]> git.baikalelectronics.ru Git - kernel.git/commit
net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
authorSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Fri, 13 Nov 2020 20:12:05 +0000 (13:12 -0700)
committerJakub Kicinski <kuba@kernel.org>
Tue, 17 Nov 2020 00:34:49 +0000 (16:34 -0800)
commitb2dd6065bcba6f080dec80d9c0c989e760118cb1
treee8e75cd3c40aac3b4aaaa1783656942338890ed0
parentbb75c6553ec6e348596b02078e90104a15246ad9
net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup

During rmnet unregistration, the real device rx_handler is first cleared
followed by the removal of rx_handler_data after the rcu synchronization.

Any packets in the receive path may observe that the rx_handler is NULL.
However, there is no check when dereferencing this value to use the
rmnet_port information.

This fixes following splat by adding the NULL check.

Unable to handle kernel NULL pointer dereference at virtual
address 000000000000000d
pc : rmnet_rx_handler+0x124/0x284
lr : rmnet_rx_handler+0x124/0x284
 rmnet_rx_handler+0x124/0x284
 __netif_receive_skb_core+0x758/0xd74
 __netif_receive_skb+0x50/0x17c
 process_backlog+0x15c/0x1b8
 napi_poll+0x88/0x284
 net_rx_action+0xbc/0x23c
 __do_softirq+0x20c/0x48c

Fixes: d1878d04ca05 ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Link: https://lore.kernel.org/r/1605298325-3705-1-git-send-email-subashab@codeaurora.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c