This is a note to let you know that I've just added the patch titled net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sun Nov 22 10:24:40 AM CET 2020 From: Subash Abhinov Kasiviswanathan <subashab@xxxxxxxxxxxxxx> Date: Fri, 13 Nov 2020 13:12:05 -0700 Subject: net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup From: Subash Abhinov Kasiviswanathan <subashab@xxxxxxxxxxxxxx> [ Upstream commit fc70f5bf5e525dde81565f0a30d5e39168062eba ] During rmnet unregistration, the real device rx_handler is first cleared followed by the removal of rx_handler_data after the rcu synchronization. Any packets in the receive path may observe that the rx_handler is NULL. However, there is no check when dereferencing this value to use the rmnet_port information. This fixes following splat by adding the NULL check. Unable to handle kernel NULL pointer dereference at virtual address 000000000000000d pc : rmnet_rx_handler+0x124/0x284 lr : rmnet_rx_handler+0x124/0x284 rmnet_rx_handler+0x124/0x284 __netif_receive_skb_core+0x758/0xd74 __netif_receive_skb+0x50/0x17c process_backlog+0x15c/0x1b8 napi_poll+0x88/0x284 net_rx_action+0xbc/0x23c __do_softirq+0x20c/0x48c Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Sean Tranchetti <stranche@xxxxxxxxxxxxxx> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@xxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/1605298325-3705-1-git-send-email-subashab@xxxxxxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c @@ -188,6 +188,11 @@ rx_handler_result_t rmnet_rx_handler(str dev = skb->dev; port = rmnet_get_port_rcu(dev); + if (unlikely(!port)) { + atomic_long_inc(&skb->dev->rx_nohandler); + kfree_skb(skb); + goto done; + } switch (port->rmnet_mode) { case RMNET_EPMODE_VND: Patches currently in stable-queue which might be from subashab@xxxxxxxxxxxxxx are queue-5.9/net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch