Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9685663c authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan
Browse files

net: qualcomm: rmnet: Fix possible null dereference in command processing 



If a command packet with invalid mux id is received, the packet would
not have a valid endpoint. This invalid endpoint maybe dereferenced.
Identified by manual code inspection.

CRs-Fixed: 2156182
Change-Id: I2fb1cf159813e7c2fd1240a16411a654cb67d7d7
Fixes: 3352e6c4 ("net: qualcomm: rmnet: Convert the muxed endpoint to hlist")
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent 1f014688

drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c

+6 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -38,6 +38,11 @@ static u8 rmnet_map_do_flow_control(struct sk_buff *skb, 
	}



	ep = rmnet_get_endpoint(port, mux_id);

	if (!ep) {

		kfree_skb(skb);

		return RX_HANDLER_CONSUMED;

	}



	vnd = ep->egress_dev;



	ip_family = cmd->flow_control.ip_family;