[PATCH 1/1] drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

-off-by: Min Li --- drivers/gpu/drm/i915/i915_perf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c index 824a34ec0b83..93748ca2c5da 100644 --- a/drivers/gpu/drm/i915/i915_perf.c +++ b/drivers/gpu/drm

[PATCH] drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl

If it is async, runqueue_node is freed in g2d_runqueue_worker on another worker thread. So in extreme cases, if g2d_runqueue_worker runs first, and then executes the following if statement, there will be use-after-free. Signed-off-by: Min Li --- drivers/gpu/drm/exynos/exynos_drm_g2d.c | 2 +- 1

[PATCH] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl

Userspace can race to free the gobj(robj converted from), robj should not be accessed again after drm_gem_object_put, otherwith it will result in use-after-free. Signed-off-by: Min Li --- drivers/gpu/drm/radeon/radeon_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a

[PATCH v2] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl

Userspace can race to free the gobj(robj converted from), robj should not be accessed again after drm_gem_object_put, otherwith it will result in use-after-free. Signed-off-by: Min Li --- Changes in v2: - Remove unused robj, avoid compile complain drivers/gpu/drm/radeon/radeon_gem.c | 4