From mboxrd@z Thu Jan 1 00:00:00 1970 From: Subash Abhinov Kasiviswanathan Subject: [PATCH net 3/3] net: qualcomm: rmnet: Fix possible null dereference in command processing Date: Fri, 16 Feb 2018 15:56:39 -0700 Message-ID: <1518821799-24549-4-git-send-email-subashab@codeaurora.org> References: <1518821799-24549-1-git-send-email-subashab@codeaurora.org> Cc: Subash Abhinov Kasiviswanathan To: davem@davemloft.net, netdev@vger.kernel.org Return-path: Received: from smtp.codeaurora.org ([198.145.29.96]:49328 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750896AbeBPW5K (ORCPT ); Fri, 16 Feb 2018 17:57:10 -0500 In-Reply-To: <1518821799-24549-1-git-send-email-subashab@codeaurora.org> Sender: netdev-owner@vger.kernel.org List-ID: If a command packet with invalid mux id is received, the packet would not have a valid endpoint. This invalid endpoint maybe dereferenced leading to a crash. Identified by manual code inspection. Fixes: 3352e6c45760 ("net: qualcomm: rmnet: Convert the muxed endpoint to hlist") Signed-off-by: Subash Abhinov Kasiviswanathan --- drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c index 6bc328f..b0dbca0 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c @@ -38,6 +38,11 @@ static u8 rmnet_map_do_flow_control(struct sk_buff *skb, } ep = rmnet_get_endpoint(port, mux_id); + if (!ep) { + kfree_skb(skb); + return RX_HANDLER_CONSUMED; + } + vnd = ep->egress_dev; ip_family = cmd->flow_control.ip_family; -- 1.9.1