drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

From Min Li
240b1502708858b5e3f10b6dc5ca3f148a322fef in linux-6.1.y/6.1.24
dc30c011469165d57af9adac5baff7d767d20e5c in mainline linux

diff --git a/sys/dev/pci/drm/i915/i915_perf.c b/sys/dev/pci/drm/i915/i915_perf.c
index 5953e29..015d953 100644 (file)
--- a/sys/dev/pci/drm/i915/i915_perf.c
+++ b/sys/dev/pci/drm/i915/i915_perf.c
@@ -4316,13 +4316,13 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, void *data,
                err = oa_config->id;
                goto sysfs_err;
        }
-
-       mutex_unlock(&perf->metrics_lock);
+       id = oa_config->id;
 
        drm_dbg(&perf->i915->drm,
                "Added config %s id=%i\n", oa_config->uuid, oa_config->id);
+       mutex_unlock(&perf->metrics_lock);
 
-       return oa_config->id;
+       return id;
 
 sysfs_err:
        mutex_unlock(&perf->metrics_lock);