samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disp: msm: sde: add event to event_list after register is successful

Browse Source 
Add event to event_list after msm_register_event is successful to avoid
use-after-free vulnerability.

Change-Id: I34fb39c99051978cbab64a852851964691a5ea9e
Signed-off-by: Ping Li <pingli@codeaurora.org>
This commit is contained in:
Ping Li
2020-09-10 13:17:32 -07:00
committed by Gerrit - the friendly Code Review server
parent 76a1d81e9d
commit 97a5b52ebd
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
msm/msm_drv.c
View File

@@ -1351,24 +1351,27 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data,
* calls add to client list and return. * calls add to client list and return.
*/ */
count = msm_event_client_count(dev, req_event, false); count = msm_event_client_count(dev, req_event, false);
/* Add current client to list */ if (count) {
spin_lock_irqsave(&dev->event_lock, flag); /* Add current client to list */
list_add_tail(&client->base.link, &priv->client_event_list); spin_lock_irqsave(&dev->event_lock, flag);
spin_unlock_irqrestore(&dev->event_lock, flag); list_add_tail(&client->base.link, &priv->client_event_list);
spin_unlock_irqrestore(&dev->event_lock, flag);
if (count)
return 0; return 0;
}
ret = msm_register_event(dev, req_event, file, true); ret = msm_register_event(dev, req_event, file, true);
if (ret) { if (ret) {
DRM_ERROR("failed to enable event %x object %x object id %d\n", DRM_ERROR("failed to enable event %x object %x object id %d\n",
req_event->event, req_event->object_type, req_event->event, req_event->object_type,
req_event->object_id); req_event->object_id);
spin_lock_irqsave(&dev->event_lock, flag);
list_del(&client->base.link);
spin_unlock_irqrestore(&dev->event_lock, flag);
kfree(client); kfree(client);
} else {
/* Add current client to list */
spin_lock_irqsave(&dev->event_lock, flag);
list_add_tail(&client->base.link, &priv->client_event_list);
spin_unlock_irqrestore(&dev->event_lock, flag);
} }
return ret; return ret;
} }