dfc: fix use-after-free

When IPA failed to send a QMAP packet, the skb is freed in IPA so
accessing the skb after IPA failure will result in use-after-free.

Remove the skb access after IPA send failure.

Change-Id: Id5f876d68e8ecae6c8d7e07c99a9f842fbbf51c1
Signed-off-by: Weiyi Chen <[email protected]>

core/rmnet_ctl_client.c

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * RMNET_CTL client handlers
  *
@@ -180,8 +181,10 @@ int rmnet_ctl_send_client(void *handle, struct sk_buff *skb)
 	struct rmnet_ctl_dev *dev;
 	int rc = -EINVAL;
 
-	if (client != rcu_dereference(ctl_ep.client))
+	if (client != rcu_dereference(ctl_ep.client)) {
+		kfree_skb(skb);
 		return rc;
+	}
 
 	rmnet_ctl_log_info("TX", skb->data, skb->len);
 
@@ -190,11 +193,13 @@ int rmnet_ctl_send_client(void *handle, struct sk_buff *skb)
 	dev = rcu_dereference(ctl_ep.dev);
 	if (dev && dev->xmit)
 		rc = dev->xmit(dev, skb);
+	else
+		kfree_skb(skb);
 
 	rcu_read_unlock();
 
 	if (rc)
-		rmnet_ctl_log_err("TXE", rc, skb->data, skb->len);
+		rmnet_ctl_log_err("TXE", rc, NULL, 0);
 
 	return rc;
 }