소스 검색

rmnet_core: Avoid altering ep before synchronize_rcu()

rmnet_dellink() will handle freeing the endpoint information, but as this
structure is accessed via RCU on the packet path, care must be taken. It
is dangerous to alter any fields inside of it until it is guaranteed that
no one is currently accessing it.

pc : rmnet_frag_process_next_hdr_packet
lr : rmnet_frag_process_next_hdr_packet
Call trace:
  rmnet_frag_process_next_hdr_packet
  rmnet_frag_ingress_handler
  rmnet_rx_handler

Change-Id: I2410d941e370d1173eefd6e63049121285a1cb26
Signed-off-by: Sean Tranchetti <[email protected]>
Sean Tranchetti 3 년 전
부모
커밋
320db4b3c0
1개의 변경된 파일1개의 추가작업 그리고 1개의 파일을 삭제
  1. 1 1
      core/rmnet_config.c

+ 1 - 1
core/rmnet_config.c

@@ -275,9 +275,9 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
 	ep = rmnet_get_endpoint(port, mux_id);
 	if (ep) {
 		hlist_del_init_rcu(&ep->hlnode);
+		synchronize_rcu();
 		rmnet_unregister_bridge(dev, port);
 		rmnet_vnd_dellink(mux_id, port, ep);
-		synchronize_rcu();
 		kfree(ep);
 	}