Commit c859bb1d authored Nov 13, 2020 by Subash Abhinov Kasiviswanathan

core: Fix incorrect receive packet handling during cleanup



During rmnet unregistration, the real device rx_handler is first cleared
followed by the removal of rx_handler_data after the rcu synchronization.

Any packets in the receive path may observe that the rx_handler is NULL.
However, there is no check when dereferencing this value to use the
rmnet_port information.

This fixes following splat by adding the NULL check.

Unable to handle kernel NULL pointer dereference at virtual
address 000000000000000d
pc : rmnet_rx_handler+0x124/0x284
lr : rmnet_rx_handler+0x124/0x284
 rmnet_rx_handler+0x124/0x284
 __netif_receive_skb_core+0x758/0xd74
 __netif_receive_skb+0x50/0x17c
 process_backlog+0x15c/0x1b8
 napi_poll+0x88/0x284
 net_rx_action+0xbc/0x23c
 __do_softirq+0x20c/0x48c

CRs-Fixed: 2818544
Change-Id: I766db0b75469f2f049eb226daa7de9ba413d8f59
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

parent b8fea6fa

core/rmnet_handlers.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -397,6 +397,11 @@ rx_handler_result_t rmnet_rx_handler(struct sk_buff **pskb)
		0xDEF, 0xDEF, 0xDEF, NULL, NULL);
		dev = skb->dev;
		port = rmnet_get_port(dev);
		if (unlikely(!port)) {
		atomic_long_inc(&skb->dev->rx_nohandler);
		kfree_skb(skb);
		goto done;
		}

		switch (port->rmnet_mode) {
		case RMNET_EPMODE_VND: