Commit 9c5c6bfc authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan
Browse files

drivers: shs: Protect new flow cpu logic



The new flow cpu logic dereferences endpoint information but
does not hold the endpoint lock. This could potentially cause
an use after free as these elements could be freed from
the netdevice notifier which holds the endpoint lock.

Fixes the following-

1130.302097:   <6> Unable to handle kernel paging request at virtual address bd9e0912da8bb3e5
1130.302138:   <6> Modules linked in: rmnet_shs(O-) rmnet_perf(O) [last unloaded: rmnet_shs]
1130.302213:   <2> pc : rmnet_shs_wq_get_lpwr_cpu_new_flow+0x2c/0xc8 [rmnet_shs]
1130.302224:   <2> lr : rmnet_shs_new_flow_cpu+0x34/0x138 [rmnet_shs]
1130.302305:   <2> Call trace:
1130.302317:   <2>  rmnet_shs_wq_get_lpwr_cpu_new_flow+0x2c/0xc8 [rmnet_shs]
1130.302328:   <2>  rmnet_shs_assign+0x188/0xc50 [rmnet_shs]
1130.302340:   <2>  rmnet_deliver_skb+0x134/0x228
1130.302344:   <2>  rmnet_frag_deliver+0x5d0/0x730
1130.302379:   <2>  rmnet_perf_core_send_desc+0x44/0x50 [rmnet_perf]
1130.302386:   <2>  rmnet_perf_opt_flush_single_flow_node+0x228/0x438 [rmnet_perf]
1130.302393:   <2>  rmnet_perf_opt_flush_all_flow_nodes+0x40/0x70 [rmnet_perf]
1130.302400:   <2>  rmnet_perf_core_handle_map_control_end+0x34/0x138 [rmnet_perf]
1130.302405:   <2>  rmnet_map_dl_trl_notify_v2+0x40/0x80
1130.302409:   <2>  rmnet_frag_flow_command+0x110/0x120
1130.302413:   <2>  rmnet_frag_ingress_handler+0x2c8/0x3c8
1130.302417:   <2>  rmnet_rx_handler+0x188/0x238
1130.302425:   <2>  __netif_receive_skb_core+0x444/0xb68
1130.302428:   <2>  process_backlog+0x170/0x390
1130.302431:   <2>  net_rx_action+0x134/0x548
1130.302439:   <2>  __do_softirq+0x1dc/0x384

CRs-fixed: 2594249
Change-Id: Ie4bcd300e340dc190ec88dd5d067cdd59b6d30eb
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent 0a1bb64f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment