Merge "net: rmnet_data: Fix use after free when sending MAP command ACK" (fae99df5) · Commits · e / devices / android_kernel_xiaomi_markw

net/rmnet_data/rmnet_data_stats.h

+2 −1

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2014, The Linux Foundation. All rights reserved.
		* Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -39,6 +39,7 @@ enum rmnet_skb_free_e {
		RMNET_STATS_SKBFREE_DEAGG_UNKOWN_IP_TYP,
		RMNET_STATS_SKBFREE_DEAGG_DATA_LEN_0,
		RMNET_STATS_SKBFREE_INGRESS_BAD_MAP_CKSUM,
		RMNET_STATS_SKBFREE_MAPC_UNSUPPORTED,
		RMNET_STATS_SKBFREE_MAX
		};

+7 −3

Original line number	Diff line number	Diff line
		@@ -93,11 +93,13 @@ static uint8_t rmnet_map_do_flow_control(struct sk_buff *skb,
		LOGD("dev:%s, qos_id:0x%08X, ip_family:%hd, fc_seq %hd, en:%d",
		skb->dev->name, qos_id, ip_family & 3, fc_seq, enable);

		if (r)
		if (r) {
		rmnet_kfree_skb(skb, RMNET_STATS_SKBFREE_MAPC_UNSUPPORTED);
		return RMNET_MAP_COMMAND_UNSUPPORTED;
		else
		} else {
		return RMNET_MAP_COMMAND_ACK;
		}
		}

		/**
		* rmnet_map_send_ack() - Send N/ACK message for MAP commands
		@@ -188,8 +190,10 @@ rx_handler_result_t rmnet_map_command(struct sk_buff *skb,
		rmnet_map_command_stats[RMNET_MAP_COMMAND_UNKNOWN]++;
		LOGM("Uknown MAP command: %d", command_name);
		rc = RMNET_MAP_COMMAND_UNSUPPORTED;
		rmnet_kfree_skb(skb, RMNET_STATS_SKBFREE_MAPC_UNSUPPORTED);
		break;
		}
		if (rc == RMNET_MAP_COMMAND_ACK)
		rmnet_map_send_ack(skb, rc, config);
		return RX_HANDLER_CONSUMED;
		}