drivers: rmnet_perf: Take lock during DL marker handling
Since handling DL markers can result in flushing the various flow nodes,
the rmnet_perf lock must be taken to ensure synchronization with the
rest of the driver. During hotplug scenarios, a regular flush could be
going on while a DL marker handling callback is invoked. In certain cases,
the callback can proceed farther than it should, and send a second pointer
to a previously flushed descriptor down the call chain. This phantom
descriptor can cause various problems, but the most "common" case seen
is a NULL dereference such as the following:
rmnet_frag_deliver+0x110/0x730
rmnet_perf_core_send_desc+0x44/0x50 [rmnet_perf]
rmnet_perf_opt_flush_single_flow_node+0x220/0x430 [rmnet_perf]
rmnet_perf_opt_flush_all_flow_nodes+0x40/0x70 [rmnet_perf]
rmnet_perf_core_handle_map_control_start+0x38/0x130 [rmnet_perf]
rmnet_map_dl_hdr_notify_v2+0x3c/0x58
rmnet_frag_flow_command+0x104/0x120
rmnet_frag_ingress_handler+0x2c8/0x3c8
rmnet_rx_handler+0x188/0x238
Change-Id: I79cb626732358c827d6c9df4239c0c55821bd3a5
Signed-off-by:
Sean Tranchetti <stranche@codeaurora.org>
Loading
Please register or sign in to comment