From e5178a0830c5766409c227add6c940a16c796a65 Mon Sep 17 00:00:00 2001 From: Deepak Kumar Singh Date: Thu, 10 Sep 2020 21:42:09 +0530 Subject: [PATCH] net: qrtr: hold ept sem lock before node lookup Node ref count decrement and test is performed inside ept sem lock while node lookup is done inside node spin lock. This can sometime cause node lookup to succeed while parallely node can be freed in node release function. This will further use of node and will result in use after free. Additionally hold ept smem lock before performing node lookup. Change-Id: Iaa5781c56ebee51611dfea9fddcde50f1367dfea Signed-off-by: Deepak Kumar Singh --- net/qrtr/qrtr.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index 0935891f1e89..6ccb13c598fa 100644 --- a/net/qrtr/qrtr.c +++ b/net/qrtr/qrtr.c @@ -643,10 +643,12 @@ static struct qrtr_node *qrtr_node_lookup(unsigned int nid) struct qrtr_node *node; unsigned long flags; + down_read(&qrtr_epts_lock); spin_lock_irqsave(&qrtr_nodes_lock, flags); node = radix_tree_lookup(&qrtr_nodes, nid); node = qrtr_node_acquire(node); spin_unlock_irqrestore(&qrtr_nodes_lock, flags); + up_read(&qrtr_epts_lock); return node; }