper.c	drm/atomic: Acquire connection_mutex lock in drm_helper_probe_single_connector_modes, v4.	2017-04-06 21:29:23 +02:00
drm_property.c	drm: Drop modeset_lock_all from the getproperty ioctl	2017-04-05 09:27:16 +02:00
drm_rect.c	drm/rect: Fix formatting of example code	2016-12-30 13:35:54 +01:00
drm_scatter.c
drm_scdc_helper.c	drm/edid: detect SCDC support in HF-VSDB	2017-03-21 10:15:56 +02:00
drm_simple_kms_helper.c	drm: Clarify the role of plane_state argument to drm_simple update().	2017-03-30 12:02:00 -07:00
drm_sysfs.c	drm: Consolidate and document sysfs support	2017-04-04 20:47:54 +02:00
drm_trace_points.c
drm_trace.h	drm: Remove drm_pending_event->pid	2017-03-14 14:38:33 +01:00
drm_vm.c	drm: remove unnecessary fault wrappers	2017-02-24 17:46:55 -08:00
drm_vma_manager.c	drm: Improve drm_mm search (and fix topdown allocation) with rbtrees	2017-02-03 11:10:32 +01:00
Kconfig	drm/fb-helper: Add multi buffer support for cma fbdev	2017-02-26 22:11:37 +01:00
Makefile	drm: Add SCDC helpers	2017-03-21 10:15:39 +02:00