Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 360fc9aa authored by Ping Li's avatar Ping Li Committed by Gerrit - the friendly Code Review server
Browse files

disp: msm: sde: add event to event_list after register is successful 



Add event to event_list after msm_register_event is successful to avoid
use-after-free vulnerability.

Change-Id: I34fb39c99051978cbab64a852851964691a5ea9e
Signed-off-by: default avatarPing Li <pingli@codeaurora.org>
parent f5e6d2c2

msm/msm_drv.c

+11 −8
Original line number Diff line number Diff line
@@ -1336,24 +1336,27 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data, 
	 * calls add to client list and return.

	 */

	count = msm_event_client_count(dev, req_event, false);

	if (count) {

		/* Add current client to list */

		spin_lock_irqsave(&dev->event_lock, flag);

		list_add_tail(&client->base.link, &priv->client_event_list);

		spin_unlock_irqrestore(&dev->event_lock, flag);



	if (count)

		return 0;

	}



	ret = msm_register_event(dev, req_event, file, true);

	if (ret) {

		DRM_ERROR("failed to enable event %x object %x object id %d\n",

			req_event->event, req_event->object_type,

			req_event->object_id);

		kfree(client);

	} else {

		/* Add current client to list */

		spin_lock_irqsave(&dev->event_lock, flag);

		list_del(&client->base.link);

		list_add_tail(&client->base.link, &priv->client_event_list);

		spin_unlock_irqrestore(&dev->event_lock, flag);

		kfree(client);

	}



	return ret;

}