Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1fb3bd16 authored by Ping Li's avatar Ping Li Committed by Gerrit - the friendly Code Review server
Browse files

disp: msm: sde: add event to event_list after register is successful 



Add event to event_list after msm_register_event is successful to avoid
use-after-free vulnerability.

Change-Id: I144ae82c657c1e2cf16608c0e8768b12a7d27974
Signed-off-by: default avatarPing Li <pingli@codeaurora.org>
parent d0f5c748

msm/msm_drv.c

+5 −5
Original line number Diff line number Diff line
@@ -1336,11 +1336,6 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data, 
	 * calls add to client list and return.

	 */

	count = msm_event_client_count(dev, req_event, false);

	/* Add current client to list */

	spin_lock_irqsave(&dev->event_lock, flag);

	list_add_tail(&client->base.link, &priv->client_event_list);

	spin_unlock_irqrestore(&dev->event_lock, flag);



	if (count)

		return 0;
@@ -1353,6 +1348,11 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data, 
		list_del(&client->base.link);

		spin_unlock_irqrestore(&dev->event_lock, flag);

		kfree(client);

	} else {

		/* Add current client to list */

		spin_lock_irqsave(&dev->event_lock, flag);

		list_add_tail(&client->base.link, &priv->client_event_list);

		spin_unlock_irqrestore(&dev->event_lock, flag);

	}

	return ret;

}