Commit 9ad24ba4 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'net-qrtr-ns-a-bunch-of-fixs' 

Manivannan Sadhasivam says:

====================
net: qrtr: ns: A bunch of fixs

This series fixes a bunch of possible memory exhaustion issues in the QRTR
nameserver.
====================

Link: https://patch.msgid.link/20260409-qrtr-fix-v3-0-00a8a5ff2b51@oss.qualcomm.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents e7a62edd 7809fea2

net/qrtr/ns.c

+69 −10
Original line number Diff line number Diff line
@@ -22,8 +22,10 @@ static struct { 
	struct socket *sock;

	struct sockaddr_qrtr bcast_sq;

	struct list_head lookups;

	u32 lookup_count;

	struct workqueue_struct *workqueue;

	struct work_struct work;

	void (*saved_data_ready)(struct sock *sk);

	int local_node;

} qrtr_ns;
@@ -67,8 +69,19 @@ struct qrtr_server { 
struct qrtr_node {

	unsigned int id;

	struct xarray servers;

	u32 server_count;

};



/* Max nodes, server, lookup limits are chosen based on the current platform

 * requirements. If the requirement changes in the future, these values can be

 * increased.

 */

#define QRTR_NS_MAX_NODES   64

#define QRTR_NS_MAX_SERVERS 256

#define QRTR_NS_MAX_LOOKUPS 64



static u8 node_count;



static struct qrtr_node *node_get(unsigned int node_id)

{

	struct qrtr_node *node;
@@ -77,6 +90,11 @@ static struct qrtr_node *node_get(unsigned int node_id) 
	if (node)

		return node;



	if (node_count >= QRTR_NS_MAX_NODES) {

		pr_err_ratelimited("QRTR clients exceed max node limit!\n");

		return NULL;

	}



	/* If node didn't exist, allocate and insert it to the tree */

	node = kzalloc_obj(*node);

	if (!node)
@@ -90,6 +108,8 @@ static struct qrtr_node *node_get(unsigned int node_id) 
		return NULL;

	}



	node_count++;



	return node;

}
@@ -229,6 +249,17 @@ static struct qrtr_server *server_add(unsigned int service, 
	if (!service || !port)

		return NULL;



	node = node_get(node_id);

	if (!node)

		return NULL;



	/* Make sure the new servers per port are capped at the maximum value */

	old = xa_load(&node->servers, port);

	if (!old && node->server_count >= QRTR_NS_MAX_SERVERS) {

		pr_err_ratelimited("QRTR client node %u exceeds max server limit!\n", node_id);

		return NULL;

	}



	srv = kzalloc_obj(*srv);

	if (!srv)

		return NULL;
@@ -238,10 +269,6 @@ static struct qrtr_server *server_add(unsigned int service, 
	srv->node = node_id;

	srv->port = port;



	node = node_get(node_id);

	if (!node)

		goto err;



	/* Delete the old server on the same port */

	old = xa_store(&node->servers, port, srv, GFP_KERNEL);

	if (old) {
@@ -252,6 +279,8 @@ static struct qrtr_server *server_add(unsigned int service, 
		} else {

			kfree(old);

		}

	} else {

		node->server_count++;

	}



	trace_qrtr_ns_server_add(srv->service, srv->instance,
@@ -292,6 +321,7 @@ static int server_del(struct qrtr_node *node, unsigned int port, bool bcast) 
	}



	kfree(srv);

	node->server_count--;



	return 0;

}
@@ -341,7 +371,7 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from) 
	struct qrtr_node *node;

	unsigned long index;

	struct kvec iv;

	int ret;

	int ret = 0;



	iv.iov_base = &pkt;

	iv.iov_len = sizeof(pkt);
@@ -356,8 +386,10 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from) 


	/* Advertise the removal of this client to all local servers */

	local_node = node_get(qrtr_ns.local_node);

	if (!local_node)

		return 0;

	if (!local_node) {

		ret = 0;

		goto delete_node;

	}



	memset(&pkt, 0, sizeof(pkt));

	pkt.cmd = cpu_to_le32(QRTR_TYPE_BYE);
@@ -374,10 +406,19 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from) 
		ret = kernel_sendmsg(qrtr_ns.sock, &msg, &iv, 1, sizeof(pkt));

		if (ret < 0 && ret != -ENODEV) {

			pr_err("failed to send bye cmd\n");

			return ret;

			goto delete_node;

		}

	}

	return 0;



	/* Ignore -ENODEV */

	ret = 0;



delete_node:

	xa_erase(&nodes, from->sq_node);

	kfree(node);

	node_count--;



	return ret;

}



static int ctrl_cmd_del_client(struct sockaddr_qrtr *from,
@@ -417,6 +458,7 @@ static int ctrl_cmd_del_client(struct sockaddr_qrtr *from, 


		list_del(&lookup->li);

		kfree(lookup);

		qrtr_ns.lookup_count--;

	}



	/* Remove the server belonging to this port but don't broadcast
@@ -534,6 +576,11 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, 
	if (from->sq_node != qrtr_ns.local_node)

		return -EINVAL;



	if (qrtr_ns.lookup_count >= QRTR_NS_MAX_LOOKUPS) {

		pr_err_ratelimited("QRTR client node exceeds max lookup limit!\n");

		return -ENOSPC;

	}



	lookup = kzalloc_obj(*lookup);

	if (!lookup)

		return -ENOMEM;
@@ -542,6 +589,7 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, 
	lookup->service = service;

	lookup->instance = instance;

	list_add_tail(&lookup->li, &qrtr_ns.lookups);

	qrtr_ns.lookup_count++;



	memset(&filter, 0, sizeof(filter));

	filter.service = service;
@@ -582,6 +630,7 @@ static void ctrl_cmd_del_lookup(struct sockaddr_qrtr *from, 


		list_del(&lookup->li);

		kfree(lookup);

		qrtr_ns.lookup_count--;

	}

}
@@ -670,7 +719,7 @@ static void qrtr_ns_worker(struct work_struct *work) 
		}



		if (ret < 0)

			pr_err("failed while handling packet from %d:%d",

			pr_err_ratelimited("failed while handling packet from %d:%d",

			       sq.sq_node, sq.sq_port);

	}
@@ -709,6 +758,7 @@ int qrtr_ns_init(void) 
		goto err_sock;

	}



	qrtr_ns.saved_data_ready = qrtr_ns.sock->sk->sk_data_ready;

	qrtr_ns.sock->sk->sk_data_ready = qrtr_ns_data_ready;



	sq.sq_port = QRTR_PORT_CTRL;
@@ -749,6 +799,10 @@ int qrtr_ns_init(void) 
	return 0;



err_wq:

	write_lock_bh(&qrtr_ns.sock->sk->sk_callback_lock);

	qrtr_ns.sock->sk->sk_data_ready = qrtr_ns.saved_data_ready;

	write_unlock_bh(&qrtr_ns.sock->sk->sk_callback_lock);



	destroy_workqueue(qrtr_ns.workqueue);

err_sock:

	sock_release(qrtr_ns.sock);
@@ -758,7 +812,12 @@ EXPORT_SYMBOL_GPL(qrtr_ns_init); 


void qrtr_ns_remove(void)

{

	write_lock_bh(&qrtr_ns.sock->sk->sk_callback_lock);

	qrtr_ns.sock->sk->sk_data_ready = qrtr_ns.saved_data_ready;

	write_unlock_bh(&qrtr_ns.sock->sk->sk_callback_lock);



	cancel_work_sync(&qrtr_ns.work);

	synchronize_net();

	destroy_workqueue(qrtr_ns.workqueue);



	/* sock_release() expects the two references that were put during