Skip to content

Commit

Permalink
Merge branch 'qrtr-fixes'
Browse files Browse the repository at this point in the history 
Vignesh Viswanathan says:

====================
net: qrtr: Few fixes in QRTR

Add fixes in QRTR ns to change server and nodes radix tree to xarray to
avoid a use-after-free while iterating through the server or nodes
radix tree.

Also fix the destination port value for IPCR control buffer on older
targets.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
David S. Miller committed Jul 17, 2023
2 parents 89e970e + 69940b8 commit ae02f8d
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 112 deletions.
5 changes: 5 additions & 0 deletions net/qrtr/af_qrtr.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@
#define QRTR_EPH_PORT_RANGE \
XA_LIMIT(QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET)

#define QRTR_PORT_CTRL_LEGACY 0xffff

/**
* struct qrtr_hdr_v1 - (I|R)PCrouter packet header version 1
* @version: protocol version
Expand Down Expand Up @@ -495,6 +497,9 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
goto err;
}

if (cb->dst_port == QRTR_PORT_CTRL_LEGACY)
cb->dst_port = QRTR_PORT_CTRL;

if (!size || len != ALIGN(size, 4) + hdrlen)
goto err;

Expand Down
139 changes: 27 additions & 112 deletions net/qrtr/ns.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
#define CREATE_TRACE_POINTS
#include <trace/events/qrtr.h>

static RADIX_TREE(nodes, GFP_KERNEL);
static DEFINE_XARRAY(nodes);

static struct {
struct socket *sock;
Expand Down Expand Up @@ -66,14 +66,14 @@ struct qrtr_server {

struct qrtr_node {
unsigned int id;
struct radix_tree_root servers;
struct xarray servers;
};

static struct qrtr_node *node_get(unsigned int node_id)
{
struct qrtr_node *node;

node = radix_tree_lookup(&nodes, node_id);
node = xa_load(&nodes, node_id);
if (node)
return node;

Expand All @@ -83,8 +83,9 @@ static struct qrtr_node *node_get(unsigned int node_id)
return NULL;

node->id = node_id;
xa_init(&node->servers);

if (radix_tree_insert(&nodes, node_id, node)) {
if (xa_store(&nodes, node_id, node, GFP_KERNEL)) {
kfree(node);
return NULL;
}
Expand Down Expand Up @@ -193,40 +194,23 @@ static void lookup_notify(struct sockaddr_qrtr *to, struct qrtr_server *srv,

static int announce_servers(struct sockaddr_qrtr *sq)
{
struct radix_tree_iter iter;
struct qrtr_server *srv;
struct qrtr_node *node;
void __rcu **slot;
unsigned long index;
int ret;

node = node_get(qrtr_ns.local_node);
if (!node)
return 0;

rcu_read_lock();
/* Announce the list of servers registered in this node */
radix_tree_for_each_slot(slot, &node->servers, &iter, 0) {
srv = radix_tree_deref_slot(slot);
if (!srv)
continue;
if (radix_tree_deref_retry(srv)) {
slot = radix_tree_iter_retry(&iter);
continue;
}
slot = radix_tree_iter_resume(slot, &iter);
rcu_read_unlock();

xa_for_each(&node->servers, index, srv) {
ret = service_announce_new(sq, srv);
if (ret < 0) {
pr_err("failed to announce new service\n");
return ret;
}

rcu_read_lock();
}

rcu_read_unlock();

return 0;
}

Expand Down Expand Up @@ -256,14 +240,17 @@ static struct qrtr_server *server_add(unsigned int service,
goto err;

/* Delete the old server on the same port */
old = radix_tree_lookup(&node->servers, port);
old = xa_store(&node->servers, port, srv, GFP_KERNEL);
if (old) {
radix_tree_delete(&node->servers, port);
kfree(old);
if (xa_is_err(old)) {
pr_err("failed to add server [0x%x:0x%x] ret:%d\n",
srv->service, srv->instance, xa_err(old));
goto err;
} else {
kfree(old);
}
}

radix_tree_insert(&node->servers, port, srv);

trace_qrtr_ns_server_add(srv->service, srv->instance,
srv->node, srv->port);

Expand All @@ -280,11 +267,11 @@ static int server_del(struct qrtr_node *node, unsigned int port, bool bcast)
struct qrtr_server *srv;
struct list_head *li;

srv = radix_tree_lookup(&node->servers, port);
srv = xa_load(&node->servers, port);
if (!srv)
return -ENOENT;

radix_tree_delete(&node->servers, port);
xa_erase(&node->servers, port);

/* Broadcast the removal of local servers */
if (srv->node == qrtr_ns.local_node && bcast)
Expand Down Expand Up @@ -344,13 +331,12 @@ static int ctrl_cmd_hello(struct sockaddr_qrtr *sq)
static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
{
struct qrtr_node *local_node;
struct radix_tree_iter iter;
struct qrtr_ctrl_pkt pkt;
struct qrtr_server *srv;
struct sockaddr_qrtr sq;
struct msghdr msg = { };
struct qrtr_node *node;
void __rcu **slot;
unsigned long index;
struct kvec iv;
int ret;

Expand All @@ -361,22 +347,9 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
if (!node)
return 0;

rcu_read_lock();
/* Advertise removal of this client to all servers of remote node */
radix_tree_for_each_slot(slot, &node->servers, &iter, 0) {
srv = radix_tree_deref_slot(slot);
if (!srv)
continue;
if (radix_tree_deref_retry(srv)) {
slot = radix_tree_iter_retry(&iter);
continue;
}
slot = radix_tree_iter_resume(slot, &iter);
rcu_read_unlock();
xa_for_each(&node->servers, index, srv)
server_del(node, srv->port, true);
rcu_read_lock();
}
rcu_read_unlock();

/* Advertise the removal of this client to all local servers */
local_node = node_get(qrtr_ns.local_node);
Expand All @@ -387,18 +360,7 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
pkt.cmd = cpu_to_le32(QRTR_TYPE_BYE);
pkt.client.node = cpu_to_le32(from->sq_node);

rcu_read_lock();
radix_tree_for_each_slot(slot, &local_node->servers, &iter, 0) {
srv = radix_tree_deref_slot(slot);
if (!srv)
continue;
if (radix_tree_deref_retry(srv)) {
slot = radix_tree_iter_retry(&iter);
continue;
}
slot = radix_tree_iter_resume(slot, &iter);
rcu_read_unlock();

xa_for_each(&local_node->servers, index, srv) {
sq.sq_family = AF_QIPCRTR;
sq.sq_node = srv->node;
sq.sq_port = srv->port;
Expand All @@ -411,19 +373,14 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
pr_err("failed to send bye cmd\n");
return ret;
}
rcu_read_lock();
}

rcu_read_unlock();

return 0;
}

static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
unsigned int node_id, unsigned int port)
{
struct qrtr_node *local_node;
struct radix_tree_iter iter;
struct qrtr_lookup *lookup;
struct qrtr_ctrl_pkt pkt;
struct msghdr msg = { };
Expand All @@ -432,7 +389,7 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
struct qrtr_node *node;
struct list_head *tmp;
struct list_head *li;
void __rcu **slot;
unsigned long index;
struct kvec iv;
int ret;

Expand Down Expand Up @@ -477,18 +434,7 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
pkt.client.node = cpu_to_le32(node_id);
pkt.client.port = cpu_to_le32(port);

rcu_read_lock();
radix_tree_for_each_slot(slot, &local_node->servers, &iter, 0) {
srv = radix_tree_deref_slot(slot);
if (!srv)
continue;
if (radix_tree_deref_retry(srv)) {
slot = radix_tree_iter_retry(&iter);
continue;
}
slot = radix_tree_iter_resume(slot, &iter);
rcu_read_unlock();

xa_for_each(&local_node->servers, index, srv) {
sq.sq_family = AF_QIPCRTR;
sq.sq_node = srv->node;
sq.sq_port = srv->port;
Expand All @@ -501,11 +447,7 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
pr_err("failed to send del client cmd\n");
return ret;
}
rcu_read_lock();
}

rcu_read_unlock();

return 0;
}

Expand Down Expand Up @@ -576,13 +518,12 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from,
static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
unsigned int service, unsigned int instance)
{
struct radix_tree_iter node_iter;
struct qrtr_server_filter filter;
struct radix_tree_iter srv_iter;
struct qrtr_lookup *lookup;
struct qrtr_server *srv;
struct qrtr_node *node;
void __rcu **node_slot;
void __rcu **srv_slot;
unsigned long node_idx;
unsigned long srv_idx;

/* Accept only local observers */
if (from->sq_node != qrtr_ns.local_node)
Expand All @@ -601,40 +542,14 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
filter.service = service;
filter.instance = instance;

rcu_read_lock();
radix_tree_for_each_slot(node_slot, &nodes, &node_iter, 0) {
node = radix_tree_deref_slot(node_slot);
if (!node)
continue;
if (radix_tree_deref_retry(node)) {
node_slot = radix_tree_iter_retry(&node_iter);
continue;
}
node_slot = radix_tree_iter_resume(node_slot, &node_iter);

radix_tree_for_each_slot(srv_slot, &node->servers,
&srv_iter, 0) {
struct qrtr_server *srv;

srv = radix_tree_deref_slot(srv_slot);
if (!srv)
continue;
if (radix_tree_deref_retry(srv)) {
srv_slot = radix_tree_iter_retry(&srv_iter);
continue;
}

xa_for_each(&nodes, node_idx, node) {
xa_for_each(&node->servers, srv_idx, srv) {
if (!server_match(srv, &filter))
continue;

srv_slot = radix_tree_iter_resume(srv_slot, &srv_iter);

rcu_read_unlock();
lookup_notify(from, srv, true);
rcu_read_lock();
}
}
rcu_read_unlock();

/* Empty notification, to indicate end of listing */
lookup_notify(from, NULL, true);
Expand Down

0 comments on commit ae02f8d

Please sign in to comment.