net: rmnet_data: Fix use after free when sending MAP command ACK
Following stack trace was seen while doing a data transfer
Unable to handle kernel paging request at virtual address
6b6b6b6b6b6b6ef3
pgd =
ffffffc01c7c5000 [
6b6b6b6b6b6b6ef3] *pgd=
0000000000000000,
*pud=
0000000000000000
Internal error: Oops:
96000004 [#1] PREEMPT SMP
Call trace:
[<
ffffffc000f669ac>] rmnet_map_command+0x19c/0x238
[<
ffffffc000f6504c>] _rmnet_map_ingress_handler+0x3c/0x264
[<
ffffffc000f65500>] rmnet_ingress_handler+0x1b4/0x3a4
[<
ffffffc000f65704>] rmnet_rx_handler+0x14/0x2c
[<
ffffffc000d8b5ac>] __netif_receive_skb_core+0x514/0x71c
[<
ffffffc000d8c270>] __netif_receive_skb+0x30/0x98
[<
ffffffc000d8d3bc>] process_backlog+0xb0/0x184
[<
ffffffc000d8d1f8>] net_rx_action+0xfc/0x210
[<
ffffffc00016a2e0>] __do_softirq+0x1c0/0x39c
[<
ffffffc00016a824>] irq_exit+0x88/0xf4
[<
ffffffc0001565e8>] handle_IPI+0x340/0x4b4
[<
ffffffc0001455e8>] gic_handle_irq+0xc4/0xec
This is because an invalid MAP command was received and was freed
and rmnet_data was trying to send the freed skb as an ACK. Fix this
by returning if an invalid MAP command is detected.
CRs-Fixed:
1019188
Change-Id: Ib52e6551ac67215dab2bc5770ddcf037568f8b77
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>