Commit f26b32ef authored Jul 14, 2023 by Vignesh Viswanathan Committed by David S. Miller Jul 17, 2023

net: qrtr: ns: Change nodes radix tree to xarray



There is a use after free scenario while iterating through the nodes
radix tree despite the ns being a single threaded process. This can
happen when the radix tree APIs are not synchronized with the
rcu_read_lock() APIs.

Convert the radix tree for nodes to xarray to take advantage of the
built in rcu lock usage provided by xarray.

Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Signed-off-by: Vignesh Viswanathan <quic_viswanat@quicinc.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 608a147a

net/qrtr/ns.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -16,7 +16,7 @@
		#define CREATE_TRACE_POINTS
		#include <trace/events/qrtr.h>

		static RADIX_TREE(nodes, GFP_KERNEL);
		static DEFINE_XARRAY(nodes);

		static struct {
		struct socket *sock;
		@@ -73,7 +73,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
		{
		struct qrtr_node *node;

		node = radix_tree_lookup(&nodes, node_id);
		node = xa_load(&nodes, node_id);
		if (node)
		return node;

		@@ -85,7 +85,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
		node->id = node_id;
		xa_init(&node->servers);

		if (radix_tree_insert(&nodes, node_id, node)) {
		if (xa_store(&nodes, node_id, node, GFP_KERNEL)) {
		kfree(node);
		return NULL;
		}