Local privilege escalation via DRM object use-after-free

Use-after-free in Linux kernel 5.5 through 5.15.4 allows local users to corrupt kernel memory through DRM PRIME mmap operations. drm_gem_ttm_mmap drops the last GEM-object reference before its caller reacquires it, so a refcount of one frees the object before drm_gem_object_get accesses it. Access to an affected DRM render or primary node enables kernel-memory disclosure, arbitrary kernel writes, privilege escalation, or a host panic.