Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87acdd70 authored by Arun Prakash's avatar Arun Prakash Committed by Pranav Mahesh Phansalkar
Browse files

net: qrtr: Move service id based filter check before queueing skb 



Move service id based filter check before queueing skb to avoid
possible use after free issue since skb might get released once
rx thread completed the processing of skb.

Change-Id: Iff93e32abd3d55f78bf4ce80675fc3bb312b0841
Signed-off-by: default avatarArun Prakash <quic_app@quicinc.com>
parent 29910cbf

net/qrtr/qrtr.c

+12 −9
Original line number Diff line number Diff line
@@ -939,13 +939,6 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) 
			return -ENODEV;

		}



		if (sock_queue_rcv_skb(&ipc->sk, skb))

			goto err;



		/* Force wakeup for all packets except for sensors */

		if (node->nid != 9 && node->nid != 5)

			pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);



		if (node->nid == 5) {

			svc_id = qrtr_get_service_id(cb->src_node, cb->src_port);

			if (svc_id > 0) {
@@ -956,9 +949,19 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) 
					}

				}

			}

			if (wake)

				pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);

		}



		if (sock_queue_rcv_skb(&ipc->sk, skb))

			goto err;



		/**

		 * Force wakeup for all packets except for sensors and blacklisted services

		 * from adsp side

		 */

		if ((node->nid != 9 && node->nid != 5) ||

		    (node->nid == 5 && wake))

			pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);



		qrtr_port_put(ipc);

	}