On Thu, 02 Jul 2026 16:05:40 +0000 [email protected] wrote: > [Severity: High] > This isn't a bug introduced by this patch, but it appears the identical > use-after-free vulnerability you are fixing here remains unpatched in the > equivalent DRM driver. > > Does drivers/gpu/drm/omapdrm/dss/dsi.c:omap_dsi_irq_handler() need the same > fix? It still copies the table and drops the lock: > > drivers/gpu/drm/omapdrm/dss/dsi.c:omap_dsi_irq_handler() { > ... > memcpy(&dsi->isr_tables_copy, &dsi->isr_tables, sizeof(dsi->isr_tables)); > spin_unlock(&dsi->irq_lock); > dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus); > ... > } > > This could still race with a timeout in dsi_sync_vc_vp(), which creates a > completion on the stack: > > drivers/gpu/drm/omapdrm/dss/dsi.c:dsi_sync_vc_vp() { > DECLARE_COMPLETION_ONSTACK(completion); > ... > }
Enitities with access to cerebral richness can find the link in the patch to the version for the drm driver. Regards, Andreas
