Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b5151f1 authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan
Browse files

net: rmnet_data: Check for endpoint validity when demuxing 



In case an invalid mux id is passed, an invalid device lookup is
done leading to passing on the packet to stack incorrectly rather
than consuming them.

CRs-Fixed: 2181180
Change-Id: Iad905e932b49eda00a7d91e906f0ac0ca44cdb59
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent 3d139965

net/rmnet_data/rmnet_data_handlers.c

+8 −1
Original line number Original line Diff line number Diff line 
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.

 *

 *

 * This program is free software; you can redistribute it and/or modify

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * it under the terms of the GNU General Public License version 2 and
@@ -453,6 +453,13 @@ static rx_handler_result_t _rmnet_map_ingress_handler 
	}

	}





	ep = &config->muxed_ep[mux_id];

	ep = &config->muxed_ep[mux_id];

	if (!ep->refcount) {

		LOGD("Packet on %s:%d; has no logical endpoint config",

		     skb->dev->name, mux_id);



		rmnet_kfree_skb(skb, RMNET_STATS_SKBFREE_MAPINGRESS_MUX_NO_EP);

		return RX_HANDLER_CONSUMED;

	}





	skb->dev = ep->egress_dev;

	skb->dev = ep->egress_dev;

net/rmnet_data/rmnet_data_stats.h

+2 −1
Original line number Original line Diff line number Diff line 
/*

/*

 * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.

 * Copyright (c) 2014, 2016, 2018 The Linux Foundation. All rights reserved.

 *

 *

 * This program is free software; you can redistribute it and/or modify

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * it under the terms of the GNU General Public License version 2 and
@@ -39,6 +39,7 @@ enum rmnet_skb_free_e { 
	RMNET_STATS_SKBFREE_DEAGG_DATA_LEN_0,

	RMNET_STATS_SKBFREE_DEAGG_DATA_LEN_0,

	RMNET_STATS_SKBFREE_INGRESS_BAD_MAP_CKSUM,

	RMNET_STATS_SKBFREE_INGRESS_BAD_MAP_CKSUM,

	RMNET_STATS_SKBFREE_MAPC_UNSUPPORTED,

	RMNET_STATS_SKBFREE_MAPC_UNSUPPORTED,

	RMNET_STATS_SKBFREE_MAPINGRESS_MUX_NO_EP,

	RMNET_STATS_SKBFREE_MAX

	RMNET_STATS_SKBFREE_MAX

};

};