Skip to content

Commit

Permalink
net: qrtr: ns: Change nodes radix tree to xarray
Browse files Browse the repository at this point in the history
There is a use after free scenario while iterating through the nodes
radix tree despite the ns being a single threaded process. This can
happen when the radix tree APIs are not synchronized with the
rcu_read_lock() APIs.

Convert the radix tree for nodes to xarray to take advantage of the
built in rcu lock usage provided by xarray.

Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Signed-off-by: Vignesh Viswanathan <quic_viswanat@quicinc.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Vignesh Viswanathan authored and David S. Miller committed Jul 17, 2023
1 parent 608a147 commit f26b32e
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions net/qrtr/ns.c
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
#define CREATE_TRACE_POINTS
#include <trace/events/qrtr.h>

static RADIX_TREE(nodes, GFP_KERNEL);
static DEFINE_XARRAY(nodes);

static struct {
struct socket *sock;
Expand Down Expand Up @@ -73,7 +73,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
{
struct qrtr_node *node;

node = radix_tree_lookup(&nodes, node_id);
node = xa_load(&nodes, node_id);
if (node)
return node;

Expand All @@ -85,7 +85,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
node->id = node_id;
xa_init(&node->servers);

if (radix_tree_insert(&nodes, node_id, node)) {
if (xa_store(&nodes, node_id, node, GFP_KERNEL)) {
kfree(node);
return NULL;
}
Expand Down

0 comments on commit f26b32e

Please sign in to comment.