In the Linux kernel, the following vulnerability has been resolved:

drm/exynos: vidi: use priv->vididev for ctx lookup in vidiconnectionioctl()

vidiconnectionioctl() retrieves the driverdata from drmdev->dev to obtain a struct vidicontext pointer. However, drmdev->dev is the exynos-drm master device, and the driverdata contained therein is not the vidi component device, but a completely different device.

This can lead to various bugs, ranging from null pointer dereferences and garbage value accesses to, in unlucky cases, out-of-bounds errors, use-after-free errors, and more.

To resolve this issue, we need to store/delete the vidi device pointer in exynosdrmprivate->vididev during bind/unbind, and then read this exynosdrmprivate->vididev within ioctl() to obtain the correct struct vidicontext pointer.