On 6/28/22 15:31, Robin Murphy wrote: > [ 100.511411] > ================================================================== > [ 100.511419] BUG: KASAN: use-after-free in irq_work_single+0xa4/0x110 > [ 100.511445] Write of size 4 at addr ffff0000107f5830 by task > glmark2-es2-drm/280 > [ 100.511458] > [ 100.511464] CPU: 1 PID: 280 Comm: glmark2-es2-drm Not tainted > 5.19.0-rc3+ #400 > [ 100.511479] Hardware name: ARM LTD ARM Juno Development Platform/ARM > Juno Development Platform, BIOS EDK II Sep 3 2019 > [ 100.511489] Call trace: > [ 100.511494] dump_backtrace+0x1e4/0x1f0 > [ 100.511512] show_stack+0x20/0x70 > [ 100.511523] dump_stack_lvl+0x8c/0xb8 > [ 100.511543] print_report+0x16c/0x668 > [ 100.511559] kasan_report+0x80/0x208 > [ 100.511574] kasan_check_range+0x100/0x1b8 > [ 100.511590] __kasan_check_write+0x34/0x60 > [ 100.511607] irq_work_single+0xa4/0x110 > [ 100.511619] irq_work_run_list+0x6c/0x88 > [ 100.511632] irq_work_run+0x28/0x48 > [ 100.511644] ipi_handler+0x254/0x468 > [ 100.511664] handle_percpu_devid_irq+0x11c/0x518 > [ 100.511681] generic_handle_domain_irq+0x50/0x70 > [ 100.511699] gic_handle_irq+0xd4/0x118 > [ 100.511711] call_on_irq_stack+0x2c/0x58 > [ 100.511725] do_interrupt_handler+0xc0/0xc8 > [ 100.511741] el1_interrupt+0x40/0x68 > [ 100.511754] el1h_64_irq_handler+0x18/0x28 > [ 100.511767] el1h_64_irq+0x64/0x68 > [ 100.511778] irq_work_queue+0xc0/0xd8 > [ 100.511790] drm_sched_entity_fini+0x2c4/0x3b0 > [ 100.511805] drm_sched_entity_destroy+0x2c/0x40 > [ 100.511818] panfrost_job_close+0x44/0x1c0 > [ 100.511833] panfrost_postclose+0x38/0x60 > [ 100.511845] drm_file_free.part.0+0x33c/0x4b8 > [ 100.511862] drm_close_helper.isra.0+0xc0/0xd8 > [ 100.511877] drm_release+0xe4/0x1e0 > [ 100.511891] __fput+0xf8/0x390 > [ 100.511904] ____fput+0x18/0x28 > [ 100.511917] task_work_run+0xc4/0x1e0 > [ 100.511929] do_exit+0x554/0x1168 > [ 100.511945] do_group_exit+0x60/0x108 > [ 100.511960] __arm64_sys_exit_group+0x34/0x38 > [ 100.511977] invoke_syscall+0x64/0x180 > [ 100.511993] el0_svc_common.constprop.0+0x13c/0x170 > [ 100.512012] do_el0_svc+0x48/0xe8 > [ 100.512028] el0_svc+0x5c/0xe0 > [ 100.512038] el0t_64_sync_handler+0xb8/0xc0 > [ 100.512051] el0t_64_sync+0x18c/0x190 > [ 100.512064] This one shall be fixed by [1] that is not in the RC kernel yet, please use linux-next. [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?h=next-20220628&id=7d64c40a7d96190d9d06e240305389e025295916 -- Best regards, Dmitry
