Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2438003 authored by Venkata Prahlad Valluru's avatar Venkata Prahlad Valluru Committed by shaohanlin
Browse files

gpu: drm: msm: add event to event_list after register is successful 



Add event to event_list after msm_register_event is successful to avoid
use-after-free vulnerability.

Change-Id: I34fb39c99051978cbab64a852851964691a5ea9e
Signed-off-by: default avatarPing Li <pingli@codeaurora.org>
Signed-off-by: default avatarVenkata Prahlad Valluru <vvalluru@codeaurora.org>
parent 030346b1

drivers/gpu/drm/msm/msm_drv.c

+12 −9
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.

 * Copyright (c) 2016-2018, 2020 The Linux Foundation. All rights reserved.

 * Copyright (C) 2013 Red Hat

 * Author: Rob Clark <robdclark@gmail.com>

 *
@@ -1295,24 +1295,27 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data, 
	 * calls add to client list and return.

	 */

	count = msm_event_client_count(dev, req_event, false);

	if (count) {

		/* Add current client to list */

		spin_lock_irqsave(&dev->event_lock, flag);

		list_add_tail(&client->base.link, &priv->client_event_list);

		spin_unlock_irqrestore(&dev->event_lock, flag);



	if (count)

		return 0;

	}



	ret = msm_register_event(dev, req_event, file, true);

	if (ret) {

		DRM_ERROR("failed to enable event %x object %x object id %d\n",

			req_event->event, req_event->object_type,

			req_event->object_id);

		kfree(client);

	} else {

		/* Add current client to list */

		spin_lock_irqsave(&dev->event_lock, flag);

		list_del(&client->base.link);

		list_add_tail(&client->base.link, &priv->client_event_list);

		spin_unlock_irqrestore(&dev->event_lock, flag);

		kfree(client);

	}



	return ret;

}