[PATCH net] qrtr: make repeated lookups from one client idempotent

[PATCH net] qrtr: make repeated lookups from one client idempotent

[Sung Byeongchan]

The QRTR name service counts every NEW_LOOKUP request as a new global row,
even when one client repeats the same service and instance tuple. An
unprivileged local socket can fill all 128 rows with duplicates and prevent
an independent observer from registering a lookup.

Reuse an existing tuple owned by the same node and port. Continue through
the listing path so a repeated request retains its notification semantics
without consuming another global row.

An isolated AF_QIPCRTR test blocked an independent observer in all three
baseline runs. The observer succeeded in all three patched runs. The
127-row boundary, repeated-listing, and socket-close recovery controls
retained their expected behavior.

The demonstrated impact is bounded local cross-socket service denial. No
memory corruption or privilege escalation was observed.

This change was prepared with assistance from OpenAI Codex. I reviewed the
source change, test results, and this commit message.

Fixes: 5640227d9a21 ("net: qrtr: ns: Limit the maximum number of lookups")
Assisted-by: OpenAI Codex
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
---
 net/qrtr/ns.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c
index bcb090ee79d49..ae0dc2474e5e9 100644
--- a/net/qrtr/ns.c
+++ b/net/qrtr/ns.c
@@ -547,6 +547,14 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
 	if (from->sq_node != qrtr_ns.local_node)
 		return -EINVAL;
 
+	list_for_each_entry(lookup, &qrtr_ns.lookups, li) {
+		if (lookup->sq.sq_node == from->sq_node &&
+		    lookup->sq.sq_port == from->sq_port &&
+		    lookup->service == service &&
+		    lookup->instance == instance)
+			goto notify;
+	}
+
 	if (qrtr_ns.lookup_count >= QRTR_NS_MAX_LOOKUPS) {
 		pr_err_ratelimited("QRTR client node exceeds max lookup limit!\n");
 		return -ENOSPC;
@@ -562,6 +570,7 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
 	list_add_tail(&lookup->li, &qrtr_ns.lookups);
 	qrtr_ns.lookup_count++;
 
+notify:
 	memset(&filter, 0, sizeof(filter));
 	filter.service = service;
 	filter.instance = instance;
-- 
2.43.0

Re: [PATCH net] qrtr: make repeated lookups from one client idempotent

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] qrtr: make repeated lookups from one client idempotent

[성병찬]

Hi,

This issue was identified during manual static source review of the QRTR
lookup accounting path, with assistance from OpenAI Codex.

I subsequently reproduced and validated it using an isolated local
AF_QIPCRTR fixture. A separate unprivileged socket was unable to register
a lookup after one client submitted 128 duplicate lookup requests in all
three baseline runs. With the patch applied, the independent lookup
succeeded in all three runs, while the boundary, repeated-listing, and
socket-close cleanup controls retained their expected behavior.

Thanks,
Sung Byeongchan