On Mon, 29 Jun 2026 16:04:47 +0000
[email protected] wrote:

> > -   if (r < 0)
> > +   if ((!r) && wait_for_completion_timeout(&completion,
> > +                           msecs_to_jiffies(500)) == 0)
> > +           r = -EIO;
> > +
> > +   dsi_unregister_isr_vc(dsi, vc, dsi_completion_handler,
> > +                         &completion, DSI_VC_IRQ_PACKET_SENT);
> > +   if (r)
> >             return r;  
> 
> [Severity: High]
> Could this lead to a stack use-after-free if the timeout is reached?
> 
> The wait_for_completion_timeout() can return 0 (timeout), after which
> dsi_unregister_isr_vc() unregisters the ISR and the function returns,
> destroying the on-stack completion. 
> 
> However, dsi_unregister_isr_vc() doesn't appear to synchronize with the IRQ
> handler. If the hardware IRQ fires right after the timeout and the handler
> executes from its lockless copy of the ISR table, could it call
> dsi_completion_handler() with a dangling pointer to the destroyed stack
> frame?

There are several places in this file having that problem. So it is not new.
I have sent a fix here:

https://lore.kernel.org/lkml/[email protected]/T/#u

Regards,
Andreas

Reply via email to