Comment # 52
on bug 1151290
from Dr. Werner Fink
Seen USE AFTER FREE at reboott after latest kernel update:
[Sat Mar 14 09:39:09 2020] refcount_t: underflow; use-after-free.
[Sat Mar 14 09:39:09 2020] WARNING: CPU: 7 PID: 1848 at ../lib/refcount.c:28
refcount_warn_saturate+0x8d/0xf0
[Sat Mar 14 09:39:09 2020] Modules linked in: af_packet scsi_transport_iscsi
cmac bnep dmi_sysfs ftsteutates sunrpc btusb btrtl btbcm btintel uvcvideo
bluetoo
th videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev
ecdh_generic mc ecc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel
_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic ledtrig_audio
kvm_intel snd_hda_codec_hdmi kvm snd_hda_intel iTCO_wdt irqbypass iTCO_vendor_s
upport mei_hdcp msr iwlmvm snd_hda_codec snd_hda_core crct10dif_pclmul
snd_hwdep crc32_pclmul ghash_clmulni_intel mac80211 snd_pcm snd_seq libarc4
aesni_intel snd_seq_device iwlwifi snd_timer aes_x86_64 crypto_simd i915 cryptd
glue_helper snd pcspkr cfg80211 mxm_wmi rtsx_pci_ms joydev i2c_i801 soundcore
memstick rfkill mei_me i2c_algo_bit mei thermal battery ac acpi_pad button sg
dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua nvidia_drm(POE)
nvidia_modeset(POE) xfs libcrc32c nvidia_uvm(OE) rtsx_pci_sdmmc nvidia(POE)
mmc_core
[Sat Mar 14 09:39:09 2020] drm_kms_helper drm xhci_pci crc32c_intel xhci_hcd
syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops rtsx_pci sr_mod
ipmi_devintf cdrom usbcore ipmi_msghandler wmi video loop i2c_dev
[Sat Mar 14 09:39:09 2020] CPU: 7 PID: 1848 Comm: X Tainted: P OE
5.3.18-lp152.5-default #1 openSUSE Leap 15.2 (unreleased)
[Sat Mar 14 09:39:09 2020] Hardware name: TUXEDO N15_17RD,RD2
/N15_17RD,RD2 , BIOS 1.05.15 06/06/2016
[Sat Mar 14 09:39:09 2020] RIP: 0010:refcount_warn_saturate+0x8d/0xf0
[Sat Mar 14 09:39:09 2020] Code: 05 37 1f 06 01 01 e8 02 db bb ff 0f 0b c3 80
3d 2a 1f 06 01 00 75 ad 48 c7 c7 88 38 b3 a6 c6 05 1a 1f 06 01 01 e8 e3 da bb
ff <0f> 0b c3 80 3d 0e 1f 06 01 00 75 8e 48 c7 c7 30 38 b3 a6 c6 05 fe
[Sat Mar 14 09:39:09 2020] RSP: 0018:ffffa60f8145fd90 EFLAGS: 00010282
[Sat Mar 14 09:39:09 2020] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000006
[Sat Mar 14 09:39:09 2020] RDX: 0000000000000007 RSI: 0000000000000092 RDI:
ffff970641bd9a10
[Sat Mar 14 09:39:09 2020] RBP: ffff9702c7616ce8 R08: 000000000000036d R09:
0000000000000000
[Sat Mar 14 09:39:09 2020] R10: dead000000000100 R11: 0000000000000001 R12:
0000000000000000
[Sat Mar 14 09:39:09 2020] R13: ffff970636baa800 R14: 0000000000000000 R15:
0000000000000008
[Sat Mar 14 09:39:09 2020] FS: 00007f1be4af8ec0(0000)
GS:ffff970641bc0000(0000) knlGS:0000000000000000
[Sat Mar 14 09:39:09 2020] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Sat Mar 14 09:39:09 2020] CR2: 00007f1be2430ef0 CR3: 0000000460134006 CR4:
00000000003606e0
[Sat Mar 14 09:39:09 2020] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[Sat Mar 14 09:39:09 2020] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[Sat Mar 14 09:39:09 2020] Call Trace:
[Sat Mar 14 09:39:09 2020] nv_drm_atomic_helper_disable_all+0x263/0x2a0
[nvidia_drm]
[Sat Mar 14 09:39:09 2020] nv_drm_master_drop+0x22/0x60 [nvidia_drm]
[Sat Mar 14 09:39:09 2020] drm_drop_master+0x1e/0x30 [drm]
[Sat Mar 14 09:39:09 2020] drm_master_release+0xa0/0xb0 [drm]
[Sat Mar 14 09:39:09 2020] drm_file_free.part.13+0x235/0x290 [drm]
[Sat Mar 14 09:39:09 2020] drm_release+0x9a/0xd0 [drm]
[Sat Mar 14 09:39:09 2020] __fput+0xbe/0x250
[Sat Mar 14 09:39:09 2020] task_work_run+0x9f/0xc0
[Sat Mar 14 09:39:09 2020] exit_to_usermode_loop+0x10d/0x130
[Sat Mar 14 09:39:09 2020] do_syscall_64+0x1cd/0x1f0
[Sat Mar 14 09:39:09 2020] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[Sat Mar 14 09:39:09 2020] RIP: 0033:0x7f1be272cf24
[Sat Mar 14 09:39:09 2020] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7
0f 1f 80 00 00 00 00 8b 05 ca c4 20 00 48 63 ff 85 c0 75 13 b8 03 00 00 00 0f
05 <48> 3d 00 f0 ff ff 77 44 f3 c3 66 90 48 83 ec 18 48 89 7c 24 08 e8
[Sat Mar 14 09:39:09 2020] RSP: 002b:00007ffddc0d8c78 EFLAGS: 00000246
ORIG_RAX: 0000000000000003
[Sat Mar 14 09:39:09 2020] RAX: 0000000000000000 RBX: 000000000000000a RCX:
00007f1be272cf24
[Sat Mar 14 09:39:09 2020] RDX: 0000556d5718a020 RSI: 0000000000000002 RDI:
000000000000000a
[Sat Mar 14 09:39:09 2020] RBP: 0000556d571cb340 R08: 0000556d571c9c80 R09:
0000000000000000
[Sat Mar 14 09:39:09 2020] R10: 0000000000000079 R11: 0000000000000246 R12:
0000556d571e4380
[Sat Mar 14 09:39:09 2020] R13: 0000556d571e44e0 R14: 0000000000000000 R15:
0000000000000000