github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 17:13:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Merge branch 'net-qrtr-ns-a-bunch-of-fixs'

Browse Source 
Manivannan Sadhasivam says:

====================
net: qrtr: ns: A bunch of fixs

This series fixes a bunch of possible memory exhaustion issues in the QRTR
nameserver.
====================

Link: https://patch.msgid.link/20260409-qrtr-fix-v3-0-00a8a5ff2b51@oss.qualcomm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-04-13 15:34:09 -07:00
commit 9ad24ba408
1 changed files with 69 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
net/qrtr/ns.c
View File

@ -22,8 +22,10 @@ static struct {
struct socket *sock;
struct sockaddr_qrtr bcast_sq;
struct list_head lookups;
u32 lookup_count;
struct workqueue_struct *workqueue;
struct work_struct work;
void (*saved_data_ready)(struct sock *sk);
int local_node;
} qrtr_ns;
@ -67,8 +69,19 @@ struct qrtr_server {
struct qrtr_node {
unsigned int id;
struct xarray servers;
u32 server_count;
};
/* Max nodes, server, lookup limits are chosen based on the current platform
* requirements. If the requirement changes in the future, these values can be
* increased.
*/
#define QRTR_NS_MAX_NODES 64
#define QRTR_NS_MAX_SERVERS 256
#define QRTR_NS_MAX_LOOKUPS 64
static u8 node_count;
static struct qrtr_node *node_get(unsigned int node_id)
{
struct qrtr_node *node;
@ -77,6 +90,11 @@ static struct qrtr_node *node_get(unsigned int node_id)
if (node)
return node;
if (node_count >= QRTR_NS_MAX_NODES) {
pr_err_ratelimited("QRTR clients exceed max node limit!\n");
return NULL;
}
/* If node didn't exist, allocate and insert it to the tree */
node = kzalloc_obj(*node);
if (!node)
@ -90,6 +108,8 @@ static struct qrtr_node *node_get(unsigned int node_id)
return NULL;
}
node_count++;
return node;
}
@ -229,6 +249,17 @@ static struct qrtr_server *server_add(unsigned int service,
if (!service || !port)
return NULL;
node = node_get(node_id);
if (!node)
return NULL;
/* Make sure the new servers per port are capped at the maximum value */
old = xa_load(&node->servers, port);
if (!old && node->server_count >= QRTR_NS_MAX_SERVERS) {
pr_err_ratelimited("QRTR client node %u exceeds max server limit!\n", node_id);
return NULL;
}
srv = kzalloc_obj(*srv);
if (!srv)
return NULL;
@ -238,10 +269,6 @@ static struct qrtr_server *server_add(unsigned int service,
srv->node = node_id;
srv->port = port;
node = node_get(node_id);
if (!node)
goto err;
/* Delete the old server on the same port */
old = xa_store(&node->servers, port, srv, GFP_KERNEL);
if (old) {
@ -252,6 +279,8 @@ static struct qrtr_server *server_add(unsigned int service,
} else {
kfree(old);
}
} else {
node->server_count++;
}
trace_qrtr_ns_server_add(srv->service, srv->instance,
@ -292,6 +321,7 @@ static int server_del(struct qrtr_node *node, unsigned int port, bool bcast)
}
kfree(srv);
node->server_count--;
return 0;
}
@ -341,7 +371,7 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
struct qrtr_node *node;
unsigned long index;
struct kvec iv;
int ret;
int ret = 0;
iv.iov_base = &pkt;
iv.iov_len = sizeof(pkt);
@ -356,8 +386,10 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
/* Advertise the removal of this client to all local servers */
local_node = node_get(qrtr_ns.local_node);
if (!local_node)
return 0;
if (!local_node) {
ret = 0;
goto delete_node;
}
memset(&pkt, 0, sizeof(pkt));
pkt.cmd = cpu_to_le32(QRTR_TYPE_BYE);
@ -374,10 +406,19 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from)
ret = kernel_sendmsg(qrtr_ns.sock, &msg, &iv, 1, sizeof(pkt));
if (ret < 0 && ret != -ENODEV) {
pr_err("failed to send bye cmd\n");
return ret;
goto delete_node;
}
}
return 0;
/* Ignore -ENODEV */
ret = 0;
delete_node:
xa_erase(&nodes, from->sq_node);
kfree(node);
node_count--;
return ret;
}
static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
@ -417,6 +458,7 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
list_del(&lookup->li);
kfree(lookup);
qrtr_ns.lookup_count--;
}
/* Remove the server belonging to this port but don't broadcast
@ -534,6 +576,11 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
if (from->sq_node != qrtr_ns.local_node)
return -EINVAL;
if (qrtr_ns.lookup_count >= QRTR_NS_MAX_LOOKUPS) {
pr_err_ratelimited("QRTR client node exceeds max lookup limit!\n");
return -ENOSPC;
}
lookup = kzalloc_obj(*lookup);
if (!lookup)
return -ENOMEM;
@ -542,6 +589,7 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
lookup->service = service;
lookup->instance = instance;
list_add_tail(&lookup->li, &qrtr_ns.lookups);
qrtr_ns.lookup_count++;
memset(&filter, 0, sizeof(filter));
filter.service = service;
@ -582,6 +630,7 @@ static void ctrl_cmd_del_lookup(struct sockaddr_qrtr *from,
list_del(&lookup->li);
kfree(lookup);
qrtr_ns.lookup_count--;
}
}
@ -670,7 +719,7 @@ static void qrtr_ns_worker(struct work_struct *work)
}
if (ret < 0)
pr_err("failed while handling packet from %d:%d",
pr_err_ratelimited("failed while handling packet from %d:%d",
sq.sq_node, sq.sq_port);
}
@ -709,6 +758,7 @@ int qrtr_ns_init(void)
goto err_sock;
}
qrtr_ns.saved_data_ready = qrtr_ns.sock->sk->sk_data_ready;
qrtr_ns.sock->sk->sk_data_ready = qrtr_ns_data_ready;
sq.sq_port = QRTR_PORT_CTRL;
@ -749,6 +799,10 @@ int qrtr_ns_init(void)
return 0;
err_wq:
write_lock_bh(&qrtr_ns.sock->sk->sk_callback_lock);
qrtr_ns.sock->sk->sk_data_ready = qrtr_ns.saved_data_ready;
write_unlock_bh(&qrtr_ns.sock->sk->sk_callback_lock);
destroy_workqueue(qrtr_ns.workqueue);
err_sock:
sock_release(qrtr_ns.sock);
@ -758,7 +812,12 @@ EXPORT_SYMBOL_GPL(qrtr_ns_init);
void qrtr_ns_remove(void)
{
write_lock_bh(&qrtr_ns.sock->sk->sk_callback_lock);
qrtr_ns.sock->sk->sk_data_ready = qrtr_ns.saved_data_ready;
write_unlock_bh(&qrtr_ns.sock->sk->sk_callback_lock);
cancel_work_sync(&qrtr_ns.work);
synchronize_net();
destroy_workqueue(qrtr_ns.workqueue);
/* sock_release() expects the two references that were put during