samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disp: msm: sde: add event to event_list after register is successful

Browse Source 
Add event to event_list after msm_register_event is successful to avoid
use-after-free vulnerability.

Change-Id: I144ae82c657c1e2cf16608c0e8768b12a7d27974
Signed-off-by: Ping Li <pingli@codeaurora.org>
This commit is contained in:
Ping Li
2020-08-31 11:30:26 -07:00
parent 6f85b051af
commit 9450155b4f
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
msm/msm_drv.c
View File

@@ -1351,11 +1351,6 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data,
* calls add to client list and return. * calls add to client list and return.
*/ */
count = msm_event_client_count(dev, req_event, false); count = msm_event_client_count(dev, req_event, false);
/* Add current client to list */
spin_lock_irqsave(&dev->event_lock, flag);
list_add_tail(&client->base.link, &priv->client_event_list);
spin_unlock_irqrestore(&dev->event_lock, flag);
if (count) if (count)
return 0; return 0;
@@ -1368,6 +1363,11 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data,
list_del(&client->base.link); list_del(&client->base.link);
spin_unlock_irqrestore(&dev->event_lock, flag); spin_unlock_irqrestore(&dev->event_lock, flag);
kfree(client); kfree(client);
} else {
/* Add current client to list */
spin_lock_irqsave(&dev->event_lock, flag);
list_add_tail(&client->base.link, &priv->client_event_list);
spin_unlock_irqrestore(&dev->event_lock, flag);
} }
return ret; return ret;
} }