| Summary: | Use after free in intel_audo_lpe_teardown | ||
|---|---|---|---|
| Product: | DRI | Reporter: | Chris Wilson <chris> |
| Component: | DRM/Intel | Assignee: | Pierre Bossart <pierre-louis.bossart> |
| Status: | CLOSED FIXED | QA Contact: | Intel GFX Bugs mailing list <intel-gfx-bugs> |
| Severity: | normal | ||
| Priority: | medium | CC: | intel-gfx-bugs |
| Version: | XOrg git | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | |||
| i915 platform: | BSW/CHT | i915 features: | display/audio |
|
Description
Chris Wilson
2017-02-24 22:52:59 UTC
Bisect commit eef57324d926f0d8c7a40069e7d26e0cb0651b47 Author: Jerome Anand <jerome.anand@intel.com> Date: Wed Jan 25 04:27:49 2017 +0530 drm/i915: setup bridge for HDMI LPE audio driver Enable support for HDMI LPE audio mode on Baytrail and Cherrytrail when HDaudio controller is not detected Setup minimum required resources during i915_driver_load: 1. Create a platform device to share MMIO/IRQ resources 2. Make the platform device child of i915 device for runtime PM. 3. Create IRQ chip to forward HDMI LPE audio irqs. HDMI LPE audio driver (a standalone sound driver) probes the LPE audio device and creates a new sound card. Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Signed-off-by: Jerome Anand <jerome.anand@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> thanks for bisecting. I can't see any obvious issues so it'll have to be a debug session. would you mind sharing your setup (KConfig options and commands)? diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 7a5b41b1c024..8d800aa60163 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -131,8 +131,8 @@ lpe_audio_platdev_create(struct drm_i915_private *dev_priv)
static void lpe_audio_platdev_destroy(struct drm_i915_private *dev_priv)
{
- platform_device_unregister(dev_priv->lpe_audio.platdev);
kfree(dev_priv->lpe_audio.platdev->dev.dma_mask);
+ platform_device_unregister(dev_priv->lpe_audio.platdev);
}
static void lpe_audio_irq_unmask(struct irq_data *d)
as platdev is freed by the unregister as kasan says.
commit 48ae80741da4b8a26b6df0f765713912bc7cc480 Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Wed Apr 12 09:02:51 2017 +0100 drm/i915: Fix use after free in lpe_audio_platdev_destroy() |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.