[PATCH v2] drm/omap: dsi: do not copy isr table

[PATCH v2] drm/omap: dsi: do not copy isr table

[Andreas Kemnade]

To te able to unregister stuff from isrs, the corresponding table was
copied.  Nobody seems to unregister stuff that way, so it does not help.
But there are stack-allocated objects passed to these isrs giving chances
of UAF of these objects if irqs are unregistered while they are handled,
so better do not copy that table.

Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
---
If this gets backported, it should be re-checked that
no isr unregisters itself in older kernel versions`.
---
Changes in v2:
- remove variable definition (Sashiko)
- Link to v1: https://patch.msgid.link/20260629-dsi-uaf-v1-1-a5e894f4e4d1@kemnade.info

To: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
To: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
To: Maxime Ripard <mripard@kernel.org>
To: Thomas Zimmermann <tzimmermann@suse.de>
To: David Airlie <airlied@gmail.com>
To: Simona Vetter <simona@ffwll.ch>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
---
 drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +------
 drivers/gpu/drm/omapdrm/dss/dsi.h | 2 --
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 27fe7bca9e2c..70cfb779d6ae 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
 		timer_delete(&dsi->te_timer);
 #endif
 
-	/* make a copy and unlock, so that isrs can unregister
-	 * themselves */
-	memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
-		sizeof(dsi->isr_tables));
+	dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);
 
 	spin_unlock(&dsi->irq_lock);
 
-	dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
-
 	dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus);
 
 	dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus);
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.h b/drivers/gpu/drm/omapdrm/dss/dsi.h
index 601707c0ecc4..2b25247ea893 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.h
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.h
@@ -379,8 +379,6 @@ struct dsi_data {
 
 	spinlock_t irq_lock;
 	struct dsi_isr_tables isr_tables;
-	/* space for a copy used by the interrupt handler */
-	struct dsi_isr_tables isr_tables_copy;
 
 	int update_vc;
 #ifdef DSI_PERF_MEASURE

---
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
change-id: 20260629-dsi-uaf-71bfbf3553bf

Best regards,
--  
Andreas Kemnade <andreas@kemnade.info>

Re: [PATCH v2] drm/omap: dsi: do not copy isr table

[Andreas Kemnade]

On Thu, Jul 02, 2026 at 05:27:11PM +0200, Andreas Kemnade wrote:
> To te able to unregister stuff from isrs, the corresponding table was
> copied.  Nobody seems to unregister stuff that way, so it does not help.
> But there are stack-allocated objects passed to these isrs giving chances
> of UAF of these objects if irqs are unregistered while they are handled,
> so better do not copy that table.
> 
> Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
> Signed-off-by: Andreas Kemnade <andreas@kemnade.info>

a friendly ping... the corresponding fix in the old fb code already was
accepted.

Regards,
Andreas

> ---
> If this gets backported, it should be re-checked that
> no isr unregisters itself in older kernel versions`.
> ---
> Changes in v2:
> - remove variable definition (Sashiko)
> - Link to v1: https://patch.msgid.link/20260629-dsi-uaf-v1-1-a5e894f4e4d1@kemnade.info
> 
> To: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> To: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> To: Maxime Ripard <mripard@kernel.org>
> To: Thomas Zimmermann <tzimmermann@suse.de>
> To: David Airlie <airlied@gmail.com>
> To: Simona Vetter <simona@ffwll.ch>
> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-kernel@vger.kernel.org
> ---
>  drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +------
>  drivers/gpu/drm/omapdrm/dss/dsi.h | 2 --
>  2 files changed, 1 insertion(+), 8 deletions(-)
> 
> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
> index 27fe7bca9e2c..70cfb779d6ae 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.c
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
> @@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
>  		timer_delete(&dsi->te_timer);
>  #endif
>  
> -	/* make a copy and unlock, so that isrs can unregister
> -	 * themselves */
> -	memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
> -		sizeof(dsi->isr_tables));
> +	dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);
>  
>  	spin_unlock(&dsi->irq_lock);
>  
> -	dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
> -
>  	dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus);
>  
>  	dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus);
> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.h b/drivers/gpu/drm/omapdrm/dss/dsi.h
> index 601707c0ecc4..2b25247ea893 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.h
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.h
> @@ -379,8 +379,6 @@ struct dsi_data {
>  
>  	spinlock_t irq_lock;
>  	struct dsi_isr_tables isr_tables;
> -	/* space for a copy used by the interrupt handler */
> -	struct dsi_isr_tables isr_tables_copy;
>  
>  	int update_vc;
>  #ifdef DSI_PERF_MEASURE
> 
> ---
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
> change-id: 20260629-dsi-uaf-71bfbf3553bf
> 
> Best regards,
> --  
> Andreas Kemnade <andreas@kemnade.info>
> 
> 

Re: [PATCH v2] drm/omap: dsi: do not copy isr table

[Tomi Valkeinen]

Hi,

On 02/07/2026 18:27, Andreas Kemnade wrote:
> To te able to unregister stuff from isrs, the corresponding table was
> copied.  Nobody seems to unregister stuff that way, so it does not help.
> But there are stack-allocated objects passed to these isrs giving chances
> of UAF of these objects if irqs are unregistered while they are handled,
> so better do not copy that table.
> 
> Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
> Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
> ---
> If this gets backported, it should be re-checked that
> no isr unregisters itself in older kernel versions`.
> ---
> Changes in v2:
> - remove variable definition (Sashiko)
> - Link to v1: https://patch.msgid.link/20260629-dsi-uaf-v1-1-a5e894f4e4d1@kemnade.info

Looks good to me, applying to drm-misc-next.

  Tomi

> To: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> To: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> To: Maxime Ripard <mripard@kernel.org>
> To: Thomas Zimmermann <tzimmermann@suse.de>
> To: David Airlie <airlied@gmail.com>
> To: Simona Vetter <simona@ffwll.ch>
> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-kernel@vger.kernel.org
> ---
>   drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +------
>   drivers/gpu/drm/omapdrm/dss/dsi.h | 2 --
>   2 files changed, 1 insertion(+), 8 deletions(-)
> 
> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
> index 27fe7bca9e2c..70cfb779d6ae 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.c
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
> @@ -455,15 +455,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
>   		timer_delete(&dsi->te_timer);
>   #endif
>   
> -	/* make a copy and unlock, so that isrs can unregister
> -	 * themselves */
> -	memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
> -		sizeof(dsi->isr_tables));
> +	dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);
>   
>   	spin_unlock(&dsi->irq_lock);
>   
> -	dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
> -
>   	dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus);
>   
>   	dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus);
> diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.h b/drivers/gpu/drm/omapdrm/dss/dsi.h
> index 601707c0ecc4..2b25247ea893 100644
> --- a/drivers/gpu/drm/omapdrm/dss/dsi.h
> +++ b/drivers/gpu/drm/omapdrm/dss/dsi.h
> @@ -379,8 +379,6 @@ struct dsi_data {
>   
>   	spinlock_t irq_lock;
>   	struct dsi_isr_tables isr_tables;
> -	/* space for a copy used by the interrupt handler */
> -	struct dsi_isr_tables isr_tables_copy;
>   
>   	int update_vc;
>   #ifdef DSI_PERF_MEASURE
> 
> ---
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
> change-id: 20260629-dsi-uaf-71bfbf3553bf
> 
> Best regards,
> --
> Andreas Kemnade <andreas@kemnade.info>
> 

Re: [PATCH v2] drm/omap: dsi: do not copy isr table

[Andreas Kemnade]

On Wed, 29 Jul 2026 11:23:21 +0300
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> wrote:

> Hi,
> 
> On 02/07/2026 18:27, Andreas Kemnade wrote:
> > To te able to unregister stuff from isrs, the corresponding table was
> > copied.  Nobody seems to unregister stuff that way, so it does not help.
> > But there are stack-allocated objects passed to these isrs giving chances
> > of UAF of these objects if irqs are unregistered while they are handled,
> > so better do not copy that table.
> > 
> > Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
> > Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
> > ---
> > If this gets backported, it should be re-checked that
> > no isr unregisters itself in older kernel versions`.
> > ---
> > Changes in v2:
> > - remove variable definition (Sashiko)
> > - Link to v1: https://patch.msgid.link/20260629-dsi-uaf-v1-1-a5e894f4e4d1@kemnade.info  
> 
> Looks good to me, applying to drm-misc-next.
> 
It seems not to be on linux-next. somehow this did fall through the cracks?

Regards,
Andreas

Re: [PATCH v2] drm/omap: dsi: do not copy isr table

[Tomi Valkeinen]

Hi,

On 04/08/2026 11:49, Andreas Kemnade wrote:
> On Wed, 29 Jul 2026 11:23:21 +0300
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> wrote:
> 
>> Hi,
>>
>> On 02/07/2026 18:27, Andreas Kemnade wrote:
>>> To te able to unregister stuff from isrs, the corresponding table was
>>> copied.  Nobody seems to unregister stuff that way, so it does not help.
>>> But there are stack-allocated objects passed to these isrs giving chances
>>> of UAF of these objects if irqs are unregistered while they are handled,
>>> so better do not copy that table.
>>>
>>> Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
>>> Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
>>> ---
>>> If this gets backported, it should be re-checked that
>>> no isr unregisters itself in older kernel versions`.
>>> ---
>>> Changes in v2:
>>> - remove variable definition (Sashiko)
>>> - Link to v1: https://patch.msgid.link/20260629-dsi-uaf-v1-1-a5e894f4e4d1@kemnade.info
>>
>> Looks good to me, applying to drm-misc-next.
>>
> It seems not to be on linux-next. somehow this did fall through the cracks?
It did. I applied it to my local dim branch, then went looking for other 
omapdrm patches (the dsi one), which took a while and... yes, forgot to 
push...

Pushed now to drm-misc-next.

  Tomi