From bcea72ceab494f22dfc9788566ed9d06354c32a7 Mon Sep 17 00:00:00 2001 From: Srinivasarao Pathipati Date: Mon, 10 Oct 2022 16:33:22 +0530 Subject: [PATCH] virt: haven: rm_core: Clean up sequence idr earlier When RM sends an error for a given call, Linux can re-use that sequence number later. Presently, the sequence number is kept as reserved and could cause a denial of service if many messages are crafted which always return an RM error. Change-Id: Icc2b054ab8d110c63759e30d62650ebc9d02b234 Signed-off-by: Elliot Berman Signed-off-by: Srinivasarao Pathipati --- drivers/virt/haven/hh_rm_core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/virt/haven/hh_rm_core.c b/drivers/virt/haven/hh_rm_core.c index 5c31130b81bc..02fcfcb8ef82 100644 --- a/drivers/virt/haven/hh_rm_core.c +++ b/drivers/virt/haven/hh_rm_core.c @@ -639,6 +639,10 @@ void *hh_rm_call(hh_rm_msgid_t message_id, goto out; } + mutex_lock(&hh_rm_call_idr_lock); + idr_remove(&hh_rm_call_idr, connection->seq); + mutex_unlock(&hh_rm_call_idr_lock); + *rm_error = connection->rm_error; if (connection->rm_error) { pr_err("%s: Reply for seq:%d failed with RM err: %d\n", @@ -662,10 +666,6 @@ void *hh_rm_call(hh_rm_msgid_t message_id, *resp_buff_size = connection->size; out: - mutex_lock(&hh_rm_call_idr_lock); - idr_remove(&hh_rm_call_idr, connection->seq); - mutex_unlock(&hh_rm_call_idr_lock); - kfree(connection); return ret; }