github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-31 11:37:06 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: qrtr: get svc_id before queueing sk_buff

Browse Source 
In qrtr_endpoint_post, getting svc_id based on sk_buff->cb after sk_buff
has been queued to the endpoint leads to a potential use-after-free
scenario. To avoid this race condition, get the service ID via
sk_buff->cb before queueing the sk_buff.

Change-Id: I53205fdffc08fd6dc48fd158c7fe5966f38aa978
Signed-off-by: Tony Truong <quic_truong@quicinc.com>
This commit is contained in:
Tony Truong 2022-03-16 16:11:12 -07:00 committed by Gerrit - the friendly Code Review server
parent ab95e090ae
commit 69dbe4ac19
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/qrtr/af_qrtr.c
View File

@ -893,6 +893,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
/* All control packets and non-local destined data packets should be
* queued to the worker for forwarding handling.
*/
svc_id = qrtr_get_service_id(cb->src_node, cb->src_port);
if (cb->type != QRTR_TYPE_DATA || cb->dst_node != qrtr_local_nid) {
skb_queue_tail(&node->rx_queue, skb);
kthread_queue_work(&node->kworker, &node->read_data);
@ -910,7 +911,6 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
}
/* Force wakeup based on services */
svc_id = qrtr_get_service_id(cb->src_node, cb->src_port);
if (!xa_load(&node->no_wake_svc, svc_id))
pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);