Arm Mali CSF kbase_kcpu_command_queue Use-After-Free
Posted by deepcore on February 28, 2023 – 7:24 am
kbase_csf_kcpu_queue_enqueue() locks the kctx->csf.kcpu_queues, looks up a pointer from inside that structure, then drops the lock before continuing to use the kbase_kcpu_command_queue that was looked up. This is a classic use-after-free pattern, where the lookup of a pointer is protected but the protective lock is then released without first acquiring any other lock or reference to keep the referenced object alive.
Post a reply
You must be logged in to post a comment.