A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: rearrange to avoid use-after-free of the skb

Browse source 
The skb buffer is freed after the ealier sanity and then pass along
to connectivity stats tracking. Rearragne the stats tracking into the
scope of the skb sanity to assure the skb poitner is valid before
accessing it and set to NULL after free to make sure it is cleared.

Change-Id: I08106bced48fa8f23955fd261c679a5362ddd7a6
CRs-fixed: 2232362
This commit is contained in:
Ryan Hsu 2018-05-04 12:19:50 -07:00 • committed by nshrivas
commit da74332d4b
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
core/hdd/src/wlan_hdd_tx_rx.c
View file

@ -1091,10 +1091,15 @@ drop_pkt_and_release_skb:
drop_pkt:
if (skb) {
/* track connectivity stats */
if (adapter->pkt_type_bitmap)
hdd_tx_rx_collect_connectivity_stats_info(skb, adapter,
PKT_TYPE_TX_DROPPED, &pkt_type);
qdf_dp_trace_data_pkt(skb, QDF_TRACE_DEFAULT_PDEV_ID,
QDF_DP_TRACE_DROP_PACKET_RECORD, 0,
QDF_TX);
kfree_skb(skb);
skb = NULL;
}
drop_pkt_accounting:
@ -1107,11 +1112,6 @@ drop_pkt_accounting:
"%s : ARP packet dropped", __func__);
}
/* track connectivity stats */
if (adapter->pkt_type_bitmap)
hdd_tx_rx_collect_connectivity_stats_info(skb, adapter,
PKT_TYPE_TX_DROPPED, &pkt_type);
return NETDEV_TX_OK;
}