Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit b9ca96bd authored by Sean Tranchetti's avatar Sean Tranchetti Committed by Gerrit - the friendly Code Review server
Browse files

drivers: rmnet_perf: Take lock during DL marker handling



Since handling DL markers can result in flushing the various flow nodes,
the rmnet_perf lock must be taken to ensure synchronization with the
rest of the driver. During hotplug scenarios, a regular flush could be
going on while a DL marker handling callback is invoked. In certain cases,
the callback can proceed farther than it should, and send a second pointer
to a previously flushed descriptor down the call chain. This phantom
descriptor can cause various problems, but the most "common" case seen
is a NULL dereference such as the following:
	rmnet_frag_deliver+0x110/0x730
	rmnet_perf_core_send_desc+0x44/0x50 [rmnet_perf]
	rmnet_perf_opt_flush_single_flow_node+0x220/0x430 [rmnet_perf]
	rmnet_perf_opt_flush_all_flow_nodes+0x40/0x70 [rmnet_perf]
	rmnet_perf_core_handle_map_control_start+0x38/0x130 [rmnet_perf]
	rmnet_map_dl_hdr_notify_v2+0x3c/0x58
	rmnet_frag_flow_command+0x104/0x120
	rmnet_frag_ingress_handler+0x2c8/0x3c8
	rmnet_rx_handler+0x188/0x238

Change-Id: I79cb626732358c827d6c9df4239c0c55821bd3a5
Signed-off-by: default avatarSean Tranchetti <stranche@codeaurora.org>
parent c390153e
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment