From 4b5151f1095de8670db030fc420615f22f3daa79 Mon Sep 17 00:00:00 2001 From: Subash Abhinov Kasiviswanathan Date: Thu, 25 Jan 2018 23:14:39 -0700 Subject: [PATCH] net: rmnet_data: Check for endpoint validity when demuxing In case an invalid mux id is passed, an invalid device lookup is done leading to passing on the packet to stack incorrectly rather than consuming them. CRs-Fixed: 2181180 Change-Id: Iad905e932b49eda00a7d91e906f0ac0ca44cdb59 Signed-off-by: Subash Abhinov Kasiviswanathan --- net/rmnet_data/rmnet_data_handlers.c | 9 ++++++++- net/rmnet_data/rmnet_data_stats.h | 3 ++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/net/rmnet_data/rmnet_data_handlers.c b/net/rmnet_data/rmnet_data_handlers.c index 8faf7a7688b1..50dd51651f3b 100644 --- a/net/rmnet_data/rmnet_data_handlers.c +++ b/net/rmnet_data/rmnet_data_handlers.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -453,6 +453,13 @@ static rx_handler_result_t _rmnet_map_ingress_handler } ep = &config->muxed_ep[mux_id]; + if (!ep->refcount) { + LOGD("Packet on %s:%d; has no logical endpoint config", + skb->dev->name, mux_id); + + rmnet_kfree_skb(skb, RMNET_STATS_SKBFREE_MAPINGRESS_MUX_NO_EP); + return RX_HANDLER_CONSUMED; + } skb->dev = ep->egress_dev; diff --git a/net/rmnet_data/rmnet_data_stats.h b/net/rmnet_data/rmnet_data_stats.h index 366e48680412..75ed434f1487 100644 --- a/net/rmnet_data/rmnet_data_stats.h +++ b/net/rmnet_data/rmnet_data_stats.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved. + * Copyright (c) 2014, 2016, 2018 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -39,6 +39,7 @@ enum rmnet_skb_free_e { RMNET_STATS_SKBFREE_DEAGG_DATA_LEN_0, RMNET_STATS_SKBFREE_INGRESS_BAD_MAP_CKSUM, RMNET_STATS_SKBFREE_MAPC_UNSUPPORTED, + RMNET_STATS_SKBFREE_MAPINGRESS_MUX_NO_EP, RMNET_STATS_SKBFREE_MAX };