mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy due to race condition
In mdp5_crtc_init, &mdp5_crtc->unref_cursor_work is bound with
unref_cursor_worker. This work will be commited by drm_flip_work_commit
located in mdp5_crtc_vblank_irq.
If we call mdp5_crtc_destroy to make cleanup, there may be a unfinished work.
This function will call drm_flip_work_cleanup to destroy resources allocated
for the flip-work. However, drm_flip_work_cleanup works as following:
WARN_ON(!list_empty(&work->queued) || !list_empty(&work->commited));
After mdp5_crtc_destroy call kfree to release the object "mdp5_crtc",
&mdp5_crtc->unref_cursor_work will get use-after-free error.
CPU 0 CPU 1
| unref_cursor_worker
mdp5_crtc_destroy |
kfree(mdp5_crtc) (free) |
| get_kms(&mdp5_crtc->base) (use)
This bug may be fixed by adding the following instructions in drm_flip_work_cleanup.
flush_work(&mdp5_crtc->unref_cursor_work)
Best regards,
Sicong Huang