CVE-2024-26874

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip<br /> <br /> It&amp;#39;s possible that mtk_crtc-&gt;event is NULL in<br /> mtk_drm_crtc_finish_page_flip().<br /> <br /> pending_needs_vblank value is set by mtk_crtc-&gt;event, but in<br /> mtk_drm_crtc_atomic_flush(), it&amp;#39;s is not guarded by the same<br /> lock in mtk_drm_finish_page_flip(), thus a race condition happens.<br /> <br /> Consider the following case:<br /> <br /> CPU1 CPU2<br /> step 1:<br /> mtk_drm_crtc_atomic_begin()<br /> mtk_crtc-&gt;event is not null,<br /> step 1:<br /> mtk_drm_crtc_atomic_flush:<br /> mtk_drm_crtc_update_config(<br /> !!mtk_crtc-&gt;event)<br /> step 2:<br /> mtk_crtc_ddp_irq -&gt;<br /> mtk_drm_finish_page_flip:<br /> lock<br /> mtk_crtc-&gt;event set to null,<br /> pending_needs_vblank set to false<br /> unlock<br /> pending_needs_vblank set to true,<br /> <br /> step 2:<br /> mtk_crtc_ddp_irq -&gt;<br /> mtk_drm_finish_page_flip called again,<br /> pending_needs_vblank is still true<br /> //null pointer<br /> <br /> Instead of guarding the entire mtk_drm_crtc_atomic_flush(), it&amp;#39;s more<br /> efficient to just check if mtk_crtc-&gt;event is null before use.