DF-4840 / panic.txt
modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled modeuaf: CONTROLLED INDIRECT CALL plane=0xfffff8008f8af4a8 property=0xfffff8008f825748 value=0x0 (freed drm_display_mode block fully chased) modeuaf: verbatim dispatch ret=0 (canary fired above if 0) modeuaf: unloaded: calls=360451521 destroys=10873305 hits=32 modeuaf: sizeof(drm_display_mode)=240 base@+16 off(type)=20 off(props)=24 plane.funcs-off.base=96 modeuaf: target mode id=1 (0xfffff8008d3cdd00) — racing stock drm_mode_obj_set_property_ioctl vs drm_mode_destroy modeuaf: UAF WINDOW HIT (forced): find() returned freed+groomed block; obj->properties attacker-controlled Fatal trap 9: general protection fault while in kernel mode cpuid = 5; lapic id = 5 instruction pointer = 0x8:0xffffffff82634126 stack pointer = 0x10:0xfffff80117a7ba00 frame pointer = 0x10:0xfffff80117a7ba30 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = Idle current thread = pri 12 kernel: type 9 trap, code=0 CPU5 stopping CPUs: 0x0000001f stopped Stopped at drm_mode_plane_set_obj_prop+0x36: ret db>