disp: msm: sde: add event to event_list after register is successful

Add event to event_list after msm_register_event is successful to avoid
use-after-free vulnerability.

Change-Id: I144ae82c657c1e2cf16608c0e8768b12a7d27974
Signed-off-by: Ping Li <[email protected]>

msm/msm_drv.c

@@ -1351,11 +1351,6 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data,
 	 * calls add to client list and return.
 	 */
 	count = msm_event_client_count(dev, req_event, false);
-	/* Add current client to list */
-	spin_lock_irqsave(&dev->event_lock, flag);
-	list_add_tail(&client->base.link, &priv->client_event_list);
-	spin_unlock_irqrestore(&dev->event_lock, flag);
-
 	if (count)
 		return 0;
 
@@ -1368,6 +1363,11 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data,
 		list_del(&client->base.link);
 		spin_unlock_irqrestore(&dev->event_lock, flag);
 		kfree(client);
+	} else {
+		/* Add current client to list */
+		spin_lock_irqsave(&dev->event_lock, flag);
+		list_add_tail(&client->base.link, &priv->client_event_list);
+		spin_unlock_irqrestore(&dev->event_lock, flag);
 	}
 	return ret;
 }