| From: Vladis Dronov <vdronov@redhat.com> |
| Date: Mon, 13 Jan 2020 14:00:09 +0100 |
| Subject: ptp: free ptp device pin descriptors properly |
| |
| commit 75718584cb3c64e6269109d4d54f888ac5a5fd15 upstream. |
| |
| There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups() |
| first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs |
| them to destroy a related sysfs device. |
| |
| These functions can not be just swapped, as posix_clock_unregister() frees |
| ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling |
| ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed. |
| |
| This makes this patch fix an UAF bug in a patch which fixes an UAF bug. |
| |
| Reported-by: Antti Laakso <antti.laakso@intel.com> |
| Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") |
| Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/ |
| Signed-off-by: Vladis Dronov <vdronov@redhat.com> |
| Acked-by: Richard Cochran <richardcochran@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/ptp/ptp_clock.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/ptp/ptp_clock.c |
| +++ b/drivers/ptp/ptp_clock.c |
| @@ -171,6 +171,7 @@ static void ptp_clock_release(struct dev |
| { |
| struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev); |
| |
| + ptp_cleanup_pin_groups(ptp); |
| mutex_destroy(&ptp->tsevq_mux); |
| mutex_destroy(&ptp->pincfg_mux); |
| ida_simple_remove(&ptp_clocks_map, ptp->index); |
| @@ -271,9 +272,8 @@ int ptp_clock_unregister(struct ptp_cloc |
| if (ptp->pps_source) |
| pps_unregister_source(ptp->pps_source); |
| |
| - ptp_cleanup_pin_groups(ptp); |
| - |
| posix_clock_unregister(&ptp->clock); |
| + |
| return 0; |
| } |
| EXPORT_SYMBOL(ptp_clock_unregister); |
