Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7fd6250 authored by Krishna Manikandan's avatar Krishna Manikandan Committed by Gerrit - the friendly Code Review server
Browse files

disp: msm: sde: add null check for drm file in msm_release 



Drm file is not set to NULL after freeing it from drm
release. This can result in use-after-free issues in
some scenarios. Add a mutex lock and other proper null
checks to prevent such issues.

Change-Id: Ic35b0a76166b0f47a354b1737e6f4c3ac1437ed4
Signed-off-by: default avatarKrishna Manikandan <mkrishn@codeaurora.org>
Signed-off-by: default avatarAlthaf Neelanchirayil <aneelanc@codeaurora.org>
parent 5d77c36d

msm/msm_drv.c

+23 −5
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved.

 * Copyright (C) 2013 Red Hat

 * Author: Rob Clark <robdclark@gmail.com>

 *
@@ -61,6 +61,8 @@ 
#define MSM_VERSION_MINOR	3

#define MSM_VERSION_PATCHLEVEL	0



static DEFINE_MUTEX(msm_release_lock);



static void msm_fb_output_poll_changed(struct drm_device *dev)

{

	struct msm_drm_private *priv = NULL;
@@ -1461,13 +1463,25 @@ void msm_mode_object_event_notify(struct drm_mode_object *obj, 
static int msm_release(struct inode *inode, struct file *filp)

{

	struct drm_file *file_priv = filp->private_data;

	struct drm_minor *minor = file_priv->minor;

	struct drm_device *dev = minor->dev;

	struct msm_drm_private *priv = dev->dev_private;

	struct drm_minor *minor;

	struct drm_device *dev;

	struct msm_drm_private *priv;

	struct msm_drm_event *node, *temp, *tmp_node;

	u32 count;

	unsigned long flags;

	LIST_HEAD(tmp_head);

	int ret = 0;



	mutex_lock(&msm_release_lock);



	if (!file_priv) {

		ret = -EINVAL;

		goto end;

	}



	minor = file_priv->minor;

	dev = minor->dev;

	priv = dev->dev_private;



	spin_lock_irqsave(&dev->event_lock, flags);

	list_for_each_entry_safe(node, temp, &priv->client_event_list,
@@ -1504,7 +1518,11 @@ static int msm_release(struct inode *inode, struct file *filp) 
	 */

	msm_preclose(dev, file_priv);



	return drm_release(inode, filp);

	ret = drm_release(inode, filp);

	filp->private_data = NULL;

end:

	mutex_unlock(&msm_release_lock);

	return ret;

}



/**