From c859bb1d2be4d957f77d9a720f6a3a57f8e0d657 Mon Sep 17 00:00:00 2001 From: Subash Abhinov Kasiviswanathan Date: Fri, 13 Nov 2020 00:46:40 -0700 Subject: [PATCH 1/2] core: Fix incorrect receive packet handling during cleanup During rmnet unregistration, the real device rx_handler is first cleared followed by the removal of rx_handler_data after the rcu synchronization. Any packets in the receive path may observe that the rx_handler is NULL. However, there is no check when dereferencing this value to use the rmnet_port information. This fixes following splat by adding the NULL check. Unable to handle kernel NULL pointer dereference at virtual address 000000000000000d pc : rmnet_rx_handler+0x124/0x284 lr : rmnet_rx_handler+0x124/0x284 rmnet_rx_handler+0x124/0x284 __netif_receive_skb_core+0x758/0xd74 __netif_receive_skb+0x50/0x17c process_backlog+0x15c/0x1b8 napi_poll+0x88/0x284 net_rx_action+0xbc/0x23c __do_softirq+0x20c/0x48c CRs-Fixed: 2818544 Change-Id: I766db0b75469f2f049eb226daa7de9ba413d8f59 Signed-off-by: Subash Abhinov Kasiviswanathan --- core/rmnet_handlers.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/rmnet_handlers.c b/core/rmnet_handlers.c index a640710c70ad..4f005583c07a 100644 --- a/core/rmnet_handlers.c +++ b/core/rmnet_handlers.c @@ -397,6 +397,11 @@ rx_handler_result_t rmnet_rx_handler(struct sk_buff **pskb) 0xDEF, 0xDEF, 0xDEF, NULL, NULL); dev = skb->dev; port = rmnet_get_port(dev); + if (unlikely(!port)) { + atomic_long_inc(&skb->dev->rx_nohandler); + kfree_skb(skb); + goto done; + } switch (port->rmnet_mode) { case RMNET_EPMODE_VND: From 607125c52c9971f34e472d01d933fbf3bcfd9623 Mon Sep 17 00:00:00 2001 From: Chinmay Agarwal Date: Tue, 17 Nov 2020 11:46:07 +0530 Subject: [PATCH 2/2] datarmnet: Enable rmnet_core and rmnet_ctl for monaco Enabling rmnet_core and rmnet_ctl for monaco target. Change-Id: I55a7e50ae9b79090588d745240e139a789d302e0 Signed-off-by: Chinmay Agarwal --- core/Android.mk | 1 + datarmnet_dlkm_vendor_board.mk | 1 + 2 files changed, 2 insertions(+) diff --git a/core/Android.mk b/core/Android.mk index 50ef9864dbe3..341eaf859dc2 100644 --- a/core/Android.mk +++ b/core/Android.mk @@ -1,6 +1,7 @@ ifneq ($(TARGET_PRODUCT),qssi) RMNET_CORE_DLKM_PLATFORMS_LIST := lahaina RMNET_CORE_DLKM_PLATFORMS_LIST += holi +RMNET_CORE_DLKM_PLATFORMS_LIST += monaco ifeq ($(call is-board-platform-in-list, $(RMNET_CORE_DLKM_PLATFORMS_LIST)),true) #Make file to create RMNET_CORE DLKM diff --git a/datarmnet_dlkm_vendor_board.mk b/datarmnet_dlkm_vendor_board.mk index 44a2c8ba6878..3eb26a9fc94d 100644 --- a/datarmnet_dlkm_vendor_board.mk +++ b/datarmnet_dlkm_vendor_board.mk @@ -1,6 +1,7 @@ #Build rmnet core DATA_DLKM_BOARD_PLATFORMS_LIST := lahaina DATA_DLKM_BOARD_PLATFORMS_LIST += holi +DATA_DLKM_BOARD_PLATFORMS_LIST += monaco ifneq ($(TARGET_BOARD_AUTO),true) ifeq ($(call is-board-platform-in-list,$(DATA_DLKM_BOARD_PLATFORMS_LIST)),true) BOARD_VENDOR_KERNEL_MODULES += $(KERNEL_MODULES_OUT)/rmnet_core.ko