Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missed fix / Use-After-Free in fbdev omapfb driver -- commit 84bfbe9de64eb5f62f575283f7f6c859c07c8287 Author: Andreas Kemnade <[email protected]> drm/omap: dsi: do not copy isr table This commit stops copying the ISR table in the OMAP DSI interrupt handler to prevent potential use-after-free vulnerabilities. By directly handling ISRs with the original table, it avoids accessing stack-allocated objects that might have been unregistered and destroyed. > diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c > b/drivers/gpu/drm/omapdrm/dss/dsi.c > index 27fe7bca9e2cf..70cfb779d6ae5 100644 > --- a/drivers/gpu/drm/omapdrm/dss/dsi.c > +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c > @@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void > *arg) > timer_delete(&dsi->te_timer); > #endif > > - /* make a copy and unlock, so that isrs can unregister > - * themselves */ > - memcpy(&dsi->isr_tables_copy, &dsi->isr_tables, > - sizeof(dsi->isr_tables)); > + dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus); [Severity: High] This is a pre-existing issue, but does the same vulnerability still exist in the fbdev omapfb driver? Looking at drivers/video/fbdev/omap2/omapfb/dss/dsi.c in omap_dsi_irq_handler(), it still contains the copied table pattern: /* make a copy and unlock, so that isrs can unregister * themselves */ memcpy(&dsi->isr_tables_copy, &dsi->isr_tables, sizeof(dsi->isr_tables)); spin_unlock(&dsi->irq_lock); dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus); If a timed-out waiter unregisters its ISR and its on-stack completion object is destroyed, could the interrupt handler still access it via the copied isr_tables_copy table? Should this fix be applied to the fbdev driver as well? > > spin_unlock(&dsi->irq_lock); > > - dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus); > - > dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus); > > dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
