From mboxrd@z Thu Jan  1 00:00:00 1970
From: Chris Wilson <chris@chris-wilson.co.uk>
Subject: Re: [PATCH 02/13] drm/i915: fix invalid reference
	handling of the default ctx obj
Date: Sat, 14 Jul 2012 10:55:19 +0100
Message-ID: <1342259731_7151@CP5-2952>
References: <1342185256-16024-1-git-send-email-chris@chris-wilson.co.uk>
	<1342185256-16024-3-git-send-email-chris@chris-wilson.co.uk>
	<20120713153714.GE5721@phenom.ffwll.local>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org>
Received: from fireflyinternet.com (smtp.fireflyinternet.com [109.228.6.236])
	by gabe.freedesktop.org (Postfix) with ESMTP id 804B49E96C
	for <intel-gfx@lists.freedesktop.org>;
	Sat, 14 Jul 2012 02:55:38 -0700 (PDT)
In-Reply-To: <20120713153714.GE5721@phenom.ffwll.local>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Sender: intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org
Errors-To: intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org
To: Daniel Vetter <daniel@ffwll.ch>
Cc: intel-gfx@lists.freedesktop.org, Ben Widawsky <ben@bwidawsk.net>
List-Id: intel-gfx@lists.freedesktop.org

On Fri, 13 Jul 2012 17:37:14 +0200, Daniel Vetter <daniel@ffwll.ch> wrote:
> On Fri, Jul 13, 2012 at 02:14:05PM +0100, Chris Wilson wrote:
> > Otherwise we end up trying to unpin a freed object and BUG.
> > 
> > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Ben Widawsky <ben@bwidawsk.net>
> 
> Afact this patch contains quite some code refactoring that does not
> relate directly to the fix (or if it does, I fail to see the direct
> relevance). So I think this either needs an explanation in the commit
> message or be put into a separate patch (I agree though for actual code
> cleanups).
> 
> For the fix itself I seem to be a bit dense again - the only thing I see
> is that you move the refcount handling into do_switch. Afacs we do the
> ref-handling in both cases only when do_switch is successful, and also
> right at the end of do_switch (or right afterwards). So can you please
> enlighten your clueless maintainer a bit an explain how things blow up?

The fix is that the reference handling was only done on one path, not
both. Hence the default_ctx ends up being used-after-free.

The rest of it was just unwinding the code to get to finding the bug...
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre