Thread (1 message) 1 message, 1 author, 2023-11-06

Re: [PATCH] ptp: fix null ptr deref in ptp_ioctrl

From: Rahul Rameshbabu <rrameshbabu@nvidia.com>
Date: 2023-11-06 02:20:14
Also in: lkml

On Mon, 06 Nov, 2023 09:19:26 +0800 Lizhi Xu [off-list ref] wrote:

<snip>
quoted hunk
It can be confirmed that after the execution of "read (3, 0x20000080, 90)",
ptp_release() will be called to release the queue and set
pccontext->private_clkdata = NULL at the same time, this is unreasonable and
incorrect. The queue is not the memory requested in ptp_read() and should not
be released in ptp_read().

Signed-off-by: Lizhi Xu <redacted>
---
 drivers/ptp/ptp_chardev.c | 2 --
 1 file changed, 2 deletions(-)
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 282cd7d24077..27c1ef493617 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -585,7 +585,5 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags,
 free_event:
 	kfree(event);
 exit:
-	if (result < 0)
-		ptp_release(pccontext);
 	return result;
 }
There is already an ongoing review for a patch submission that covers this.

  https://lore.kernel.org/netdev/tencent_856E1C97CCE9E2ED66CC087B526CD42ED50A@qq.com/ (local)

--
Thanks,

Rahul Rameshbabu
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help