netdev - Re: [PATCH net-next v9 02/13] net: pse-pd: Add support for reporting events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <be2ae666-a891-4dee-8791-3773331ce7d7@redhat.com>
Date: Tue, 29 Apr 2025 11:00:19 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Kory Maincent <kory.maincent@...tlin.com>, Andrew Lunn <andrew@...n.ch>,
 Oleksij Rempel <o.rempel@...gutronix.de>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Jonathan Corbet <corbet@....net>,
 Donald Hunter <donald.hunter@...il.com>, Rob Herring <robh@...nel.org>,
 Andrew Lunn <andrew+netdev@...n.ch>, Simon Horman <horms@...nel.org>,
 Heiner Kallweit <hkallweit1@...il.com>, Russell King
 <linux@...linux.org.uk>, Krzysztof Kozlowski <krzk+dt@...nel.org>,
 Conor Dooley <conor+dt@...nel.org>
Cc: Liam Girdwood <lgirdwood@...il.com>, Mark Brown <broonie@...nel.org>,
 Thomas Petazzoni <thomas.petazzoni@...tlin.com>, netdev@...r.kernel.org,
 linux-doc@...r.kernel.org, Kyle Swenson <kyle.swenson@....tech>,
 Dent Project <dentproject@...uxfoundation.org>, kernel@...gutronix.de,
 Maxime Chevallier <maxime.chevallier@...tlin.com>,
 devicetree@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next v9 02/13] net: pse-pd: Add support for reporting
 events

On 4/22/25 4:56 PM, Kory Maincent wrote:
> +/**
> + * pse_control_find_phy_by_id - Find PHY attached to the pse control id
> + * @pcdev: a pointer to the PSE
> + * @id: index of the PSE control
> + *
> + * Return: PHY device pointer or NULL
> + */
> +static struct phy_device *
> +pse_control_find_phy_by_id(struct pse_controller_dev *pcdev, int id)
> +{
> +	struct pse_control *psec;
> +
> +	mutex_lock(&pse_list_mutex);
> +	list_for_each_entry(psec, &pcdev->pse_control_head, list) {
> +		if (psec->id == id) {
> +			mutex_unlock(&pse_list_mutex);

AFAICS at this point 'psec' could be freed and the next statement could
cause UaF.

It looks like you should acquire a reference to the pse control?

/P