Keith Packard <keithp@xxxxxxxxxx> writes: > When FB_EVENT_FB_UNBIND is sent, fbcon has two paths, one path taken > when there is another frame buffer to switch any affected vcs to and > another path when there isn't. What I meant to attach to this bug report but clearly failed was that I think this case essentially *always* occurs if you have a generic frame buffer driver loaded before a 'real' driver is loaded. In my case, this is efifb. So, we have a reference to freed memory hanging out on a timer list. I'm really unsure why this hasn't caused more grief, but I can say that it was greatly aggravated by adding 'fbcon=vc:2-6' to the kernel command line, which limits fbcon to supporting consoles only on vt 2-6. Definitely one of those 'how could this ever have worked, and why hasn't my machine been crashing every day' moments when I read through the code. As the patch indicates, I'm not sure this patch is actually what we want, but I'd love to know if I've isolated the root cause correctly and then figure out what patch we actually want. For my own part, I've got a happy customer with the patch, which is definitely a nice way to end the day. -- keith.packard@xxxxxxxxx
Attachment:
pgpK09Nol2kWl.pgp
Description: PGP signature
