ANDROID: net: netfilter: Add full sock check prior to uid lookup
commit78e2baf3d9("net: add TIME_WAIT logic to sk_to_full_sk()") updated the full socket lookup to return NULL for TIME_WAIT sockets. Update the uid lookup to pick full sockets only (all states except for TIME_WAIT and SYN_RECV) in the blamed ANDROID specific commit. Fixes the following - Unable to handle kernel NULL pointer dereference at virtual address 0000000000000210 pc : reset_timer+0x84/0x120 lr : reset_timer+0x38/0x120 Call trace: reset_timer+0x84/0x120 (P) idletimer_tg_target_v1+0x68/0x9c ipt_do_table+0x31c/0x4d8 iptable_mangle_hook+0xc4/0xe0 nf_hook_slow+0x80/0x124 ip_output+0xe4/0x10c ip_send_skb+0x68/0x108 ip_send_unicast_reply+0x370/0x3cc tcp_v4_send_reset+0x304/0x458 tcp_v4_rcv+0x9fc/0xf08 ip_protocol_deliver_rcu+0x190/0x358 ip_local_deliver_finish+0xa4/0x10c ip_local_deliver+0x78/0x100 ip_rcv+0x8c/0x110 process_backlog+0x14c/0x2f4 __napi_poll+0x64/0x20c net_rx_action+0x184/0x3d0 handle_softirqs+0x130/0x3f0 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x20 call_on_irq_stack+0x48/0x68 do_softirq_own_stack+0x1c/0x2c __irq_exit_rcu+0x54/0xf4 irq_exit_rcu+0x10/0x1c el1_interrupt+0x50/0xa8 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x84/0x88 finish_task_switch+0x94/0x27c (P) __schedule+0x8e4/0xec4 schedule_idle+0x24/0x48 do_idle+0x274/0x2bc cpu_startup_entry+0x34/0x3c rest_init+0xdc/0xe0 start_kernel+0x35c/0x440 __primary_switched+0x90/0x9c Bug: 509990247 Fixes:382e68666b("ANDROID: core of xt_IDLETIMER send_nl_msg support") Change-Id: I1a7ea11ad3d1fe3dda20491b9e6398ff2286da62 Signed-off-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
This commit is contained in:
1 parent
08ee3c6b0a
commit
729dad03ba
1 file changed
+5
-2
@@ -458,8 +458,11 @@ static void reset_timer(struct idletimer_tg * const info_timer,
|
||||
|
||||
/* Stores the uid resposible for waking up the radio */
|
||||
if (skb && (skb->sk)) {
|
||||
info_timer->uid = from_kuid_munged(current_user_ns(),
|
||||
sk_uid(skb_to_full_sk(skb)));
|
||||
struct sock *full_sk = skb_to_full_sk(skb);
|
||||
|
||||
if (full_sk)
|
||||
info_timer->uid = from_kuid_munged(current_user_ns(),
|
||||
sk_uid(full_sk));
|
||||
}
|
||||
|
||||
/* checks if there is a pending inactive notification*/
|
||||
|
||||
Reference in new issue
Block a user