From 9450155b4f805da81759e4a31e30945ca01bca89 Mon Sep 17 00:00:00 2001 From: Ping Li Date: Mon, 31 Aug 2020 11:30:26 -0700 Subject: [PATCH] disp: msm: sde: add event to event_list after register is successful Add event to event_list after msm_register_event is successful to avoid use-after-free vulnerability. Change-Id: I144ae82c657c1e2cf16608c0e8768b12a7d27974 Signed-off-by: Ping Li --- msm/msm_drv.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/msm/msm_drv.c b/msm/msm_drv.c index 95d08b0baa54..5969a941f7e0 100644 --- a/msm/msm_drv.c +++ b/msm/msm_drv.c @@ -1351,11 +1351,6 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data, * calls add to client list and return. */ count = msm_event_client_count(dev, req_event, false); - /* Add current client to list */ - spin_lock_irqsave(&dev->event_lock, flag); - list_add_tail(&client->base.link, &priv->client_event_list); - spin_unlock_irqrestore(&dev->event_lock, flag); - if (count) return 0; @@ -1368,6 +1363,11 @@ static int msm_ioctl_register_event(struct drm_device *dev, void *data, list_del(&client->base.link); spin_unlock_irqrestore(&dev->event_lock, flag); kfree(client); + } else { + /* Add current client to list */ + spin_lock_irqsave(&dev->event_lock, flag); + list_add_tail(&client->base.link, &priv->client_event_list); + spin_unlock_irqrestore(&dev->event_lock, flag); } return ret; }