GHSL-2022-037: Use After Free (UAF) in Qualcomm kgsl driver - CVE-2022-22057

long kgsl_ioctl_timeline_fence_get(struct kgsl_device_private *dev_priv,
		unsigned int cmd, void *data)
{
    ...

	fence = kgsl_timeline_fence_alloc(timeline, param->seqno);  //<------ allocate and add `fence` to `timeline`, refcount = 1

	if (IS_ERR(fence)) {
		kgsl_timeline_put(timeline);
		return PTR_ERR(fence);
	}

	fd = get_unused_fd_flags(O_CLOEXEC);
	if (fd < 0) {
		ret = fd;
		goto out;
	}

	sync_file = sync_file_create(fence);   //<--------- `sync_file` increases the refcount of `fence`, refcount = 2
	if (sync_file) {
		fd_install(fd, sync_file->file);
		param->handle = fd;                //<--------- file handle returns to user
	} else {
		put_unused_fd(fd);
		ret = -ENOMEM;
	}

out:
	dma_fence_put(fence);               //<------ refcount of `fence` is 1.
	kgsl_timeline_put(timeline);

	return ret;
}

static void timeline_fence_release(struct dma_fence *fence)
{
	struct kgsl_timeline_fence *f = to_timeline_fence(fence);
	struct kgsl_timeline *timeline = f->timeline;
	struct kgsl_timeline_fence *cur, *temp;
	unsigned long flags;

	spin_lock_irqsave(&timeline->fence_lock, flags);

	/* If the fence is still on the active list, remove it */
	list_for_each_entry_safe(cur, temp, &timeline->fences, node) {
		if (f != cur)
			continue;

		list_del_init(&f->node);
		break;
	}
	spin_unlock_irqrestore(&timeline->fence_lock, flags);
	trace_kgsl_timeline_fence_release(f->timeline->id, fence->seqno);

	kgsl_timeline_put(f->timeline);
	dma_fence_free(fence);
}

long kgsl_ioctl_timeline_destroy(struct kgsl_device_private *dev_priv,
		unsigned int cmd, void *data)
{
	struct kgsl_device *device = dev_priv->device;
	struct kgsl_timeline_fence *fence, *tmp;
	struct kgsl_timeline *timeline;
	struct list_head temp;
	u32 *param = data;

	if (*param == 0)
		return -ENODEV;

	spin_lock(&device->timelines_lock);
	timeline = idr_find(&device->timelines, *param);

	if (timeline == NULL) {
		spin_unlock(&device->timelines_lock);
		return -ENODEV;
	}

	/*
	 * Validate that the id given is owned by the dev_priv
	 * instance that is passed in. If not, abort.
	 */
	if (timeline->dev_priv != dev_priv) {
		spin_unlock(&device->timelines_lock);
		return -EINVAL;
	}

	idr_remove(&device->timelines, timeline->id);
	spin_unlock(&device->timelines_lock);

	INIT_LIST_HEAD(&temp);

	spin_lock(&timeline->fence_lock);                           //<----------- a. triggers before timeline_fence_release removes `fence` from `timeline->fences`
	list_for_each_entry_safe(fence, tmp, &timeline->fences, node)
		dma_fence_get(&fence->base);
	list_replace_init(&timeline->fences, &temp);
	spin_unlock(&timeline->fence_lock);
                                                            //<------------- `timeline_fence_release` tries to remove `fence` from `timeline->fences` but couldn't find it
                                                            //                it then proceeds to and free `fence`
	spin_lock_irq(&timeline->lock);
	list_for_each_entry_safe(fence, tmp, &temp, node) {     //<------------  `use-after-free`
		dma_fence_set_error(&fence->base, -ENOENT);
		dma_fence_signal_locked(&fence->base);
		dma_fence_put(&fence->base);
	}
	spin_unlock_irq(&timeline->lock);

	kgsl_timeline_put(timeline);

	return timeline ? 0 : -ENODEV;
}

struct dma_fence *kgsl_timelines_to_fence_array(struct kgsl_device *device,
		u64 timelines, u32 count, u64 usize, bool any)
{
    ...
	for (i = 0; i < count; i++) {
        ...
		fences[i] = kgsl_timeline_fence_alloc(timeline, val.seqno);  //<------ kgsl_timeline_fence created and adds to timeline
        ...

		uptr += usize;
	}
    ...
err:
	for (i = 0; i < count; i++) {
		if (!IS_ERR_OR_NULL(fences[i]))
			dma_fence_put(fences[i]);          //<-------- this will free fences
	}
    ...
}