CVE-2022-1280

concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources

References

• https://www.openwall.com/lists/oss-security/2022/04/12/3
• https://bugzilla.redhat.com/show_bug.cgi?id=2071022
• https://bugzilla.suse.com/show_bug.cgi?id=1197914
• https://www.openwall.com/lists/oss-security/2022/04/12/4

Notes

 carnil> Not a problem on 5.15.y and newer, but the list of commits need
 carnil> to be isolated yet.
 carnil> Is the main fix 56f0729a510f ("drm: protect drm_master pointers
 carnil> in drm_lease.c")? Situation though is not very clear and what
 carnil> exactly is needed.
 bwh> I think most of these are fixing similar races even if some are not
 bwh> needed for the specific race in the description.  I don't think it
 bwh> makes any sense to backport them selectively.

Bugs

Status