The QRTR name service counts every NEW_LOOKUP request as a new global row, even when one client repeats the same service and instance tuple. An unprivileged local socket can fill all 128 rows with duplicates and prevent an independent observer from registering a lookup. Reuse an existing tuple owned by the same node and port. Continue through the listing path so a repeated request retains its notification semantics without consuming another global row. An isolated AF_QIPCRTR test blocked an independent observer in all three baseline runs. The observer succeeded in all three patched runs. The 127-row boundary, repeated-listing, and socket-close recovery controls retained their expected behavior. The demonstrated impact is bounded local cross-socket service denial. No memory corruption or privilege escalation was observed. This change was prepared with assistance from OpenAI Codex. I reviewed the source change, test results, and this commit message. Fixes: 5640227d9a21 ("net: qrtr: ns: Limit the maximum number of lookups") Assisted-by: OpenAI Codex Signed-off-by: Sung Byeongchan --- net/qrtr/ns.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c index bcb090ee79d49..ae0dc2474e5e9 100644 --- a/net/qrtr/ns.c +++ b/net/qrtr/ns.c @@ -547,6 +547,14 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, if (from->sq_node != qrtr_ns.local_node) return -EINVAL; + list_for_each_entry(lookup, &qrtr_ns.lookups, li) { + if (lookup->sq.sq_node == from->sq_node && + lookup->sq.sq_port == from->sq_port && + lookup->service == service && + lookup->instance == instance) + goto notify; + } + if (qrtr_ns.lookup_count >= QRTR_NS_MAX_LOOKUPS) { pr_err_ratelimited("QRTR client node exceeds max lookup limit!\n"); return -ENOSPC; @@ -562,6 +570,7 @@ static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, list_add_tail(&lookup->li, &qrtr_ns.lookups); qrtr_ns.lookup_count++; +notify: memset(&filter, 0, sizeof(filter)); filter.service = service; filter.instance = instance; -- 2.43.0