android_kernel_oneplus_msm8998/net/rmnet_data
Subash Abhinov Kasiviswanathan c6e1ec80cd net: rmnet_data: Fix use after free when sending MAP command ACK
Following stack trace was seen while doing a data transfer

Unable to handle kernel paging request at virtual address
6b6b6b6b6b6b6ef3
pgd = ffffffc01c7c5000 [6b6b6b6b6b6b6ef3] *pgd=0000000000000000,
*pud=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Call trace:
[<ffffffc000f669ac>] rmnet_map_command+0x19c/0x238
[<ffffffc000f6504c>] _rmnet_map_ingress_handler+0x3c/0x264
[<ffffffc000f65500>] rmnet_ingress_handler+0x1b4/0x3a4
[<ffffffc000f65704>] rmnet_rx_handler+0x14/0x2c
[<ffffffc000d8b5ac>] __netif_receive_skb_core+0x514/0x71c
[<ffffffc000d8c270>] __netif_receive_skb+0x30/0x98
[<ffffffc000d8d3bc>] process_backlog+0xb0/0x184
[<ffffffc000d8d1f8>] net_rx_action+0xfc/0x210
[<ffffffc00016a2e0>] __do_softirq+0x1c0/0x39c
[<ffffffc00016a824>] irq_exit+0x88/0xf4
[<ffffffc0001565e8>] handle_IPI+0x340/0x4b4
[<ffffffc0001455e8>] gic_handle_irq+0xc4/0xec

This is because an invalid MAP command was received and was freed
and rmnet_data was trying to send the freed skb as an ACK. Fix this
by returning if an invalid MAP command is detected.

CRs-Fixed: 1019188
Change-Id: Ib52e6551ac67215dab2bc5770ddcf037568f8b77
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
2016-05-26 15:30:13 -07:00
..
Kconfig
Makefile net: rmnet_data: Add support for ftrace events 2016-03-22 11:05:09 -07:00
rmnet_data_config.c net: rmnet_data: Handle info pointer from netdevice notifier 2016-03-22 11:05:38 -07:00
rmnet_data_config.h net: rmnet_data: Add a GRO flush timer 2016-04-28 16:37:50 -07:00
rmnet_data_handlers.c net: rmnet_data: Stop adding pad bytes for MAPv3 uplink packets 2016-04-28 16:47:48 -07:00
rmnet_data_handlers.h
rmnet_data_main.c net: rmnet_data: Add support for ftrace events 2016-03-22 11:05:09 -07:00
rmnet_data_private.h net: rmnet_data: Add default value for tx_queue_len 2016-03-22 11:05:07 -07:00
rmnet_data_stats.c net: rmnet_data: add support for UL MAP based checksum offload 2016-03-22 11:05:23 -07:00
rmnet_data_stats.h net: rmnet_data: Fix use after free when sending MAP command ACK 2016-05-26 15:30:13 -07:00
rmnet_data_trace.h net: rmnet_data: Change the print format for addresses 2016-04-28 16:47:34 -07:00
rmnet_data_vnd.c net: rmnet_data: Change the print format for addresses 2016-04-28 16:47:34 -07:00
rmnet_data_vnd.h net: rmnet_data: Remove the NAPI context for rmnet_data devices 2016-03-22 11:05:52 -07:00
rmnet_map.h net: rmnet_data: Stop adding pad bytes for MAPv4 uplink packets 2016-03-22 11:05:45 -07:00
rmnet_map_command.c net: rmnet_data: Fix use after free when sending MAP command ACK 2016-05-26 15:30:13 -07:00
rmnet_map_data.c rmnet_data: skip padding count for non linear skbs 2016-04-27 19:04:56 -07:00