linux-kernel - Re: [Intel-gfx] BUG: KASAN: use-after-free in intel_hdmi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0df373d6-99e0-7509-1404-f3eadd9f23f7@xs4all.nl>
Date:   Mon, 25 Feb 2019 15:43:10 +0100
From:   Hans Verkuil <hverkuil@...all.nl>
To:     Jani Nikula <jani.nikula@...ux.intel.com>,
        Randy Dunlap <rdunlap@...radead.org>,
        LKML <linux-kernel@...r.kernel.org>,
        intel-gfx <intel-gfx@...ts.freedesktop.org>
Cc:     Neil Armstrong <narmstrong@...libre.com>,
        Ville Syrjälä <ville.syrjala@...ux.intel.com>
Subject: Re: [Intel-gfx] BUG: KASAN: use-after-free in
 intel_hdmi_destroy+0x79/0x80

Hi Jani,

On 2/25/19 2:40 PM, Jani Nikula wrote:
> On Fri, 22 Feb 2019, Randy Dunlap <rdunlap@...radead.org> wrote:
>> This is 5.0-rc7 on an old Toshiba Portege laptop.
>> No hdmi or other external video.
>>
>> Linux dragon.dunlab 5.0.0-rc7mod #3 SMP PREEMPT Wed Feb 20 00:05:17 PST 2019 x86_64 x86_64 x86_64 GNU/Linux
>>
>> on openSUSE LEAP 15.0 distro.
>>
>> Full boot log is attached.
> 
> On a hunch, caused by 9c229127aee2 ("drm/i915: hdmi: add CEC notifier to
> intel_hdmi") referencing the encoder in connector destroy hook. We
> should probably move the cec_notifier_put() call in the encoder destroy
> hook.

So the intel_encoder_destroy function is/can be called before the 
intel_hdmi_destroy function? Sounds odd. I would expect that the 
connectors are destroyed before the encoders.

In any case, I am happy to try it in another destroy hook, but I need
advice which hook I should use and how I get to the cec_notifier from
whatever structure pointer I have in that destroy hook.

I tried to figure it out, but I became very confused :-)

Regards,

	Hans