On Mon, 29 Jun 2026 16:04:47 +0000 [email protected] wrote: > > - if (r < 0) > > + if ((!r) && wait_for_completion_timeout(&completion, > > + msecs_to_jiffies(500)) == 0) > > + r = -EIO; > > + > > + dsi_unregister_isr_vc(dsi, vc, dsi_completion_handler, > > + &completion, DSI_VC_IRQ_PACKET_SENT); > > + if (r) > > return r; > > [Severity: High] > Could this lead to a stack use-after-free if the timeout is reached? > > The wait_for_completion_timeout() can return 0 (timeout), after which > dsi_unregister_isr_vc() unregisters the ISR and the function returns, > destroying the on-stack completion. > > However, dsi_unregister_isr_vc() doesn't appear to synchronize with the IRQ > handler. If the hardware IRQ fires right after the timeout and the handler > executes from its lockless copy of the ISR table, could it call > dsi_completion_handler() with a dangling pointer to the destroyed stack > frame?
There are several places in this file having that problem. So it is not new. I have sent a fix here: https://lore.kernel.org/lkml/[email protected]/T/#u Regards, Andreas
