netdev - Re: [PATCH net] ptp: ocp: fix use-after-free bugs causing by ptp_ocp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <25ff983c-8479-4c2e-9afc-2a3befedabb0@linux.dev>
Date: Thu, 28 Aug 2025 12:11:36 +0100
From: Vadim Fedorenko <vadim.fedorenko@...ux.dev>
To: Duoming Zhou <duoming@....edu.cn>
Cc: netdev@...r.kernel.org, pabeni@...hat.com, kuba@...nel.org,
 edumazet@...gle.com, davem@...emloft.net, andrew+netdev@...n.ch,
 jonathan.lemon@...il.com, richardcochran@...il.com,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] ptp: ocp: fix use-after-free bugs causing by
 ptp_ocp_watchdog

On 28/08/2025 09:29, Duoming Zhou wrote:
> The ptp_ocp_detach() only shuts down the watchdog timer if it is
> pending. However, if the timer handler is already running, the
> timer_delete_sync() is not called. This leads to race conditions
> where the devlink that contains the ptp_ocp is deallocated while
> the timer handler is still accessing it, resulting in use-after-free
> bugs. The following details one of the race scenarios.
> 
> (thread 1)                           | (thread 2)
> ptp_ocp_remove()                     |
>    ptp_ocp_detach()                   | ptp_ocp_watchdog()
>      if (timer_pending(&bp->watchdog))|   bp = timer_container_of()
>        timer_delete_sync()            |
>                                       |
>    devlink_free(devlink) //free       |
>                                       |   bp-> //use
> 
> Resolve this by unconditionally calling timer_delete_sync() to ensure
> the timer is reliably deactivated, preventing any access after free.
> 
> Fixes: 773bda964921 ("ptp: ocp: Expose various resources on the timecard.")
> Signed-off-by: Duoming Zhou <duoming@....edu.cn>

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@...ux.dev>

> ---
>   drivers/ptp/ptp_ocp.c | 3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
> index d39073dc4072..4e1286ce05c9 100644
> --- a/drivers/ptp/ptp_ocp.c
> +++ b/drivers/ptp/ptp_ocp.c
> @@ -4557,8 +4557,7 @@ ptp_ocp_detach(struct ptp_ocp *bp)
>   	ptp_ocp_debugfs_remove_device(bp);
>   	ptp_ocp_detach_sysfs(bp);
>   	ptp_ocp_attr_group_del(bp);
> -	if (timer_pending(&bp->watchdog))
> -		timer_delete_sync(&bp->watchdog);
> +	timer_delete_sync(&bp->watchdog);
>   	if (bp->ts0)
>   		ptp_ocp_unregister_ext(bp->ts0);
>   	if (bp->ts1)