drm/panfrost: Fix GEM handle creation ref-counting

stable inclusion
from stable-v5.10.163
commit 0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PJ9N

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c



----------------------------------------------------

[ Upstream commit 4217c6ac ]

panfrost_gem_create_with_handle() previously returned a BO but with the
only reference being from the handle, which user space could in theory
guess and release, causing a use-after-free. Additionally if the call to
panfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then
a(nother) reference on the BO was dropped.

The _create_with_handle() is a problematic pattern, so ditch it and
instead create the handle in panfrost_ioctl_create_bo(). If the call to
panfrost_gem_mapping_get() fails then this means that user space has
indeed gone behind our back and freed the handle. In which case just
return an error code.

Reported-by: Rob Clark <robdclark@chromium.org>
Fixes: f3ba9122 ("drm/panfrost: Add initial panfrost driver")
Signed-off-by: Steven Price <steven.price@arm.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221219140130.410578-1-steven.price@arm.com


Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: zhaoxiaoqiang11 <zhaoxiaoqiang11@jd.com>