From 67789fda415da7e342361f59add9b78b43362a37 Mon Sep 17 00:00:00 2001 From: Chris Lew Date: Thu, 27 Oct 2022 11:07:12 -0700 Subject: [PATCH] net: qrtr: hold ept sem lock before node lookup Node ref count decrement and test is performed inside ept sem lock while node lookup is done inside node spin lock. This can sometime cause node lookup to succeed while parallely node can be freed in node release function. This will further use of node and will result in use after free. Additionally hold ept smem lock before performing node lookup. Change-Id: Iaa5781c56ebee51611dfea9fddcde50f1367dfea Signed-off-by: Deepak Kumar Singh Signed-off-by: Jay Jayanna Signed-off-by: Chris Lew --- net/qrtr/af_qrtr.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c index 6ec1526c182f..df6447b0c77d 100644 --- a/net/qrtr/af_qrtr.c +++ b/net/qrtr/af_qrtr.c @@ -479,10 +479,12 @@ static struct qrtr_node *qrtr_node_lookup(unsigned int nid) struct qrtr_node *node; unsigned long flags; + down_read(&qrtr_epts_lock); spin_lock_irqsave(&qrtr_nodes_lock, flags); node = radix_tree_lookup(&qrtr_nodes, nid); node = qrtr_node_acquire(node); spin_unlock_irqrestore(&qrtr_nodes_lock, flags); + up_read(&qrtr_epts_lock); return node; }