diff options
| author |   Vignesh Viswanathan <quic_viswanat@quicinc.com> | 2023-07-14 11:28:45 +0530 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2023-07-17 09:02:30 +0100 |
| commit | f26b32ef2fe6f7ae0ba56854e666339e105610ad (patch) | |
| tree | 7982805dcaba325d676b366e7f14153435e1804d /net/qrtr | |
| parent | net: qrtr: ns: Change servers radix tree to xarray (diff) | |
| download | wireguard-linux-f26b32ef2fe6f7ae0ba56854e666339e105610ad.tar.xz wireguard-linux-f26b32ef2fe6f7ae0ba56854e666339e105610ad.zip | |
net: qrtr: ns: Change nodes radix tree to xarray
There is a use after free scenario while iterating through the nodes
radix tree despite the ns being a single threaded process. This can
happen when the radix tree APIs are not synchronized with the
rcu_read_lock() APIs.
Convert the radix tree for nodes to xarray to take advantage of the
built in rcu lock usage provided by xarray.
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Signed-off-by: Vignesh Viswanathan <quic_viswanat@quicinc.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/qrtr')
| -rw-r--r-- | net/qrtr/ns.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c index af28d9e6b53f..b1db0b519179 100644 --- a/net/qrtr/ns.c +++ b/net/qrtr/ns.c @@ -16,7 +16,7 @@ #define CREATE_TRACE_POINTS #include <trace/events/qrtr.h> -static RADIX_TREE(nodes, GFP_KERNEL); +static DEFINE_XARRAY(nodes); static struct { struct socket *sock; @@ -73,7 +73,7 @@ static struct qrtr_node *node_get(unsigned int node_id) { struct qrtr_node *node; - node = radix_tree_lookup(&nodes, node_id); + node = xa_load(&nodes, node_id); if (node) return node; @@ -85,7 +85,7 @@ static struct qrtr_node *node_get(unsigned int node_id) node->id = node_id; xa_init(&node->servers); - if (radix_tree_insert(&nodes, node_id, node)) { + if (xa_store(&nodes, node_id, node, GFP_KERNEL)) { kfree(node); return NULL; } |