Re: [PATCH v2] drm/omap: dsi: do not copy isr table

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missed fix / Use-After-Free in fbdev omapfb driver
--

commit 84bfbe9de64eb5f62f575283f7f6c859c07c8287
Author: Andreas Kemnade <andreas@kemnade.info>

drm/omap: dsi: do not copy isr table

This commit stops copying the ISR table in the OMAP DSI interrupt handler
to prevent potential use-after-free vulnerabilities. By directly handling
ISRs with the original table, it avoids accessing stack-allocated objects
that might have been unregistered and destroyed.

> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
> index 27fe7bca9e2cf..70cfb779d6ae5 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.c
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
> @@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
>  		timer_delete(&dsi->te_timer);
>  #endif
>  
> -	/* make a copy and unlock, so that isrs can unregister
> -	 * themselves */
> -	memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
> -		sizeof(dsi->isr_tables));
> +	dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);

[Severity: High]
This is a pre-existing issue, but does the same vulnerability still exist
in the fbdev omapfb driver?

Looking at drivers/video/fbdev/omap2/omapfb/dss/dsi.c in omap_dsi_irq_handler(),
it still contains the copied table pattern:

	/* make a copy and unlock, so that isrs can unregister
	 * themselves */
	memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
		sizeof(dsi->isr_tables));

	spin_unlock(&dsi->irq_lock);

	dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);

If a timed-out waiter unregisters its ISR and its on-stack completion object
is destroyed, could the interrupt handler still access it via the copied
isr_tables_copy table?

Should this fix be applied to the fbdev driver as well?

>  
>  	spin_unlock(&dsi->irq_lock);
>  
> -	dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
> -
>  	dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus);
>  
>  	dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-dsi-uaf-v2-1-dbb4aa0f0b8e@kemnade.info?part=1