linux-kernel - [PATCH net 1/8] idpf: cleanup remaining SKBs in PTP flows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251001-jk-iwl-net-2025-10-01-v1-1-49fa99e86600@intel.com>
Date: Wed, 01 Oct 2025 17:14:11 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Przemek Kitszel <przemyslaw.kitszel@...el.com>, 
 Andrew Lunn <andrew+netdev@...n.ch>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Emil Tantilov <emil.s.tantilov@...el.com>, 
 Pavan Kumar Linga <pavan.kumar.linga@...el.com>, 
 Alexander Lobakin <aleksander.lobakin@...el.com>, 
 Willem de Bruijn <willemb@...gle.com>, 
 Sridhar Samudrala <sridhar.samudrala@...el.com>, 
 Phani Burra <phani.r.burra@...el.com>, 
 Piotr Kwapulinski <piotr.kwapulinski@...el.com>, 
 Simon Horman <horms@...nel.org>, Radoslaw Tyl <radoslawx.tyl@...el.com>, 
 Jedrzej Jagielski <jedrzej.jagielski@...el.com>, 
 Mateusz Polchlopek <mateusz.polchlopek@...el.com>
Cc: Anton Nadezhdin <anton.nadezhdin@...el.com>, 
 Konstantin Ilichev <konstantin.ilichev@...el.com>, 
 Milena Olech <milena.olech@...el.com>, netdev@...r.kernel.org, 
 linux-kernel@...r.kernel.org, Jacob Keller <jacob.e.keller@...el.com>, 
 Aleksandr Loktionov <aleksandr.loktionov@...el.com>, 
 Samuel Salin <Samuel.salin@...el.com>
Subject: [PATCH net 1/8] idpf: cleanup remaining SKBs in PTP flows

From: Milena Olech <milena.olech@...el.com>

When the driver requests Tx timestamp value, one of the first steps is
to clone SKB using skb_get. It increases the reference counter for that
SKB to prevent unexpected freeing by another component.
However, there may be a case where the index is requested, SKB is
assigned and never consumed by PTP flows - for example due to reset during
running PTP apps.

Add a check in release timestamping function to verify if the SKB
assigned to Tx timestamp latch was freed, and release remaining SKBs.

Fixes: 4901e83a94ef ("idpf: add Tx timestamp capabilities negotiation")
Signed-off-by: Milena Olech <milena.olech@...el.com>
Signed-off-by: Anton Nadezhdin <anton.nadezhdin@...el.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>
Tested-by: Samuel Salin <Samuel.salin@...el.com>
---
 drivers/net/ethernet/intel/idpf/idpf_ptp.c          | 3 +++
 drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_ptp.c b/drivers/net/ethernet/intel/idpf/idpf_ptp.c
index ee21f2ff0cad..63a41e688733 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_ptp.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_ptp.c
@@ -855,6 +855,9 @@ static void idpf_ptp_release_vport_tstamp(struct idpf_vport *vport)
 	head = &vport->tx_tstamp_caps->latches_in_use;
 	list_for_each_entry_safe(ptp_tx_tstamp, tmp, head, list_member) {
 		list_del(&ptp_tx_tstamp->list_member);
+		if (ptp_tx_tstamp->skb)
+			consume_skb(ptp_tx_tstamp->skb);
+
 		kfree(ptp_tx_tstamp);
 	}

diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
index 4f1fb0cefe51..688a6f4e0acc 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
@@ -517,6 +517,7 @@ idpf_ptp_get_tstamp_value(struct idpf_vport *vport,
 	shhwtstamps.hwtstamp = ns_to_ktime(tstamp);
 	skb_tstamp_tx(ptp_tx_tstamp->skb, &shhwtstamps);
 	consume_skb(ptp_tx_tstamp->skb);
+	ptp_tx_tstamp->skb = NULL;

 	list_add(&ptp_tx_tstamp->list_member,
 		 &tx_tstamp_caps->latches_free);

-- 
2.51.0.rc1.197.g6d975e95c9d7