DivestOS/Patches/Linux_CVEs/CVE-2017-8277/ANY/0.patch

From c9a6f09f1030cec591df837622cb54bbb2d24ddc Mon Sep 17 00:00:00 2001
From: Sandeep Panda <spanda@codeaurora.org>
Date: Fri, 12 May 2017 10:56:32 +0530
Subject: msm: mdss: remove client from device list if failed to register

If there is any failure while registering a DBA client with MDSS
driver, then remove the client from device client list first and
then free the client. Otherwise driver might crash when
traversing the device client list in later stage, because of an
uninitialized entry in the list.

Change-Id: I60666f4c3dea5c7ea7b7c77bcb14b080ee25b54d
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
---
 drivers/video/fbdev/msm/msm_dba/msm_dba.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/msm/msm_dba/msm_dba.c b/drivers/video/fbdev/msm/msm_dba/msm_dba.c
index 7a5c9d9..cc6512a 100644
--- a/drivers/video/fbdev/msm/msm_dba/msm_dba.c
+++ b/drivers/video/fbdev/msm/msm_dba/msm_dba.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015,2017, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -80,6 +80,11 @@ void *msm_dba_register_client(struct msm_dba_reg_info *info,
 		if (rc) {
 			pr_err("%s: Client register failed (%s, %d)\n",
 			       __func__, info->chip_name, info->instance_id);
+			/* remove the client from list before freeing */
+			mutex_lock_nested(&device->dev_mutex,
+						SINGLE_DEPTH_NESTING);
+			list_del(&client->list);
+			mutex_unlock(&device->dev_mutex);
 			kfree(client);
 			mutex_unlock(&register_mutex);
 			return ERR_PTR(rc);
-- 
cgit v1.1