* [PATCH] ptp: free ptp device pin descriptors properly [not found] <3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com> @ 2020-01-13 13:00 ` Vladis Dronov 2020-01-14 4:26 ` Richard Cochran 2020-01-14 18:59 ` David Miller 0 siblings, 2 replies; 3+ messages in thread From: Vladis Dronov @ 2020-01-13 13:00 UTC (permalink / raw) To: Antti Laakso, netdev Cc: Richard Cochran, vdronov, sjohnsto, vlovejoy, linux-kernel, davem, artem.bityutskiy There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups() first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs them to destroy a related sysfs device. These functions can not be just swapped, as posix_clock_unregister() frees ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed. This makes this patch fix an UAF bug in a patch which fixes an UAF bug. Reported-by: Antti Laakso <antti.laakso@intel.com> Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/ Signed-off-by: Vladis Dronov <vdronov@redhat.com> --- drivers/ptp/ptp_clock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c index 61fafe0374ce..b84f16bbd6f2 100644 --- a/drivers/ptp/ptp_clock.c +++ b/drivers/ptp/ptp_clock.c @@ -170,6 +170,7 @@ static void ptp_clock_release(struct device *dev) { struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev); + ptp_cleanup_pin_groups(ptp); mutex_destroy(&ptp->tsevq_mux); mutex_destroy(&ptp->pincfg_mux); ida_simple_remove(&ptp_clocks_map, ptp->index); @@ -302,9 +303,8 @@ int ptp_clock_unregister(struct ptp_clock *ptp) if (ptp->pps_source) pps_unregister_source(ptp->pps_source); - ptp_cleanup_pin_groups(ptp); - posix_clock_unregister(&ptp->clock); + return 0; } EXPORT_SYMBOL(ptp_clock_unregister); -- 2.20.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] ptp: free ptp device pin descriptors properly 2020-01-13 13:00 ` [PATCH] ptp: free ptp device pin descriptors properly Vladis Dronov @ 2020-01-14 4:26 ` Richard Cochran 2020-01-14 18:59 ` David Miller 1 sibling, 0 replies; 3+ messages in thread From: Richard Cochran @ 2020-01-14 4:26 UTC (permalink / raw) To: Vladis Dronov Cc: Antti Laakso, netdev, sjohnsto, vlovejoy, linux-kernel, davem, artem.bityutskiy On Mon, Jan 13, 2020 at 02:00:09PM +0100, Vladis Dronov wrote: > There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups() > first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs > them to destroy a related sysfs device. > > These functions can not be just swapped, as posix_clock_unregister() frees > ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling > ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed. > > This makes this patch fix an UAF bug in a patch which fixes an UAF bug. > > Reported-by: Antti Laakso <antti.laakso@intel.com> > Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") > Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/ > Signed-off-by: Vladis Dronov <vdronov@redhat.com> Acked-by: Richard Cochran <richardcochran@gmail.com> ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ptp: free ptp device pin descriptors properly 2020-01-13 13:00 ` [PATCH] ptp: free ptp device pin descriptors properly Vladis Dronov 2020-01-14 4:26 ` Richard Cochran @ 2020-01-14 18:59 ` David Miller 1 sibling, 0 replies; 3+ messages in thread From: David Miller @ 2020-01-14 18:59 UTC (permalink / raw) To: vdronov Cc: antti.laakso, netdev, richardcochran, sjohnsto, vlovejoy, linux-kernel, artem.bityutskiy From: Vladis Dronov <vdronov@redhat.com> Date: Mon, 13 Jan 2020 14:00:09 +0100 > There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups() > first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs > them to destroy a related sysfs device. > > These functions can not be just swapped, as posix_clock_unregister() frees > ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling > ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed. > > This makes this patch fix an UAF bug in a patch which fixes an UAF bug. > > Reported-by: Antti Laakso <antti.laakso@intel.com> > Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") > Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/ > Signed-off-by: Vladis Dronov <vdronov@redhat.com> Applied, thank you. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-01-14 19:00 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- [not found] <3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com> 2020-01-13 13:00 ` [PATCH] ptp: free ptp device pin descriptors properly Vladis Dronov 2020-01-14 4:26 ` Richard Cochran 2020-01-14 18:59 ` David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).