diff options
| author | Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> | 2015-06-10 11:26:17 -0600 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-22 11:05:37 -0700 |
| commit | 0eb441dce89685b63a28a33207b2b7efd625b172 (patch) | |
| tree | fabe67c89ac4103c0e1e06641c53e1f72a6720e3 | |
| parent | ea9757ee26e5c76583e6807674cb041ffbc8e18f (diff) | |
net: rmnet_data: Fix memory corruption in gro tracepoint
skb's passed to the network stack through napi_gro_receive can
be freed before it is used in the gro tracepoint to print the
ingress device.
Fix this by removing the skb as an argument. We could copy the
skb->dev to a string before passing it to napi_gro_receive and then
use it as an argument for the tracepoint but that would mean
unnecessary code in hotpath for debugging purposes.
Change-Id: I82055dbc9b84f405e8f63f7b2eeb7c80e5ae0c3a
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
| -rw-r--r-- | net/rmnet_data/rmnet_data_handlers.c | 3 | ||||
| -rw-r--r-- | net/rmnet_data/rmnet_data_trace.h | 9 |
2 files changed, 4 insertions, 8 deletions
diff --git a/net/rmnet_data/rmnet_data_handlers.c b/net/rmnet_data/rmnet_data_handlers.c index f6d4ca01fb55..833eb7f4a6c0 100644 --- a/net/rmnet_data/rmnet_data_handlers.c +++ b/net/rmnet_data/rmnet_data_handlers.c @@ -215,8 +215,7 @@ static rx_handler_result_t __rmnet_deliver_skb(struct sk_buff *skb, napi = get_current_napi_context(); if (napi != NULL) { gro_res = napi_gro_receive(napi, skb); - trace_rmnet_gro_downlink(skb->dev, - gro_res); + trace_rmnet_gro_downlink(gro_res); } else { WARN_ONCE(1, "current napi is NULL\n"); netif_receive_skb(skb); diff --git a/net/rmnet_data/rmnet_data_trace.h b/net/rmnet_data/rmnet_data_trace.h index 2760b717a57d..9ec507706f17 100644 --- a/net/rmnet_data/rmnet_data_trace.h +++ b/net/rmnet_data/rmnet_data_trace.h @@ -308,22 +308,19 @@ DEFINE_EVENT(rmnet_physdev_action_template, rmnet_unassociate, TRACE_EVENT(rmnet_gro_downlink, - TP_PROTO(struct net_device *dev, gro_result_t gro_res), + TP_PROTO(gro_result_t gro_res), - TP_ARGS(dev, gro_res), + TP_ARGS(gro_res), TP_STRUCT__entry( - __string(name, dev->name) __field(gro_result_t, res) ), TP_fast_assign( - __assign_str(name, dev->name); __entry->res = gro_res; ), - TP_printk("GRO on dev=%s, res: %d", - __get_str(name), __entry->res) + TP_printk("GRO res: %d", __entry->res) ) #endif /* _RMNET_DATA_TRACE_H_ */ |