From c859bb1d2be4d957f77d9a720f6a3a57f8e0d657 Mon Sep 17 00:00:00 2001 From: Subash Abhinov Kasiviswanathan Date: Fri, 13 Nov 2020 00:46:40 -0700 Subject: [PATCH] core: Fix incorrect receive packet handling during cleanup During rmnet unregistration, the real device rx_handler is first cleared followed by the removal of rx_handler_data after the rcu synchronization. Any packets in the receive path may observe that the rx_handler is NULL. However, there is no check when dereferencing this value to use the rmnet_port information. This fixes following splat by adding the NULL check. Unable to handle kernel NULL pointer dereference at virtual address 000000000000000d pc : rmnet_rx_handler+0x124/0x284 lr : rmnet_rx_handler+0x124/0x284 rmnet_rx_handler+0x124/0x284 __netif_receive_skb_core+0x758/0xd74 __netif_receive_skb+0x50/0x17c process_backlog+0x15c/0x1b8 napi_poll+0x88/0x284 net_rx_action+0xbc/0x23c __do_softirq+0x20c/0x48c CRs-Fixed: 2818544 Change-Id: I766db0b75469f2f049eb226daa7de9ba413d8f59 Signed-off-by: Subash Abhinov Kasiviswanathan --- core/rmnet_handlers.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/rmnet_handlers.c b/core/rmnet_handlers.c index a640710c70ad..4f005583c07a 100644 --- a/core/rmnet_handlers.c +++ b/core/rmnet_handlers.c @@ -397,6 +397,11 @@ rx_handler_result_t rmnet_rx_handler(struct sk_buff **pskb) 0xDEF, 0xDEF, 0xDEF, NULL, NULL); dev = skb->dev; port = rmnet_get_port(dev); + if (unlikely(!port)) { + atomic_long_inc(&skb->dev->rx_nohandler); + kfree_skb(skb); + goto done; + } switch (port->rmnet_mode) { case RMNET_EPMODE_VND: