浏览代码

rmnet_core: Avoid altering ep before synchronize_rcu()

rmnet_dellink() will handle freeing the endpoint information, but as this
structure is accessed via RCU on the packet path, care must be taken. It
is dangerous to alter any fields inside of it until it is guaranteed that
no one is currently accessing it.

pc : rmnet_frag_process_next_hdr_packet
lr : rmnet_frag_process_next_hdr_packet
Call trace:
  rmnet_frag_process_next_hdr_packet
  rmnet_frag_ingress_handler
  rmnet_rx_handler

Change-Id: I2410d941e370d1173eefd6e63049121285a1cb26
Signed-off-by: Sean Tranchetti <[email protected]>
Sean Tranchetti 3 年之前
父节点
当前提交
320db4b3c0
共有 1 个文件被更改,包括 1 次插入1 次删除
  1. 1 1
      core/rmnet_config.c

+ 1 - 1
core/rmnet_config.c

@@ -275,9 +275,9 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
 	ep = rmnet_get_endpoint(port, mux_id);
 	if (ep) {
 		hlist_del_init_rcu(&ep->hlnode);
+		synchronize_rcu();
 		rmnet_unregister_bridge(dev, port);
 		rmnet_vnd_dellink(mux_id, port, ep);
-		synchronize_rcu();
 		kfree(ep);
 	}