Commit f26b32ef authored by Vignesh Viswanathan's avatar Vignesh Viswanathan Committed by David S. Miller

net: qrtr: ns: Change nodes radix tree to xarray

There is a use after free scenario while iterating through the nodes
radix tree despite the ns being a single threaded process. This can
happen when the radix tree APIs are not synchronized with the
rcu_read_lock() APIs.

Convert the radix tree for nodes to xarray to take advantage of the
built in rcu lock usage provided by xarray.
Signed-off-by: default avatarChris Lew <quic_clew@quicinc.com>
Signed-off-by: default avatarVignesh Viswanathan <quic_viswanat@quicinc.com>
Reviewed-by: default avatarSimon Horman <simon.horman@corigine.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 608a147a
...@@ -16,7 +16,7 @@ ...@@ -16,7 +16,7 @@
#define CREATE_TRACE_POINTS #define CREATE_TRACE_POINTS
#include <trace/events/qrtr.h> #include <trace/events/qrtr.h>
static RADIX_TREE(nodes, GFP_KERNEL); static DEFINE_XARRAY(nodes);
static struct { static struct {
struct socket *sock; struct socket *sock;
...@@ -73,7 +73,7 @@ static struct qrtr_node *node_get(unsigned int node_id) ...@@ -73,7 +73,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
{ {
struct qrtr_node *node; struct qrtr_node *node;
node = radix_tree_lookup(&nodes, node_id); node = xa_load(&nodes, node_id);
if (node) if (node)
return node; return node;
...@@ -85,7 +85,7 @@ static struct qrtr_node *node_get(unsigned int node_id) ...@@ -85,7 +85,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
node->id = node_id; node->id = node_id;
xa_init(&node->servers); xa_init(&node->servers);
if (radix_tree_insert(&nodes, node_id, node)) { if (xa_store(&nodes, node_id, node, GFP_KERNEL)) {
kfree(node); kfree(node);
return NULL; return NULL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment