mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-30 16:53:20 -04:00
drm/omap: dsi: Do not copy isr table
To be able to unregister stuff from isrs, the corresponding table was
copied. Nobody seems to unregister stuff that way, so it does not help.
But there are stack-allocated objects passed to these isrs giving chances
of UAF of these objects if irqs are unregistered while they are handled,
so better do not copy that table.
Fixes: 4ae2ddddf4 ("OMAP: DSS2: DSI: Add ISR support")
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20260702-dsi-uaf-v2-1-dbb4aa0f0b8e@kemnade.info
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
This commit is contained in:
committed by
Tomi Valkeinen
parent
44e9eb5a76
commit
97c03b32b2
@@ -456,15 +456,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
|
||||
timer_delete(&dsi->te_timer);
|
||||
#endif
|
||||
|
||||
/* make a copy and unlock, so that isrs can unregister
|
||||
* themselves */
|
||||
memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
|
||||
sizeof(dsi->isr_tables));
|
||||
dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);
|
||||
|
||||
spin_unlock(&dsi->irq_lock);
|
||||
|
||||
dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
|
||||
|
||||
dsi_handle_irq_errors(dsi, irqstatus, vcstatus, ciostatus);
|
||||
|
||||
dsi_collect_irq_stats(dsi, irqstatus, vcstatus, ciostatus);
|
||||
|
||||
@@ -379,8 +379,6 @@ struct dsi_data {
|
||||
|
||||
spinlock_t irq_lock;
|
||||
struct dsi_isr_tables isr_tables;
|
||||
/* space for a copy used by the interrupt handler */
|
||||
struct dsi_isr_tables isr_tables_copy;
|
||||
|
||||
int update_vc;
|
||||
#ifdef DSI_PERF_MEASURE
|
||||
|
||||
Reference in New Issue
Block a user