On Sun, Mar 1, 2015 at 1:00 PM, Linus Torvalds wrote: > > Back to the drawing board. Ok, many hours later, but I found it. The bisection was a disaster, having to work around other bugs in this area, but it ended up getting "close enough" that I figured out what went wrong. The "intel_plane_duplicate_state()" is horribly horribly buggy. It looks at the state->fb pointer, but it may have been free'd already. This workaround "works for me", but it's really still very questionable, because while the "kref_get_unless_zero()" works correctly when the last reference has been dropped, I'm not sure that there is any guarantee that the whole allocation even exists any more, so I think the *correct* thing to do would be to clear state->fb when dropping the kref. But this was the smallest working patch I could come up with. Somebody who actually knows the code should start looking at the places that do drm_framebuffer_unreference(), and actually clear that pointer instead. Added Matt Roper and Ander Conselvan de Oliveira to the discussion, since they are the ones git says are involved with the original broken intel_plane_duplicate_state(). Anyway, attached is (a) the patch with a big comment (b) the warnings I get on that machine that show where this problem triggers (and another warning earlier). Comments? I'm sure this probably only triggers with *old* X servers that don't do all the modern dri stuff. Linus