mirror of
https://github.com/torvalds/linux.git
synced 2026-08-02 13:22:02 +02:00
net: qrtr: ns: Change servers radix tree to xarray
There is a use after free scenario while iterating through the servers radix tree despite the ns being a single threaded process. This can happen when the radix tree APIs are not synchronized with the rcu_read_lock() APIs. Convert the radix tree for servers to xarray to take advantage of the built in rcu lock usage provided by xarray. Change-Id: I1d9b017da4efba9d8fc72e4666253060cc7b87e3 Signed-off-by: Chris Lew <quic_clew@quicinc.com>
This commit is contained in:
Chris Lew
parent
6ec2df4fa3
commit
06424dff8c
113
net/qrtr/ns.c
113
net/qrtr/ns.c
|
|
@ -3,6 +3,7 @@
|
|||
* Copyright (c) 2015, Sony Mobile Communications Inc.
|
||||
* Copyright (c) 2013, The Linux Foundation. All rights reserved.
|
||||
* Copyright (c) 2020, Linaro Ltd.
|
||||
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
|
||||
*/
|
||||
|
||||
#include <linux/module.h>
|
||||
|
|
@ -66,7 +67,7 @@ struct qrtr_server {
|
|||
|
||||
struct qrtr_node {
|
||||
unsigned int id;
|
||||
struct radix_tree_root servers;
|
||||
struct xarray servers;
|
||||
};
|
||||
|
||||
static struct qrtr_node *node_get(unsigned int node_id)
|
||||
|
|
@ -83,6 +84,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
|
|||
return NULL;
|
||||
|
||||
node->id = node_id;
|
||||
xa_init(&node->servers);
|
||||
|
||||
xa_store(&nodes, node_id, node, GFP_KERNEL);
|
||||
|
||||
|
|
@ -190,40 +192,24 @@ static void lookup_notify(struct sockaddr_qrtr *to, struct qrtr_server *srv,
|
|||
|
||||
static int announce_servers(struct sockaddr_qrtr *sq)
|
||||
{
|
||||
struct radix_tree_iter iter;
|
||||
struct qrtr_server *srv;
|
||||
struct qrtr_node *node;
|
||||
void __rcu **slot;
|
||||
unsigned long index;
|
||||
int ret;
|
||||
|
||||
node = node_get(qrtr_ns.local_node);
|
||||
if (!node)
|
||||
return 0;
|
||||
|
||||
rcu_read_lock();
|
||||
/* Announce the list of servers registered in this node */
|
||||
radix_tree_for_each_slot(slot, &node->servers, &iter, 0) {
|
||||
srv = radix_tree_deref_slot(slot);
|
||||
if (!srv)
|
||||
continue;
|
||||
if (radix_tree_deref_retry(srv)) {
|
||||
slot = radix_tree_iter_retry(&iter);
|
||||
continue;
|
||||
}
|
||||
slot = radix_tree_iter_resume(slot, &iter);
|
||||
rcu_read_unlock();
|
||||
|
||||
xa_for_each(&node->servers, index, srv) {
|
||||
ret = service_announce_new(sq, srv);
|
||||
if (ret < 0) {
|
||||
pr_err("failed to announce new service\n");
|
||||
return ret;
|
||||
}
|
||||
|
||||
rcu_read_lock();
|
||||
}
|
||||
|
||||
rcu_read_unlock();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -253,14 +239,17 @@ static struct qrtr_server *server_add(unsigned int service,
|
|||
goto err;
|
||||
|
||||
/* Delete the old server on the same port */
|
||||
old = radix_tree_lookup(&node->servers, port);
|
||||
old = xa_store(&node->servers, port, srv, GFP_KERNEL);
|
||||
if (old) {
|
||||
radix_tree_delete(&node->servers, port);
|
||||
kfree(old);
|
||||
if (xa_is_err(old)) {
|
||||
pr_err("failed to add server [0x%x:0x%x] ret:%d\n",
|
||||
srv->service, srv->instance, xa_err(old));
|
||||
goto err;
|
||||
} else {
|
||||
kfree(old);
|
||||
}
|
||||
}
|
||||
|
||||
radix_tree_insert(&node->servers, port, srv);
|
||||
|
||||
trace_qrtr_ns_server_add(srv->service, srv->instance,
|
||||
srv->node, srv->port);
|
||||
|
||||
|
|
@ -277,11 +266,11 @@ static int server_del(struct qrtr_node *node, unsigned int port)
|
|||
struct qrtr_server *srv;
|
||||
struct list_head *li;
|
||||
|
||||
srv = radix_tree_lookup(&node->servers, port);
|
||||
srv = xa_load(&node->servers, port);
|
||||
if (!srv)
|
||||
return -ENOENT;
|
||||
|
||||
radix_tree_delete(&node->servers, port);
|
||||
xa_erase(&node->servers, port);
|
||||
|
||||
/* Broadcast the removal of local servers */
|
||||
if (srv->node == qrtr_ns.local_node)
|
||||
|
|
@ -341,13 +330,12 @@ static int ctrl_cmd_hello(struct sockaddr_qrtr *sq)
|
|||
static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
|
||||
{
|
||||
struct qrtr_node *local_node;
|
||||
struct radix_tree_iter iter;
|
||||
struct qrtr_ctrl_pkt pkt;
|
||||
struct qrtr_server *srv;
|
||||
struct sockaddr_qrtr sq;
|
||||
struct msghdr msg = { };
|
||||
struct qrtr_node *node;
|
||||
void __rcu **slot;
|
||||
unsigned long index;
|
||||
struct kvec iv;
|
||||
int ret;
|
||||
|
||||
|
|
@ -358,22 +346,9 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
|
|||
if (!node)
|
||||
return 0;
|
||||
|
||||
rcu_read_lock();
|
||||
/* Advertise removal of this client to all servers of remote node */
|
||||
radix_tree_for_each_slot(slot, &node->servers, &iter, 0) {
|
||||
srv = radix_tree_deref_slot(slot);
|
||||
if (!srv)
|
||||
continue;
|
||||
if (radix_tree_deref_retry(srv)) {
|
||||
slot = radix_tree_iter_retry(&iter);
|
||||
continue;
|
||||
}
|
||||
slot = radix_tree_iter_resume(slot, &iter);
|
||||
rcu_read_unlock();
|
||||
xa_for_each(&node->servers, index, srv)
|
||||
server_del(node, srv->port);
|
||||
rcu_read_lock();
|
||||
}
|
||||
rcu_read_unlock();
|
||||
|
||||
/* Advertise the removal of this client to all local servers */
|
||||
local_node = node_get(qrtr_ns.local_node);
|
||||
|
|
@ -384,18 +359,7 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
|
|||
pkt.cmd = cpu_to_le32(QRTR_TYPE_BYE);
|
||||
pkt.client.node = cpu_to_le32(from->sq_node);
|
||||
|
||||
rcu_read_lock();
|
||||
radix_tree_for_each_slot(slot, &local_node->servers, &iter, 0) {
|
||||
srv = radix_tree_deref_slot(slot);
|
||||
if (!srv)
|
||||
continue;
|
||||
if (radix_tree_deref_retry(srv)) {
|
||||
slot = radix_tree_iter_retry(&iter);
|
||||
continue;
|
||||
}
|
||||
slot = radix_tree_iter_resume(slot, &iter);
|
||||
rcu_read_unlock();
|
||||
|
||||
xa_for_each(&local_node->servers, index, srv) {
|
||||
sq.sq_family = AF_QIPCRTR;
|
||||
sq.sq_node = srv->node;
|
||||
sq.sq_port = srv->port;
|
||||
|
|
@ -408,11 +372,8 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
|
|||
pr_err("failed to send bye cmd\n");
|
||||
return ret;
|
||||
}
|
||||
rcu_read_lock();
|
||||
}
|
||||
|
||||
rcu_read_unlock();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -420,7 +381,6 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
|
|||
unsigned int node_id, unsigned int port)
|
||||
{
|
||||
struct qrtr_node *local_node;
|
||||
struct radix_tree_iter iter;
|
||||
struct qrtr_lookup *lookup;
|
||||
struct qrtr_ctrl_pkt pkt;
|
||||
struct msghdr msg = { };
|
||||
|
|
@ -429,7 +389,7 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
|
|||
struct qrtr_node *node;
|
||||
struct list_head *tmp;
|
||||
struct list_head *li;
|
||||
void __rcu **slot;
|
||||
unsigned long index;
|
||||
struct kvec iv;
|
||||
int ret;
|
||||
|
||||
|
|
@ -471,18 +431,7 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
|
|||
pkt.client.node = cpu_to_le32(node_id);
|
||||
pkt.client.port = cpu_to_le32(port);
|
||||
|
||||
rcu_read_lock();
|
||||
radix_tree_for_each_slot(slot, &local_node->servers, &iter, 0) {
|
||||
srv = radix_tree_deref_slot(slot);
|
||||
if (!srv)
|
||||
continue;
|
||||
if (radix_tree_deref_retry(srv)) {
|
||||
slot = radix_tree_iter_retry(&iter);
|
||||
continue;
|
||||
}
|
||||
slot = radix_tree_iter_resume(slot, &iter);
|
||||
rcu_read_unlock();
|
||||
|
||||
xa_for_each(&local_node->servers, index, srv) {
|
||||
sq.sq_family = AF_QIPCRTR;
|
||||
sq.sq_node = srv->node;
|
||||
sq.sq_port = srv->port;
|
||||
|
|
@ -495,11 +444,8 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
|
|||
pr_err("failed to send del client cmd\n");
|
||||
return ret;
|
||||
}
|
||||
rcu_read_lock();
|
||||
}
|
||||
|
||||
rcu_read_unlock();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -571,11 +517,11 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
|
|||
unsigned int service, unsigned int instance)
|
||||
{
|
||||
struct qrtr_server_filter filter;
|
||||
struct radix_tree_iter srv_iter;
|
||||
struct qrtr_lookup *lookup;
|
||||
struct qrtr_server *srv;
|
||||
struct qrtr_node *node;
|
||||
unsigned long node_idx;
|
||||
void __rcu **srv_slot;
|
||||
unsigned long srv_idx;
|
||||
|
||||
/* Accept only local observers */
|
||||
if (from->sq_node != qrtr_ns.local_node)
|
||||
|
|
@ -595,23 +541,10 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
|
|||
filter.instance = instance;
|
||||
|
||||
xa_for_each(&nodes, node_idx, node) {
|
||||
radix_tree_for_each_slot(srv_slot, &node->servers,
|
||||
&srv_iter, 0) {
|
||||
struct qrtr_server *srv;
|
||||
|
||||
srv = radix_tree_deref_slot(srv_slot);
|
||||
if (!srv)
|
||||
continue;
|
||||
if (radix_tree_deref_retry(srv)) {
|
||||
srv_slot = radix_tree_iter_retry(&srv_iter);
|
||||
continue;
|
||||
}
|
||||
|
||||
xa_for_each(&node->servers, srv_idx, srv) {
|
||||
if (!server_match(srv, &filter))
|
||||
continue;
|
||||
|
||||
srv_slot = radix_tree_iter_resume(srv_slot, &srv_iter);
|
||||
|
||||
lookup_notify(from, srv, true);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user