Re: [PATCH v4] drm/omap: dsi: avoid sending bta sync all the time in writes

[Andreas Kemnade <andreas@kemnade.info>]

On Mon, 29 Jun 2026 16:04:47 +0000
sashiko-bot@kernel.org wrote:

> > -	if (r < 0)
> > +	if ((!r) && wait_for_completion_timeout(&completion,
> > +				msecs_to_jiffies(500)) == 0)
> > +		r = -EIO;
> > +
> > +	dsi_unregister_isr_vc(dsi, vc, dsi_completion_handler,
> > +			      &completion, DSI_VC_IRQ_PACKET_SENT);
> > +	if (r)
> >  		return r;  
> 
> [Severity: High]
> Could this lead to a stack use-after-free if the timeout is reached?
> 
> The wait_for_completion_timeout() can return 0 (timeout), after which
> dsi_unregister_isr_vc() unregisters the ISR and the function returns,
> destroying the on-stack completion. 
> 
> However, dsi_unregister_isr_vc() doesn't appear to synchronize with the IRQ
> handler. If the hardware IRQ fires right after the timeout and the handler
> executes from its lockless copy of the ISR table, could it call
> dsi_completion_handler() with a dangling pointer to the destroyed stack
> frame?

There are several places in this file having that problem. So it is not new.
I have sent a fix here:

https://lore.kernel.org/lkml/20260629-dsi-uaf-v1-1-a5e894f4e4d1@kemnade.info/T/#u

Regards,
Andreas