Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 117a9331 authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan
Browse files

net: rmnet_data: Fix memory corruption in gro tracepoint 



skb's passed to the network stack through napi_gro_receive can
be freed before it is used in the gro tracepoint to print the
ingress device.

Fix this by removing the skb as an argument. We could copy the
skb->dev to a string before passing it to napi_gro_receive and then
use it as an argument for the tracepoint but that would mean
unnecessary code in hotpath for debugging purposes.

Change-Id: I82055dbc9b84f405e8f63f7b2eeb7c80e5ae0c3a
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
parent 861a4ae9

net/rmnet_data/rmnet_data_handlers.c

+1 −2
Original line number Diff line number Diff line
@@ -215,8 +215,7 @@ static rx_handler_result_t __rmnet_deliver_skb(struct sk_buff *skb, 
				napi = get_current_napi_context();

				if (napi != NULL) {

					gro_res = napi_gro_receive(napi, skb);

					trace_rmnet_gro_downlink(skb->dev,

						gro_res);

					trace_rmnet_gro_downlink(gro_res);

				} else {

					WARN_ONCE(1, "current napi is NULL\n");

					netif_receive_skb(skb);

net/rmnet_data/rmnet_data_trace.h

+3 −6
Original line number Diff line number Diff line
@@ -308,22 +308,19 @@ DEFINE_EVENT(rmnet_physdev_action_template, rmnet_unassociate, 


TRACE_EVENT(rmnet_gro_downlink,



	TP_PROTO(struct net_device *dev, gro_result_t gro_res),

	TP_PROTO(gro_result_t gro_res),



	TP_ARGS(dev, gro_res),

	TP_ARGS(gro_res),



	TP_STRUCT__entry(

		__string(name, dev->name)

		__field(gro_result_t, res)

	),



	TP_fast_assign(

		__assign_str(name, dev->name);

		__entry->res = gro_res;

	),



	TP_printk("GRO on dev=%s, res: %d",

		__get_str(name), __entry->res)

	TP_printk("GRO res: %d", __entry->res)

)



#endif /* _RMNET_DATA_TRACE_H_ */