summaryrefslogtreecommitdiff
path: root/net/qrtr
diff options
context:
space:
mode:
authorVignesh Viswanathan <quic_viswanat@quicinc.com>2023-07-14 11:28:45 +0530
committerDavid S. Miller <davem@davemloft.net>2023-07-17 09:02:30 +0100
commitf26b32ef2fe6f7ae0ba56854e666339e105610ad (patch)
tree7982805dcaba325d676b366e7f14153435e1804d /net/qrtr
parent608a147a88728f84bbd2efdde3d4984339f1d872 (diff)
net: qrtr: ns: Change nodes radix tree to xarray
There is a use after free scenario while iterating through the nodes radix tree despite the ns being a single threaded process. This can happen when the radix tree APIs are not synchronized with the rcu_read_lock() APIs. Convert the radix tree for nodes to xarray to take advantage of the built in rcu lock usage provided by xarray. Signed-off-by: Chris Lew <quic_clew@quicinc.com> Signed-off-by: Vignesh Viswanathan <quic_viswanat@quicinc.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/qrtr')
-rw-r--r--net/qrtr/ns.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c
index af28d9e6b53f..b1db0b519179 100644
--- a/net/qrtr/ns.c
+++ b/net/qrtr/ns.c
@@ -16,7 +16,7 @@
#define CREATE_TRACE_POINTS
#include <trace/events/qrtr.h>
-static RADIX_TREE(nodes, GFP_KERNEL);
+static DEFINE_XARRAY(nodes);
static struct {
struct socket *sock;
@@ -73,7 +73,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
{
struct qrtr_node *node;
- node = radix_tree_lookup(&nodes, node_id);
+ node = xa_load(&nodes, node_id);
if (node)
return node;
@@ -85,7 +85,7 @@ static struct qrtr_node *node_get(unsigned int node_id)
node->id = node_id;
xa_init(&node->servers);
- if (radix_tree_insert(&nodes, node_id, node)) {
+ if (xa_store(&nodes, node_id, node, GFP_KERNEL)) {
kfree(node);
return NULL;
}