From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.andi.de1.cc (mail.andi.de1.cc [178.238.236.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B79B837A822 for ; Thu, 2 Jul 2026 15:28:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.238.236.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783006086; cv=none; b=JUa/Eg2TfEcMxIhN1wYBVOJ4hJ0azE3kvxocA9F5Ly71m8/g1RyA0LoT4OVmlxLM4SahkowWtrNxk9UhDtCL2yVDTR2jsCyupCnUaBQO2b6nlkqr+9wxiQzKq9Q8jydZQHqCafxtmOG8ZAcHsTA2r/2BPOSy7OmB1ors1Pzarm0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783006086; c=relaxed/simple; bh=VlBhh5GT89LrG7d1fQdNbMdChy0IHhum+QNNLF2uL5g=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=F9O8QwIF1Ra/dZZvmTIBE9gbTz9H/fawZRXJlDoFaD4SVos3HmcYxcFjSaSEna1YMj22nyUoCNl9Znn0FahNQ8vaKXd+Fah5qbJ8axlWn8SYmrNviTHAZ6yDZh3k7qgOw2p0u3WWBxeBAahgPpbUKqoVAqHNYg4bpJ+k58MiUFE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kemnade.info; spf=pass smtp.mailfrom=kemnade.info; dkim=pass (2048-bit key) header.d=kemnade.info header.i=@kemnade.info header.b=mJ2xc0x4; arc=none smtp.client-ip=178.238.236.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kemnade.info Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kemnade.info Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kemnade.info header.i=@kemnade.info header.b="mJ2xc0x4" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=kemnade.info; s=20220719; h=Cc:To:Subject:From:Reply-To:Content-ID: Content-Description:In-Reply-To:References; bh=QyHcD2maUl1+iR/NwYMaR7nRqr2+evGjUhRfjdA4Fcw=; t=1783006084; x=1784215684; b=mJ2xc0x4CyYB7Ekt1ZKu4NwpprN65FFAAnwiv/sW/IUmZ/oJmQTM4VvOnVf9Co5KDeUqoXqgFSo nY47N2pD39ofAg92SfQ/nMNiHpKFH8i5vZVECyfGSX/f3SoIPThCByib4FQslqe1xLmzW3kwoTwCD GCa8uh+DILhiv+j4GN+ytRfvmLuLzBm+ZYbN8m0Gqst/zgo9V7mRTa7EmqZ7t1uShD9sFBCpJl23B N2TEYpO4pau+lH36YxfC/zvnRZ+hFyIfQ9y0O/ekwkUKXTyXaagp6M9HNnyq7vbRtZw/eiww8ZuEN 9LL12DWdxMNxBlcuMEXU1kw04GQMKlA+Qkcg==; From: Andreas Kemnade Date: Thu, 02 Jul 2026 17:27:11 +0200 Subject: [PATCH v2] drm/omap: dsi: do not copy isr table Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260702-dsi-uaf-v2-1-dbb4aa0f0b8e@kemnade.info> X-B4-Tracking: v=1; b=H4sIAE6DRmoC/2WNQQ6CMBBFr0JmbQ0tFIWV9zAsWjojo7GYFoiGc HcLLl2+5P33F4gYGCM02QIBZ448+ATqkEHXG39DwS4xqFxVeaVq4SKLyZA4SUuWCq0LS5DsV0D i9166tj+Ok71jN27zzeg5jkP47Fez3Lz/6iyFFEbjuS6pxNLJywOf3jg8sqcB2nVdv/1Qwp+zA AAA X-Change-ID: 20260629-dsi-uaf-71bfbf3553bf To: Tomi Valkeinen , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Andreas Kemnade , Tomi Valkeinen X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2678; i=andreas@kemnade.info; h=from:subject:message-id; bh=VlBhh5GT89LrG7d1fQdNbMdChy0IHhum+QNNLF2uL5g=; b=owGbwMvMwCUm/rzkS6lq2x3G02pJDFluzRGzJrS+Ps2h91rtb/wtsZS4c2J3jjD0Psxu0dpty RPosLuvo5SFQYyLQVZMkeWXtYLbJ5VnucFTI+xh5rAygQxh4OIUgIkImjP89+CNCLjn1muboqxo v3TCu6lfHhQu2GETfJfbUOuCPGPQGob/eXW2e8+HSsuujtNcmcZa9o69uvxq2pFewdtStw915c3 kAQA= X-Developer-Key: i=andreas@kemnade.info; a=openpgp; fpr=EEC0DB858E66C0DA70620AC07DBD6AC74DE29324 To te able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to these isrs giving chances of UAF of these objects if irqs are unregistered while they are handled, so better do not copy that table. Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support") Signed-off-by: Andreas Kemnade --- If this gets backported, it should be re-checked that no isr unregisters itself in older kernel versions`. --- Changes in v2: - remove variable definition (Sashiko) - Link to v1: https://patch.msgid.link/20260629-dsi-uaf-v1-1-a5e894f4e4d1@kemnade.info To: Tomi Valkeinen To: Maarten Lankhorst To: Maxime Ripard To: Thomas Zimmermann To: David Airlie To: Simona Vetter Cc: Tomi Valkeinen Cc: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org --- drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +------ drivers/gpu/drm/omapdrm/dss/dsi.h | 2 -- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c index 27fe7bca9e2c..70cfb779d6ae 100644 --- a/drivers/gpu/drm/omapdrm/dss/dsi.c +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c @@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg) timer_delete(&dsi->te_timer); #endif - /* make a copy and unlock, so that isrs can unregister - * themselves */ - memcpy(&dsi->isr_tables_copy, &dsi->isr_tables, - sizeof(dsi->isr_tables)); + dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus); spin_unlock(&dsi->irq_lock); - dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus); - dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus); dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus); diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.h b/drivers/gpu/drm/omapdrm/dss/dsi.h index 601707c0ecc4..2b25247ea893 100644 --- a/drivers/gpu/drm/omapdrm/dss/dsi.h +++ b/drivers/gpu/drm/omapdrm/dss/dsi.h @@ -379,8 +379,6 @@ struct dsi_data { spinlock_t irq_lock; struct dsi_isr_tables isr_tables; - /* space for a copy used by the interrupt handler */ - struct dsi_isr_tables isr_tables_copy; int update_vc; #ifdef DSI_PERF_MEASURE --- base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482 change-id: 20260629-dsi-uaf-71bfbf3553bf Best regards, -- Andreas Kemnade