drm DevRegister Race

Vulnerability analysis

When a DRM device's registration fails after one device node has already been created (for example, the render node succeeds but the primary node fails), the error cleanup path tears down device resources without first marking the device as unplugged or waiting for any in-flight operations to finish. A local user who opened the already-registered device node during this brief window can have an ioctl in progress that accesses device memory while the cleanup path frees it, leading to a use-after-free. The fix introduces a synchronization step on the registration error path that marks the device as unplugged and waits for all in-flight critical sections to complete before any cleanup begins. This race is reachable by any local user who can open a DRM render node, and the registration failure can be triggered by hotplugging a malicious USB GPU device or by a driver encountering an error during initialization.