Linux Virtualization - Sep 2018 - [PATCH v2 00/12] remove_conflicting_framebuffers() cleanup

On Fri, Aug 31, 2018 at 10:07:42AM +0100, Chris Wilson wrote:
[...]
> Ahah, someone is looking at remove_conflicting_framebuffers(). May I
> interest you in a use-after-free?
> [  378.423513] stack segment: 0000 [#1] PREEMPT SMP PTI
> [  378.423530] CPU: 1 PID: 4338 Comm: pm_rpm Tainted: G     U           
4.19.0-rc1-CI-CI_DRM_4746+ #1
> [  378.423548] Hardware name: To Be Filled By O.E.M. To Be Filled By
O.E.M./J4205-ITX, BIOS P1.10 09/29/2016
> [  378.423570] RIP: 0010:do_remove_conflicting_framebuffers+0x56/0x170
> [  378.423587] Code: 49 8b 45 00 48 85 c0 74 50 f6 40 0a 08 74 4a 4d 85 e4
48 8b a8 78 04 00 00 74 1f 48 85 ed 74 1a 41 8b 0c 24 31 db 85 c9 74 10
<8b> 55 00 85 d2 75 42 83 c3 01 41 39 1c 24 77 f0 48 85 ed 74 1a 45
> [  378.423620] RSP: 0018:ffffc900001dfa88 EFLAGS: 00010202
> [  378.423632] RAX: ffff880274470008 RBX: 0000000000000000 RCX:
0000000000000001
> [  378.423646] RDX: 0000000000000001 RSI: ffffffffa025c634 RDI:
ffff88025cc3b428
> [  378.423660] RBP: 6b6b6b6b6b6b6b6b R08: 000000001edaddfa R09:
ffffffffa025c634
> [  378.423673] R10: ffffc900001dfae8 R11: ffffffff820de938 R12:
ffff88025cc3b428
> [  378.423687] R13: ffffffff8234ca20 R14: ffffffff8234cb20 R15:
0000000000000001
> [  378.423701] FS:  00007fcf03d0a980(0000) GS:ffff880277e80000(0000)
knlGS:0000000000000000
> [  378.423717] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  378.423729] CR2: 00007fffece1fdb8 CR3: 00000001fe32e000 CR4:
00000000003406e0
> [  378.423742] Call Trace:
> [  378.423756]  remove_conflicting_framebuffers+0x28/0x40
> [  378.423856]  i915_driver_load+0x7f5/0x10c0 [i915]
[...]

Looks like registered_fb[] entry is pointing to (partially?) freed or
corrupted fb_info, but I can't see how this could be an effect of
remove_conflicting_framebuffers().

Best Regards,
Micha? Miros?aw