Commit 6f253f11 authored Nov 20, 2019 by Sean Tranchetti

drivers: rmnet_perf: Check for over pulling



Much like the core driver, we must check for the return value of
rmnet_frag_pull() to ensure the descriptor is still valid before
continuing to process it.

Call Trace:
	__memcpy+0x68/0x180
	rmnet_perf_core_send_desc+0x48/0x58 [rmnet_perf]
	rmnet_perf_opt_flush_single_flow_node+0x244/0x458 [rmnet_perf]
	rmnet_perf_tcp_opt_ingress+0x228/0x270 [rmnet_perf]
	rmnet_perf_opt_ingress+0x34c/0x3a0 [rmnet_perf]
	rmnet_perf_core_desc_entry+0x114/0x168 [rmnet_perf]

Change-Id: I6665d7410bcdb6880af1ca20822328f81a2cc0ec
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>

parent ceaa8bcb

drivers/rmnet/perf/rmnet_perf_opt.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -318,10 +318,12 @@ rmnet_perf_opt_add_flow_subfrags(struct rmnet_perf_opt_flow_node *flow_node)

		new_frag = pkt_list[i].frag_desc;
		/* Pull headers if they're there */
		if (new_frag->hdr_ptr == rmnet_frag_data_ptr(new_frag))
		rmnet_frag_pull(new_frag, perf->rmnet_port,
		if (new_frag->hdr_ptr == rmnet_frag_data_ptr(new_frag)) {
		if (!rmnet_frag_pull(new_frag, perf->rmnet_port,
		flow_node->ip_len +
		flow_node->trans_len);
		flow_node->trans_len))
		continue;
		}

		/* Move the fragment onto the subfrags list */
		list_move_tail(&new_frag->list, &head_frag->sub_frags);