drivers: shs: Protect new flow cpu logic
The new flow cpu logic dereferences endpoint information but
does not hold the endpoint lock. This could potentially cause
an use after free as these elements could be freed from
the netdevice notifier which holds the endpoint lock.
Fixes the following-
1130.302097: <6> Unable to handle kernel paging request at virtual address bd9e0912da8bb3e5
1130.302138: <6> Modules linked in: rmnet_shs(O-) rmnet_perf(O) [last unloaded: rmnet_shs]
1130.302213: <2> pc : rmnet_shs_wq_get_lpwr_cpu_new_flow+0x2c/0xc8 [rmnet_shs]
1130.302224: <2> lr : rmnet_shs_new_flow_cpu+0x34/0x138 [rmnet_shs]
1130.302305: <2> Call trace:
1130.302317: <2> rmnet_shs_wq_get_lpwr_cpu_new_flow+0x2c/0xc8 [rmnet_shs]
1130.302328: <2> rmnet_shs_assign+0x188/0xc50 [rmnet_shs]
1130.302340: <2> rmnet_deliver_skb+0x134/0x228
1130.302344: <2> rmnet_frag_deliver+0x5d0/0x730
1130.302379: <2> rmnet_perf_core_send_desc+0x44/0x50 [rmnet_perf]
1130.302386: <2> rmnet_perf_opt_flush_single_flow_node+0x228/0x438 [rmnet_perf]
1130.302393: <2> rmnet_perf_opt_flush_all_flow_nodes+0x40/0x70 [rmnet_perf]
1130.302400: <2> rmnet_perf_core_handle_map_control_end+0x34/0x138 [rmnet_perf]
1130.302405: <2> rmnet_map_dl_trl_notify_v2+0x40/0x80
1130.302409: <2> rmnet_frag_flow_command+0x110/0x120
1130.302413: <2> rmnet_frag_ingress_handler+0x2c8/0x3c8
1130.302417: <2> rmnet_rx_handler+0x188/0x238
1130.302425: <2> __netif_receive_skb_core+0x444/0xb68
1130.302428: <2> process_backlog+0x170/0x390
1130.302431: <2> net_rx_action+0x134/0x548
1130.302439: <2> __do_softirq+0x1dc/0x384
CRs-fixed: 2594249
Change-Id: Ie4bcd300e340dc190ec88dd5d067cdd59b6d30eb
Signed-off-by:
Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Loading
Please sign in to comment