android_kernel_oneplus_msm8998/net/rmnet_data/rmnet_data_stats.h
Subash Abhinov Kasiviswanathan c6e1ec80cd net: rmnet_data: Fix use after free when sending MAP command ACK
Following stack trace was seen while doing a data transfer

Unable to handle kernel paging request at virtual address
6b6b6b6b6b6b6ef3
pgd = ffffffc01c7c5000 [6b6b6b6b6b6b6ef3] *pgd=0000000000000000,
*pud=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Call trace:
[<ffffffc000f669ac>] rmnet_map_command+0x19c/0x238
[<ffffffc000f6504c>] _rmnet_map_ingress_handler+0x3c/0x264
[<ffffffc000f65500>] rmnet_ingress_handler+0x1b4/0x3a4
[<ffffffc000f65704>] rmnet_rx_handler+0x14/0x2c
[<ffffffc000d8b5ac>] __netif_receive_skb_core+0x514/0x71c
[<ffffffc000d8c270>] __netif_receive_skb+0x30/0x98
[<ffffffc000d8d3bc>] process_backlog+0xb0/0x184
[<ffffffc000d8d1f8>] net_rx_action+0xfc/0x210
[<ffffffc00016a2e0>] __do_softirq+0x1c0/0x39c
[<ffffffc00016a824>] irq_exit+0x88/0xf4
[<ffffffc0001565e8>] handle_IPI+0x340/0x4b4
[<ffffffc0001455e8>] gic_handle_irq+0xc4/0xec

This is because an invalid MAP command was received and was freed
and rmnet_data was trying to send the freed skb as an ACK. Fix this
by returning if an invalid MAP command is detected.

CRs-Fixed: 1019188
Change-Id: Ib52e6551ac67215dab2bc5770ddcf037568f8b77
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
2016-05-26 15:30:13 -07:00

62 lines
2.1 KiB
C

/*
* Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
* only version 2 as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
*
* RMNET Data statistics
*
*/
#ifndef _RMNET_DATA_STATS_H_
#define _RMNET_DATA_STATS_H_
enum rmnet_skb_free_e {
RMNET_STATS_SKBFREE_UNKNOWN,
RMNET_STATS_SKBFREE_BRDG_NO_EGRESS,
RMNET_STATS_SKBFREE_DELIVER_NO_EP,
RMNET_STATS_SKBFREE_IPINGRESS_NO_EP,
RMNET_STATS_SKBFREE_MAPINGRESS_BAD_MUX,
RMNET_STATS_SKBFREE_MAPINGRESS_MUX_NO_EP,
RMNET_STATS_SKBFREE_MAPINGRESS_AGGBUF,
RMNET_STATS_SKBFREE_INGRESS_NOT_EXPECT_MAPD,
RMNET_STATS_SKBFREE_INGRESS_NOT_EXPECT_MAPC,
RMNET_STATS_SKBFREE_EGR_MAPFAIL,
RMNET_STATS_SKBFREE_VND_NO_EGRESS,
RMNET_STATS_SKBFREE_MAPC_BAD_MUX,
RMNET_STATS_SKBFREE_MAPC_MUX_NO_EP,
RMNET_STATS_SKBFREE_AGG_CPY_EXPAND,
RMNET_STATS_SKBFREE_AGG_INTO_BUFF,
RMNET_STATS_SKBFREE_DEAGG_MALFORMED,
RMNET_STATS_SKBFREE_DEAGG_CLONE_FAIL,
RMNET_STATS_SKBFREE_DEAGG_UNKOWN_IP_TYP,
RMNET_STATS_SKBFREE_DEAGG_DATA_LEN_0,
RMNET_STATS_SKBFREE_INGRESS_BAD_MAP_CKSUM,
RMNET_STATS_SKBFREE_MAPC_UNSUPPORTED,
RMNET_STATS_SKBFREE_MAX
};
enum rmnet_queue_xmit_e {
RMNET_STATS_QUEUE_XMIT_UNKNOWN,
RMNET_STATS_QUEUE_XMIT_EGRESS,
RMNET_STATS_QUEUE_XMIT_AGG_FILL_BUFFER,
RMNET_STATS_QUEUE_XMIT_AGG_TIMEOUT,
RMNET_STATS_QUEUE_XMIT_AGG_CPY_EXP_FAIL,
RMNET_STATS_QUEUE_XMIT_AGG_SKIP,
RMNET_STATS_QUEUE_XMIT_MAX
};
void rmnet_kfree_skb(struct sk_buff *skb, unsigned int reason);
void rmnet_stats_queue_xmit(int rc, unsigned int reason);
void rmnet_stats_deagg_pkts(int aggcount);
void rmnet_stats_agg_pkts(int aggcount);
void rmnet_stats_dl_checksum(unsigned int rc);
void rmnet_stats_ul_checksum(unsigned int rc);
#endif /* _RMNET_DATA_STATS_H_ */