Messages in this thread | | | From | Rahul Rameshbabu <> | Subject | Re: [PATCH] ptp: fix null ptr deref in ptp_ioctrl | Date | Sun, 05 Nov 2023 18:12:14 -0800 |
| |
On Mon, 06 Nov, 2023 09:19:26 +0800 Lizhi Xu <lizhi.xu@windriver.com> wrote:
<snip>
> > It can be confirmed that after the execution of "read (3, 0x20000080, 90)", > ptp_release() will be called to release the queue and set > pccontext->private_clkdata = NULL at the same time, this is unreasonable and > incorrect. The queue is not the memory requested in ptp_read() and should not > be released in ptp_read(). > > Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> > --- > drivers/ptp/ptp_chardev.c | 2 -- > 1 file changed, 2 deletions(-) > > diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c > index 282cd7d24077..27c1ef493617 100644 > --- a/drivers/ptp/ptp_chardev.c > +++ b/drivers/ptp/ptp_chardev.c > @@ -585,7 +585,5 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags, > free_event: > kfree(event); > exit: > - if (result < 0) > - ptp_release(pccontext); > return result; > }
There is already an ongoing review for a patch submission that covers this.
https://lore.kernel.org/netdev/tencent_856E1C97CCE9E2ED66CC087B526CD42ED50A@qq.com/
-- Thanks,
Rahul Rameshbabu
| |