CVE-2022-50417

In the Linux kernel, the following vulnerability has been resolved:

drm/panfrost: Fix GEM handle creation ref-counting

panfrostgemcreatewithhandle() previously returned a BO but with the only reference being from the handle, which user space could in theory guess and release, causing a use-after-free. Additionally if the call to panfrostgemmappingget() in panfrostioctlcreatebo() failed then a(nother) reference on the BO was dropped.

The createwithhandle() is a problematic pattern, so ditch it and instead create the handle in panfrostioctlcreatebo(). If the call to panfrostgemmapping_get() fails then this means that user space has indeed gone behind our back and freed the handle. In which case just return an error code.