Bug report: mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy due to race condition

Bug report: mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy due to race condition

[sicong]

mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy due to race condition

In mdp5_crtc_init, &mdp5_crtc->unref_cursor_work is bound with 
unref_cursor_worker. This work will be commited by drm_flip_work_commit 
located in mdp5_crtc_vblank_irq.

If we call mdp5_crtc_destroy to make cleanup, there may be a unfinished work. 
This function will call drm_flip_work_cleanup to destroy resources allocated 
for the flip-work. However, drm_flip_work_cleanup works as following:
WARN_ON(!list_empty(&work->queued) || !list_empty(&work->commited));

After mdp5_crtc_destroy call kfree to release the object "mdp5_crtc", 
&mdp5_crtc->unref_cursor_work will get use-after-free error.

CPU 0                          	        CPU 1
                                           |	unref_cursor_worker
mdp5_crtc_destroy            |
kfree(mdp5_crtc)  (free)    |
                                           |	get_kms(&mdp5_crtc->base) (use)

This bug may be fixed by adding the following instructions in drm_flip_work_cleanup.
flush_work(&mdp5_crtc->unref_cursor_work)

Best regards,
Sicong Huang