From 69dbe4ac191d1f6eb7d8234e964acf214f338967 Mon Sep 17 00:00:00 2001 From: Tony Truong Date: Wed, 16 Mar 2022 16:11:12 -0700 Subject: [PATCH] net: qrtr: get svc_id before queueing sk_buff In qrtr_endpoint_post, getting svc_id based on sk_buff->cb after sk_buff has been queued to the endpoint leads to a potential use-after-free scenario. To avoid this race condition, get the service ID via sk_buff->cb before queueing the sk_buff. Change-Id: I53205fdffc08fd6dc48fd158c7fe5966f38aa978 Signed-off-by: Tony Truong --- net/qrtr/af_qrtr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c index 7bfad4db18ad..db0be1473616 100644 --- a/net/qrtr/af_qrtr.c +++ b/net/qrtr/af_qrtr.c @@ -893,6 +893,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) /* All control packets and non-local destined data packets should be * queued to the worker for forwarding handling. */ + svc_id = qrtr_get_service_id(cb->src_node, cb->src_port); if (cb->type != QRTR_TYPE_DATA || cb->dst_node != qrtr_local_nid) { skb_queue_tail(&node->rx_queue, skb); kthread_queue_work(&node->kworker, &node->read_data); @@ -910,7 +911,6 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) } /* Force wakeup based on services */ - svc_id = qrtr_get_service_id(cb->src_node, cb->src_port); if (!xa_load(&node->no_wake_svc, svc_id)) pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);