From: jsg <jsg@openbsd.org>
Date: Wed, 5 Jul 2023 10:41:57 +0000 (+0000)
Subject: drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=4533a3730147b595828827b8c19605c3db9f63d2;p=openbsd

drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl

From Min Li
1af1cd7be370b08694d8752c97325fe51fdab6aa in linux-6.1.y/6.1.36
982b173a6c6d9472730c3116051977e05d17c8c5 in mainline linux
---

diff --git a/sys/dev/pci/drm/radeon/radeon_gem.c b/sys/dev/pci/drm/radeon/radeon_gem.c
index 2b87603671d..f6e6f496d01 100644
--- a/sys/dev/pci/drm/radeon/radeon_gem.c
+++ b/sys/dev/pci/drm/radeon/radeon_gem.c
@@ -552,7 +552,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
 	struct radeon_device *rdev = dev->dev_private;
 	struct drm_radeon_gem_set_domain *args = data;
 	struct drm_gem_object *gobj;
-	struct radeon_bo *robj;
 	int r;
 
 	/* for now if someone requests domain CPU -
@@ -565,13 +564,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
 		up_read(&rdev->exclusive_lock);
 		return -ENOENT;
 	}
-	robj = gem_to_radeon_bo(gobj);
 
 	r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain);
 
 	drm_gem_object_put(gobj);
 	up_read(&rdev->exclusive_lock);
-	r = radeon_gem_handle_lockup(robj->rdev, r);
+	r = radeon_gem_handle_lockup(rdev, r);
 	return r;
 }