Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit fe6ff43d authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan Committed by Gerrit - the friendly Code Review server
Browse files

net: qualcomm: rmnet: Fix list handling of the page pool



Whenever the page list is updated from userspace, the previous
list elements are freed but are not deleted from the list.

This results in a use after free-

16963.086348:   <6> list_add corruption. prev->next should be next
                    (fffffff3497a1b90), but was 6b6b6b6b6b6b6b6b.
					 (prev=fffffff29a170800).
16963.192049:   <2> pc : __list_add_valid+0x84/0x88
16963.196351:   <2> lr : __list_add_valid+0x84/0x88
16963.721175:   <2> Call trace:
16963.723712:   <2>  __list_add_valid+0x84/0x88
16963.727663:   <2>  rmnet_map_update_ul_agg_config+0x16c/0x1d0
16963.733031:   <2>  rmnet_changelink+0x17c/0x190
16963.737154:   <2>  rtnl_newlink+0x3dc/0x798
16963.740933:   <2>  rtnetlink_rcv_msg+0x350/0x5d0
16963.745155:   <2>  netlink_rcv_skb+0xac/0x128
16963.749108:   <2>  rtnetlink_rcv+0x24/0x30
16963.752788:   <2>  netlink_unicast+0x1c0/0x268
16963.756822:   <2>  netlink_sendmsg+0x308/0x368
16963.760855:   <2>  __sys_sendto+0x120/0x1a0
16963.764628:   <2>  __arm64_sys_sendto+0x2c/0x40
16963.768761:   <2>  el0_svc_common+0xac/0x188
16963.772626:   <2>  el0_svc_handler+0x7c/0x98
16963.776490:   <2>  el0_svc+0x8/0xc

Fix this by initializing the list after allocation and deleting
the list before freeing the node.

CRs-Fixed: 2525999
Change-Id: I2476cf956168569bf30d13116fedf60049f439f7
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent c511abcf
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment