From: sicong <congei42@163.com>
To: robdclark@gmail.com, quic_abhinavk@quicinc.com,
dmitry.baryshkov@linaro.org, sean@poorly.run, airlied@gmail.com,
daniel@ffwll.ch
Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Bug report: mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy due to race condition
Date: Mon, 15 Apr 2024 16:52:41 +0800 (CST) [thread overview]
Message-ID: <4221f7a6.ce68.18ee0f5636b.Coremail.congei42@163.com> (raw)
mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy due to race condition
In mdp5_crtc_init, &mdp5_crtc->unref_cursor_work is bound with
unref_cursor_worker. This work will be commited by drm_flip_work_commit
located in mdp5_crtc_vblank_irq.
If we call mdp5_crtc_destroy to make cleanup, there may be a unfinished work.
This function will call drm_flip_work_cleanup to destroy resources allocated
for the flip-work. However, drm_flip_work_cleanup works as following:
WARN_ON(!list_empty(&work->queued) || !list_empty(&work->commited));
After mdp5_crtc_destroy call kfree to release the object "mdp5_crtc",
&mdp5_crtc->unref_cursor_work will get use-after-free error.
CPU 0 CPU 1
| unref_cursor_worker
mdp5_crtc_destroy |
kfree(mdp5_crtc) (free) |
| get_kms(&mdp5_crtc->base) (use)
This bug may be fixed by adding the following instructions in drm_flip_work_cleanup.
flush_work(&mdp5_crtc->unref_cursor_work)
Best regards,
Sicong Huang
reply other threads:[~2024-04-15 8:53 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4221f7a6.ce68.18ee0f5636b.Coremail.congei42@163.com \
--to=congei42@163.com \
--cc=airlied@gmail.com \
--cc=daniel@ffwll.ch \
--cc=dmitry.baryshkov@linaro.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=quic_abhinavk@quicinc.com \
--cc=robdclark@gmail.com \
--cc=sean@poorly.run \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.