ANDROID: net: netfilter: Add full sock check prior to uid lookup

commit 78e2baf3d9 ("net: add TIME_WAIT logic to sk_to_full_sk()")
updated the full socket lookup to return NULL for TIME_WAIT sockets.

Update the uid lookup to pick full sockets only (all states except for
TIME_WAIT and SYN_RECV) in the blamed ANDROID specific commit.
Fixes the following -

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000210
pc : reset_timer+0x84/0x120
lr : reset_timer+0x38/0x120
Call trace:
 reset_timer+0x84/0x120 (P)
 idletimer_tg_target_v1+0x68/0x9c
 ipt_do_table+0x31c/0x4d8
 iptable_mangle_hook+0xc4/0xe0
 nf_hook_slow+0x80/0x124
 ip_output+0xe4/0x10c
 ip_send_skb+0x68/0x108
 ip_send_unicast_reply+0x370/0x3cc
 tcp_v4_send_reset+0x304/0x458
 tcp_v4_rcv+0x9fc/0xf08
 ip_protocol_deliver_rcu+0x190/0x358
 ip_local_deliver_finish+0xa4/0x10c
 ip_local_deliver+0x78/0x100
 ip_rcv+0x8c/0x110
 process_backlog+0x14c/0x2f4
 __napi_poll+0x64/0x20c
 net_rx_action+0x184/0x3d0
 handle_softirqs+0x130/0x3f0
 __do_softirq+0x14/0x20
 ____do_softirq+0x10/0x20
 call_on_irq_stack+0x48/0x68
 do_softirq_own_stack+0x1c/0x2c
 __irq_exit_rcu+0x54/0xf4
 irq_exit_rcu+0x10/0x1c
 el1_interrupt+0x50/0xa8
 el1h_64_irq_handler+0x18/0x24
 el1h_64_irq+0x84/0x88
 finish_task_switch+0x94/0x27c (P)
 __schedule+0x8e4/0xec4
 schedule_idle+0x24/0x48
 do_idle+0x274/0x2bc
 cpu_startup_entry+0x34/0x3c
 rest_init+0xdc/0xe0
 start_kernel+0x35c/0x440
 __primary_switched+0x90/0x9c

Bug: 509990247
Fixes: 382e68666b ("ANDROID: core of xt_IDLETIMER send_nl_msg support")
Change-Id: I1a7ea11ad3d1fe3dda20491b9e6398ff2286da62
Signed-off-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
This commit is contained in:
Subash Abhinov Kasiviswanathan authored and android-test-infra-autosubmit@system.gserviceaccount.com committed 2026-05-06 02:17:58 -07:00
1 parent 08ee3c6b0a
commit 729dad03ba
1 file changed
+5 -2
+5 -2
View File
@@ -458,8 +458,11 @@ static void reset_timer(struct idletimer_tg * const info_timer,
/* Stores the uid resposible for waking up the radio */
if (skb && (skb->sk)) {
info_timer->uid = from_kuid_munged(current_user_ns(),
sk_uid(skb_to_full_sk(skb)));
struct sock *full_sk = skb_to_full_sk(skb);
if (full_sk)
info_timer->uid = from_kuid_munged(current_user_ns(),
sk_uid(full_sk));
}
/* checks if there is a pending inactive notification*/