joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

net: rmnet_data: Check for context when freeing packing in TX path

Browse source 
If conntrack information is associated with a packet in TX path,
bh is enabled later in the stack leading to invalid contexts in
case there is a packet redirected from RX path. A sample call stack
is as follows -

[ 6996.976781] WARNING: CPU: 3 PID: 0 at kernel/softirq.c:168
__local_bh_enable_ip+0xa8/0x114

[ 6997.357481] [ffffff82c82b183c] __local_bh_enable_ip+0xa8/0x114
[ 6997.363542] [ffffff82c91457d4] destroy_conntrack+0xf8/0x1a8
[ 6997.369337] [ffffff82c913d840] nf_conntrack_destroy+0x34/0x48
[ 6997.375313] [ffffff82c90d9130] skb_release_head_state+0xd0/0xe8
[ 6997.381451] [ffffff82c90d947c] skb_release_all+0x20/0x3c
[ 6997.386983] [ffffff82c90d9248] kfree_skb+0x50/0x118
[ 6997.392083] [ffffff82c93391f4] rmnet_kfree_skb+0x60/0x70
[ 6997.397618] [ffffff82c9338120] rmnet_map_aggregate+0x184/0x638
[ 6997.403677] [ffffff82c9336d2c] rmnet_egress_handler+0x2e4/0x4a0
[ 6997.409818] [ffffff82c93356a8] rmnet_vnd_start_xmit+0x68/0x1b0
[ 6997.415877] [ffffff82c90f57c8] dev_hard_start_xmit+0xc4/0x29c
[ 6997.421844] [ffffff82c912275c] sch_direct_xmit+0x100/0x1cc
[ 6997.427549] [ffffff82c912294c] __qdisc_run+0x124/0x25c
[ 6997.432903] [ffffff82c90f5fa0] __dev_queue_xmit+0x29c/0x704
[ 6997.438699] [ffffff82c90f6430] dev_queue_xmit+0x28/0x34
[ 6997.444140] [ffffff82c910163c] neigh_direct_output+0x20/0x28
[ 6997.450029] [ffffff82c9183650] ip_finish_output2+0x1b4/0x3dc
[ 6997.455914] [ffffff82c91852c8] ip_finish_output+0x190/0x280
[ 6997.461704] [ffffff82c9185f70] ip_output+0x140/0x190
[ 6997.466889] [ffffff82c91869d8] ip_send_skb+0x5c/0xf0
[ 6997.472076] [ffffff82c9186aac] ip_push_pending_frames+0x40/0x5c
[ 6997.478221] [ffffff82c9186edc] ip_send_unicast_reply+0x240/0x2b4
[ 6997.484449] [ffffff82c91a56ac] tcp_v4_send_reset+0x1c0/0x2c8
[ 6997.490333] [ffffff82c91a871c] tcp_v4_rcv+0x680/0xabc
[ 6997.495599] [ffffff82c917fb90] ip_local_deliver_finish+0x10c/0x278
[ 6997.502009] [ffffff82c91802d0] ip_local_deliver+0x108/0x114
[ 6997.507809] [ffffff82c917fee0] ip_rcv_finish+0x1e4/0x384
[ 6997.513338] [ffffff82c918061c] ip_rcv+0x340/0x444
[ 6997.518255] [ffffff82c90edaa0] __netif_receive_skb_core+0x268/0xb7c
[ 6997.524751] [ffffff82c90f06fc] __netif_receive_skb+0x38/0x84
[ 6997.530629] [ffffff82c90f1430] process_backlog+0xd0/0x19c
[ 6997.536248] [ffffff82c90f3254] net_rx_action+0x260/0x3d8
[ 6997.541784] [ffffff82c8281b64] __do_softirq+0x144/0x468
[ 6997.547233] [ffffff82c82b1a64] irq_exit+0x118/0x144
[ 6997.552331] [ffffff82c8291810] handle_IPI+0x234/0x3c4
[ 6997.557598] [ffffff82c8281a14] gic_handle_irq+0x1a8/0x1b4

CRs-Fixed: 2180767
Change-Id: Ie9bfd4c9f9dcf64f26109a7e3eafe08b89063369
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
This commit is contained in:
Subash Abhinov Kasiviswanathan 2018-01-23 07:43:46 -07:00
commit 4c42be4f7c
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
net/rmnet_data/rmnet_map_data.c
View file

@ -292,7 +292,7 @@ new_packet:
config->agg_count = 1;
getnstimeofday(&config->agg_time);
trace_rmnet_start_aggregation(skb);
rmnet_kfree_skb(skb, RMNET_STATS_SKBFREE_AGG_CPY_EXPAND);
dev_kfree_skb_any(skb);
goto schedule;
}
diff = timespec_sub(config->agg_last, config->agg_time);
@ -321,7 +321,7 @@ new_packet:
dest_buff = skb_put(config->agg_skb, skb->len);
memcpy(dest_buff, skb->data, skb->len);
config->agg_count++;
rmnet_kfree_skb(skb, RMNET_STATS_SKBFREE_AGG_INTO_BUFF);
dev_kfree_skb_any(skb);
schedule:
if (config->agg_state != RMNET_MAP_TXFER_SCHEDULED) {