net: qualcomm: rmnet: Fix use after free while sending command ack

PATCH Applied Subash Abhinov Kasiviswanathan 2 participants 2 messages Jun 5, 2018

Subsystems (3)

Networking Network drivers Qualcomm rmnet driver

lore

Share & tools

lore

Subash Abhinov Kasiviswanathan

author

2018-06-05 01:43 UTC #0 lore raw

PATCH v2 1/1 net: qualcomm: rmnet: Fix use after free while sending command ack

When sending an ack to a command packet, the skb is still referenced after it is sent to the real device. Since the real device could free the skb, the device pointer would be invalid.
Also, remove an unnecessary variable.

Fixes ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")

Signed-off-by Subash Abhinov Kasiviswanathan <[email protected]>

---
v1->v2: Rebase change on net-next instead as mentioned by David. Also remove an unnecessary variable.

---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c +4 -4

index 56a93df..3ee8ae9 100644
@@ -67,7 +67,7 @@ static void rmnet_map_send_ack(struct sk_buff *skb,
 			       struct rmnet_port *port)
 {
 	struct rmnet_map_control_command *cmd;
-	int xmit_status;
+	struct net_device *dev = skb->dev;
 
 	if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4)
 		skb_trim(skb,

@@ -78,9 +78,9 @@ static void rmnet_map_send_ack(struct sk_buff *skb,
 	cmd = RMNET_MAP_GET_CMD_START(skb);
 	cmd->cmd_type = type & 0x03;
 
-	netif_tx_lock(skb->dev);
-	xmit_status = skb->dev->netdev_ops->ndo_start_xmit(skb, skb->dev);
-	netif_tx_unlock(skb->dev);
+	netif_tx_lock(dev);
+	dev->netdev_ops->ndo_start_xmit(skb, dev);
+	netif_tx_unlock(dev);
 }
 
 /* Process MAP command frame and send N/ACK message as appropriate. Message cmd

Signature · 1 line

1.9.1

David Miller

maintainer Applied

2018-06-05 14:17 UTC #1 lore raw

From: Subash Abhinov Kasiviswanathan <[email protected]>
Date: Mon, 4 Jun 2018 19:43:38 -0600

Quoted 7 lines

When sending an ack to a command packet, the skb is still referenced after it is sent to the real device. Since the real device could free the skb, the device pointer would be invalid.
Also, remove an unnecessary variable.
Fixes ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by Subash Abhinov Kasiviswanathan <[email protected]>

Applied.