Arm Mali CSF KBASE_REG_NO_USER_FREE Unsafe Use Use-After-Free
Posted by deepcore on January 10, 2023 – 11:13 pm
The Mali driver tries to use the KBASE_REG_NO_USER_FREE flag to ensure that the memory region referenced by kbase_csf_tiler_heap::buf_desc_reg cannot be freed by userspace. However, this flag is only a single bit, and there can be multiple tiler heaps referencing the same memory region. This can lead to a use-after-free condition.
Post a reply
You must be logged in to post a comment.