tegra_drm_ioctl_channel_open() stores a new context in fpriv->contexts
before setting context->client and initializing context->mappings.
Another thread sharing the DRM file can guess the context ID and issue
CHANNEL_MAP before CHANNEL_OPEN returns. For example, the first allocated
ID in an empty context array is 1. The mapping path can then dereference
an uninitialized client pointer or use the mappings array before it has
been initialized. CHANNEL_CLOSE can also free the context before the open
path finishes writing those fields.

Initialize the fields before xa_alloc() makes the context visible to the
other channel ioctls.

Fixes: d7c591bc1a3f ("drm/tegra: Implement new UAPI")
Reported-by: Changyul Lee <lcy8047@gmail.com>
Assisted-by: LLM
Signed-off-by: Sang-Hoon Choi <csh0052@gmail.com>
---
Found during source review at mainline
5dd1818b15d98d4a20806cd00b1b40320b06004f. The affected source is unchanged
at 93f51579e7df248780214094418f205253383cc5.

The modified uapi.o compiled in an x86 allmodconfig build. I have not
tested this on Tegra hardware and do not have a runtime sanitizer trace.
This concerns the UAPI guarded by CONFIG_DRM_TEGRA_STAGING.

 drivers/gpu/drm/tegra/uapi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/tegra/uapi.c b/drivers/gpu/drm/tegra/uapi.c
index c0ac6b45f..1dec2f0ab 100644
--- a/drivers/gpu/drm/tegra/uapi.c
+++ b/drivers/gpu/drm/tegra/uapi.c
@@ -135,14 +135,14 @@ int tegra_drm_ioctl_channel_open(struct drm_device *drm, void *data, struct drm_
 		}
 	}
 
+	context->client = client;
+	xa_init_flags(&context->mappings, XA_FLAGS_ALLOC1);
+
 	err = xa_alloc(&fpriv->contexts, &args->context, context, XA_LIMIT(1, U32_MAX),
 		       GFP_KERNEL);
 	if (err < 0)
 		goto put_memctx;
 
-	context->client = client;
-	xa_init_flags(&context->mappings, XA_FLAGS_ALLOC1);
-
 	args->version = client->version;
 	args->capabilities = 0;