From: jsg <jsg@openbsd.org>
Date: Mon, 17 Apr 2023 05:15:40 +0000 (+0000)
Subject: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=024fc4f9bc02c5fdcc339d8d38394321cc75cb69;p=openbsd

drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

From Min Li
240b1502708858b5e3f10b6dc5ca3f148a322fef in linux-6.1.y/6.1.24
dc30c011469165d57af9adac5baff7d767d20e5c in mainline linux
---

diff --git a/sys/dev/pci/drm/i915/i915_perf.c b/sys/dev/pci/drm/i915/i915_perf.c
index 5953e29d245..015d953c266 100644
--- a/sys/dev/pci/drm/i915/i915_perf.c
+++ b/sys/dev/pci/drm/i915/i915_perf.c
@@ -4316,13 +4316,13 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, void *data,
 		err = oa_config->id;
 		goto sysfs_err;
 	}
-
-	mutex_unlock(&perf->metrics_lock);
+	id = oa_config->id;
 
 	drm_dbg(&perf->i915->drm,
 		"Added config %s id=%i\n", oa_config->uuid, oa_config->id);
+	mutex_unlock(&perf->metrics_lock);
 
-	return oa_config->id;
+	return id;
 
 sysfs_err:
 	mutex_unlock(&perf->metrics_lock);