Local privilege escalation via A4xx GPU use-after-free

Use-after-free in Linux kernel 5.11 through 5.14.13 allows local users to gain kernel privileges through the MSM A4xx DRM device. The a4xx_gpu_init function stores the Boolean result of IS_ERR instead of the negative PTR_ERR value, frees the GPU object on failure, and then falsely reports successful initialization. An unprivileged user or Android app must be able to open the MSM DRM render node on an A4xx platform; later load or interrupt handling dereferences the dangling object, enabling kernel memory access, control-flow hijacking, or a kernel panic.