On Thu, Jul 02, 2026 at 05:27:11PM +0200, Andreas Kemnade wrote:
> To te able to unregister stuff from isrs, the corresponding table was
> copied. Nobody seems to unregister stuff that way, so it does not help.
> But there are stack-allocated objects passed to these isrs giving chances
> of UAF of these objects if irqs are unregistered while they are handled,
> so better do not copy that table.
>
> Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
> Signed-off-by: Andreas Kemnade <[email protected]>
a friendly ping... the corresponding fix in the old fb code already was
accepted.
Regards,
Andreas
> ---
> If this gets backported, it should be re-checked that
> no isr unregisters itself in older kernel versions`.
> ---
> Changes in v2:
> - remove variable definition (Sashiko)
> - Link to v1:
> https://patch.msgid.link/[email protected]
>
> To: Tomi Valkeinen <[email protected]>
> To: Maarten Lankhorst <[email protected]>
> To: Maxime Ripard <[email protected]>
> To: Thomas Zimmermann <[email protected]>
> To: David Airlie <[email protected]>
> To: Simona Vetter <[email protected]>
> Cc: Tomi Valkeinen <[email protected]>
> Cc: [email protected]
> Cc: [email protected]
> ---
> drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +------
> drivers/gpu/drm/omapdrm/dss/dsi.h | 2 --
> 2 files changed, 1 insertion(+), 8 deletions(-)
>
> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c
> b/drivers/gpu/drm/omapdrm/dss/dsi.c
> index 27fe7bca9e2c..70cfb779d6ae 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.c
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
> @@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void
> *arg)
> timer_delete(&dsi->te_timer);
> #endif
>
> - /* make a copy and unlock, so that isrs can unregister
> - * themselves */
> - memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
> - sizeof(dsi->isr_tables));
> + dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);
>
> spin_unlock(&dsi->irq_lock);
>
> - dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
> -
> dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus);
>
> dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus);
> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.h
> b/drivers/gpu/drm/omapdrm/dss/dsi.h
> index 601707c0ecc4..2b25247ea893 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.h
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.h
> @@ -379,8 +379,6 @@ struct dsi_data {
>
> spinlock_t irq_lock;
> struct dsi_isr_tables isr_tables;
> - /* space for a copy used by the interrupt handler */
> - struct dsi_isr_tables isr_tables_copy;
>
> int update_vc;
> #ifdef DSI_PERF_MEASURE
>
> ---
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
> change-id: 20260629-dsi-uaf-71bfbf3553bf
>
> Best regards,
> --
> Andreas Kemnade <[email protected]>
>
>
