Subject: CVE-2021-47280: drm: Fix use-after-free read in drm_getunique()

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix use-after-free read in drm_getunique()

There is a time-of-check-to-time-of-use error in drm_getunique() due
to retrieving file_priv->master prior to locking the device's master
mutex.

An example can be seen in the crash report of the use-after-free error
found by Syzbot:
https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803

In the report, the master pointer was used after being freed. This is
because another process had acquired the device's master mutex in
drm_setmaster_ioctl(), then overwrote fpriv->master in
drm_new_set_master(). The old value of fpriv->master was subsequently
freed before the mutex was unlocked.

To fix this, we lock the device's master mutex before retrieving the
pointer from from fpriv->master. This patch passes the Syzbot
reproducer test.

The Linux kernel CVE team has assigned CVE-2021-47280 to this issue.

Affected and fixed versions
===========================

	Fixed in 4.14.237 with commit 17dab9326ff2
	Fixed in 4.19.195 with commit 7d233ba700ce
	Fixed in 5.4.126 with commit b246b4c70c12
	Fixed in 5.10.44 with commit 491d52e00788
	Fixed in 5.12.11 with commit f773f8cccac1
	Fixed in 5.13 with commit b436acd1cf7f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47280
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/drm_ioctl.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/17dab9326ff263c62dab1dbac4492e2938a049e4
	https://git.kernel.org/stable/c/7d233ba700ceb593905ea82b42dadb4ec8ef85e9
	https://git.kernel.org/stable/c/b246b4c70c1250e7814f409b243000f9c0bf79a3
	https://git.kernel.org/stable/c/491d52e0078860b33b6c14f0a7ac74ca1b603bd6
	https://git.kernel.org/stable/c/f773f8cccac13c7e7bbd9182e7996c727742488e
	https://git.kernel.org/stable/c/b436acd1cf7fac0ba987abd22955d98025c80c2b