• Subash Abhinov Kasiviswanathan's avatar
    net: qualcomm: rmnet: Fix incorrect assignment of real_dev · d02854dc
    Subash Abhinov Kasiviswanathan authored
    A null dereference was observed when a sysctl was being set
    from userspace and rmnet was stuck trying to complete some actions
    in the NETDEV_REGISTER callback. This is because the real_dev is set
    only after the device registration handler completes.
    
    sysctl call stack -
    
    <6> Unable to handle kernel NULL pointer dereference at
        virtual address 00000108
    <2> pc : rmnet_vnd_get_iflink+0x1c/0x28
    <2> lr : dev_get_iflink+0x2c/0x40
    <2>  rmnet_vnd_get_iflink+0x1c/0x28
    <2>  inet6_fill_ifinfo+0x15c/0x234
    <2>  inet6_ifinfo_notify+0x68/0xd4
    <2>  ndisc_ifinfo_sysctl_change+0x1b8/0x234
    <2>  proc_sys_call_handler+0xac/0x100
    <2>  proc_sys_write+0x3c/0x4c
    <2>  __vfs_write+0x54/0x14c
    <2>  vfs_write+0xcc/0x188
    <2>  SyS_write+0x60/0xc0
    <2>  el0_svc_naked+0x34/0x38
    
    device register call stack -
    
    <2>  notifier_call_chain+0x84/0xbc
    <2>  raw_notifier_call_chain+0x38/0x48
    <2>  call_netdevice_notifiers_info+0x40/0x70
    <2>  call_netdevice_notifiers+0x38/0x60
    <2>  register_netdevice+0x29c/0x3d8
    <2>  rmnet_vnd_newlink+0x68/0xe8
    <2>  rmnet_newlink+0xa0/0x160
    <2>  rtnl_newlink+0x57c/0x6c8
    <2>  rtnetlink_rcv_msg+0x1dc/0x328
    <2>  netlink_rcv_skb+0xac/0x118
    <2>  rtnetlink_rcv+0x24/0x30
    <2>  netlink_unicast+0x158/0x1f0
    <2>  netlink_sendmsg+0x32c/0x338
    <2>  sock_sendmsg+0x44/0x60
    <2>  SyS_sendto+0x150/0x1ac
    <2>  el0_svc_naked+0x34/0x38
    
    Fixes: b752eff5 ("net: qualcomm: rmnet: Implement ndo_get_iflink")
    Signed-off-by: default avatarSean Tranchetti <stranche@codeaurora.org>
    Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d02854dc
rmnet_vnd.c 7.41 KB