Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21e13df8 authored by Weiyi Chen's avatar Weiyi Chen
Browse files

dfc: fix use-after-free 



When IPA failed to send a QMAP packet, the skb is freed in IPA so
accessing the skb after IPA failure will result in use-after-free.

Remove the skb access after IPA send failure.

Change-Id: Id12894a8f4cc3d7bec717413d48f2430e1c959cf
Signed-off-by: default avatarWeiyi Chen <quic_weiyic@quicinc.com>
parent 8c4afb2b

core/dfc_qmap.c

+6 −3
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <net/pkt_sched.h>
@@ -139,11 +140,13 @@ static void dfc_qmap_send_cmd(struct sk_buff *skb) 
{

	trace_dfc_qmap(skb->data, skb->len, false);



	if (unlikely(!rmnet_ctl || !rmnet_ctl->send) ||

	    rmnet_ctl->send(rmnet_ctl_handle, skb)) {

		pr_err("Failed to send to rmnet ctl\n");

	if (unlikely(!rmnet_ctl || !rmnet_ctl->send)) {

		kfree_skb(skb);

		return;

	}



	if (rmnet_ctl->send(rmnet_ctl_handle, skb))

		pr_err("Failed to send to rmnet ctl\n");

}



static void dfc_qmap_send_inband_ack(struct dfc_qmi_data *dfc,

core/rmnet_ctl_client.c

+7 −2
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.

 *

 * RMNET_CTL client handlers

 *
@@ -171,8 +172,10 @@ int rmnet_ctl_send_client(void *handle, struct sk_buff *skb) 
	struct rmnet_ctl_dev *dev;

	int rc = -EINVAL;



	if (client != rcu_dereference(ctl_ep.client))

	if (client != rcu_dereference(ctl_ep.client)) {

		kfree_skb(skb);

		return rc;

	}



	rmnet_ctl_log_info("TX", skb->data, skb->len);
@@ -181,11 +184,13 @@ int rmnet_ctl_send_client(void *handle, struct sk_buff *skb) 
	dev = rcu_dereference(ctl_ep.dev);

	if (dev && dev->xmit)

		rc = dev->xmit(dev, skb);

	else

		kfree_skb(skb);



	rcu_read_unlock();



	if (rc)

		rmnet_ctl_log_err("TXE", rc, skb->data, skb->len);

		rmnet_ctl_log_err("TXE", rc, NULL, 0);



	return rc;

}