From patchwork Mon Nov 6 13:41:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Edward Adam Davis X-Patchwork-Id: 13446951 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6A81200DA for ; Mon, 6 Nov 2023 13:48:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="nJ2F/Id7" Received: from out203-205-221-202.mail.qq.com (out203-205-221-202.mail.qq.com [203.205.221.202]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6213D8; Mon, 6 Nov 2023 05:47:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1699278476; bh=EJudLZETgEABMWZNAnUgwz6zsPd5cK0BfnFDCy8ZOBA=; h=From:To:Cc:Subject:Date; b=nJ2F/Id7FjKaVXsr9NuykgpHh2TgAkEt60OAv2q19MUKRsmwx9G+mq1RHjuxpRdLm FR+g2OPZsC4Ur6w8pZZ0nKJJb3kpYYF2SuUYD47N3FPC6mwVU1SXSwcvxpGYKNe171 h4V1RPhN0Ptfh8gCuqPrLLnun7W9k8VzV3nUUufI= Received: from pek-lxu-l1.wrs.com ([111.198.228.56]) by newxmesmtplogicsvrsza7-0.qq.com (NewEsmtp) with SMTP id A6233279; Mon, 06 Nov 2023 21:41:34 +0800 X-QQ-mid: xmsmtpt1699278094tcg2y2bpq Message-ID: X-QQ-XMAILINFO: NkBK3x0tNc759LLae0hf8RvQgAoD+w5EXsEaQyodv1bzxabCSDNzSZxgmup67l 5sO4iVqgggyoQJlCQkPrXfXCUvW18GK4qH4RmWVKxE4AnHS59+nMs5TosgTqugIqWuqVkVT9LOOk ESjFX55FLEnQB7b1PbfUgtAqczTPy5m1abO7WF2hyI9Psnj4ahUD+aSsEElTiFZDJ8Pqexg5D3rw tgk87roZT0OBhQjchldYhx2o+iu5GezUDnD2V1/dor3cq2zv30jOqob5zTGAkNjb91iDMJa23gDf xzhgzjTB/K9MhnMFIs8DEmYyFpdFg5iCFdlb6Hcc7Abu0ZzZBZlJLvHzw0Z88cV+ATJLn6ElTglC VCu/QeWC9H89v0N7doTbfQlEHxC6PUmsbv9+twNEHvjpQhSQlFJ8vm5KMXllflCcfn5XBOJve2kw CLJu0fiONl8FC9AeRCVdy9sHDY1dT6yH7O4go6TUwgbHQEGQy6JYATb0Zy/68bDofTA0Qr1Hj4D7 ShFa27ES6WdYyq6EP406W0z0HICDY00XH7yTm5ost4hDtIQ6tb/6R+P3N+ykqwR6Li/uU2U64kWa SoCd3PalOJrmslAMNsaAmeDHNxD8xwBIMZaZpHICs2N+FFEUNxAorzfhj0fUALWxU4F+y3eSjCXF my10yUrpije5qxHXLKXJ0Ys5/vWBimQVSgOUxrvt4WnTxmxNvJoGmA41vRh6CD0yAhL+UT2gwry7 HIarH3EqZD2oYDvu07CPQv/DQiQBmOJCEYLTrhMn8Ttc6VFZdjOxgSKv23mfdsS6HurhiomuUCr6 bCjznRGLfFD9Bks1royBY7NFTU/vOp9TrJhcSuZ9eqHT/cOHeDfXgpDazaPJ8PX/S0rOWkD+3sgC veEmqE5MJ5dKkIp48vttcZ0hjiUdnS05pXPpjLMC4VUak5aQS84hgMQwu3ziW1bkLrX4oeXkzk4G T9lCbgTcQsviUZLr/hhA== X-QQ-XMRINFO: M/715EihBoGSf6IYSX1iLFg= From: Edward Adam Davis To: richardcochran@gmail.com Cc: davem@davemloft.net, eadavis@qq.com, habetsm.xilinx@gmail.com, jeremy@jcline.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, reibax@gmail.com, syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Subject: [PATCH net-next V7 1/2] ptp: fix corrupted list in ptp_open Date: Mon, 6 Nov 2023 21:41:34 +0800 X-OQ-MSGID: <20231106134133.3882778-3-eadavis@qq.com> X-Mailer: git-send-email 2.42.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org There is no lock protection when writing ptp->tsevqs in ptp_open() and ptp_release(), which can cause data corruption, use spin lock to avoid this issue. Moreover, ptp_release() should not be used to release the queue in ptp_read(), and it should be deleted altogether. Reported-and-tested-by: syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Fixes: 8f5de6fb2453 ("ptp: support multiple timestamp event readers") Signed-off-by: Edward Adam Davis --- drivers/ptp/ptp_chardev.c | 21 ++++++++++++--------- drivers/ptp/ptp_clock.c | 8 ++++++-- drivers/ptp/ptp_private.h | 1 + 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c index 282cd7d24077..473b6d992507 100644 --- a/drivers/ptp/ptp_chardev.c +++ b/drivers/ptp/ptp_chardev.c @@ -108,6 +108,7 @@ int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode) container_of(pccontext->clk, struct ptp_clock, clock); struct timestamp_event_queue *queue; char debugfsname[32]; + unsigned long flags; queue = kzalloc(sizeof(*queue), GFP_KERNEL); if (!queue) @@ -119,7 +120,9 @@ int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode) } bitmap_set(queue->mask, 0, PTP_MAX_CHANNELS); spin_lock_init(&queue->lock); + spin_lock_irqsave(&ptp->tsevqs_lock, flags); list_add_tail(&queue->qlist, &ptp->tsevqs); + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); pccontext->private_clkdata = queue; /* Debugfs contents */ @@ -139,16 +142,16 @@ int ptp_release(struct posix_clock_context *pccontext) { struct timestamp_event_queue *queue = pccontext->private_clkdata; unsigned long flags; + struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock); - if (queue) { - debugfs_remove(queue->debugfs_instance); - pccontext->private_clkdata = NULL; - spin_lock_irqsave(&queue->lock, flags); - list_del(&queue->qlist); - spin_unlock_irqrestore(&queue->lock, flags); - bitmap_free(queue->mask); - kfree(queue); - } + debugfs_remove(queue->debugfs_instance); + pccontext->private_clkdata = NULL; + spin_lock_irqsave(&ptp->tsevqs_lock, flags); + list_del(&queue->qlist); + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); + bitmap_free(queue->mask); + kfree(queue); return 0; } diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c index 3d1b0a97301c..b901f2910963 100644 --- a/drivers/ptp/ptp_clock.c +++ b/drivers/ptp/ptp_clock.c @@ -179,11 +179,11 @@ static void ptp_clock_release(struct device *dev) mutex_destroy(&ptp->pincfg_mux); mutex_destroy(&ptp->n_vclocks_mux); /* Delete first entry */ + spin_lock_irqsave(&tsevq->lock, flags); tsevq = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, qlist); - spin_lock_irqsave(&tsevq->lock, flags); list_del(&tsevq->qlist); - spin_unlock_irqrestore(&tsevq->lock, flags); + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); bitmap_free(tsevq->mask); kfree(tsevq); debugfs_remove(ptp->debugfs_root); @@ -247,6 +247,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, if (!queue) goto no_memory_queue; list_add_tail(&queue->qlist, &ptp->tsevqs); + spin_lock_init(&ptp->tsevqs_lock); queue->mask = bitmap_alloc(PTP_MAX_CHANNELS, GFP_KERNEL); if (!queue->mask) goto no_memory_bitmap; @@ -407,6 +408,7 @@ void ptp_clock_event(struct ptp_clock *ptp, struct ptp_clock_event *event) { struct timestamp_event_queue *tsevq; struct pps_event_time evt; + unsigned long flags; switch (event->type) { @@ -415,10 +417,12 @@ void ptp_clock_event(struct ptp_clock *ptp, struct ptp_clock_event *event) case PTP_CLOCK_EXTTS: /* Enqueue timestamp on selected queues */ + spin_lock_irqsave(&ptp->tsevqs_lock, flags); list_for_each_entry(tsevq, &ptp->tsevqs, qlist) { if (test_bit((unsigned int)event->index, tsevq->mask)) enqueue_external_timestamp(tsevq, event); } + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); wake_up_interruptible(&ptp->tsev_wq); break; diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h index 52f87e394aa6..35fde0a05746 100644 --- a/drivers/ptp/ptp_private.h +++ b/drivers/ptp/ptp_private.h @@ -44,6 +44,7 @@ struct ptp_clock { struct pps_device *pps_source; long dialed_frequency; /* remembers the frequency adjustment */ struct list_head tsevqs; /* timestamp fifo list */ + spinlock_t tsevqs_lock; /* protects tsevqs from concurrent access */ struct mutex pincfg_mux; /* protect concurrent info->pin_config access */ wait_queue_head_t tsev_wq; int defunct; /* tells readers to go away when clock is being removed */ From patchwork Mon Nov 6 13:41:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Edward Adam Davis X-Patchwork-Id: 13446948 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 526101A71D for ; Mon, 6 Nov 2023 13:41:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="cNPUcOj2" Received: from out203-205-251-27.mail.qq.com (out203-205-251-27.mail.qq.com [203.205.251.27]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E0D1ED8; Mon, 6 Nov 2023 05:41:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1699278098; bh=cDDdtF+lljV7pn/L6PPw2wWs1zIAvruOvia18LhrCpQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cNPUcOj2zX5heTW8tYrxbcUPuK5tPE/myS/nvnK5xHbHO8NTnuNPYM88q+sPd2p7t ixWS0iQ0C+5zdLrrhuDFey1L3AO9RdUv4y98786L9iYKFgAlFt3b1isQoHkPoJgJrK XJ2+K8cNhvUkX8/AEk/2nRrAce2VDLCNQta4diYk= Received: from pek-lxu-l1.wrs.com ([111.198.228.56]) by newxmesmtplogicsvrsza7-0.qq.com (NewEsmtp) with SMTP id A6233279; Mon, 06 Nov 2023 21:41:34 +0800 X-QQ-mid: xmsmtpt1699278096t58dqzev6 Message-ID: X-QQ-XMAILINFO: MiPTq5wGoKOmgKwMic1eu/LYMJO9JiRPxRgOUHmuCPLKX4Topaga83rM6lqIZS 8Cont9d8/jn3djbp/TrCyi7nBHJp8x+KytQC9+BhvDNCnESqEZ/Zn2TMtfjrJZlMhngUjs95OoL9 Qrz/2z0zxSLrDB93CCRl5Pr28ZFzudbof49LsGeKfctNCuMZqR4aYeUnwycJBp9m6HPzvWTCBQZU OKa2SpTLpFxMh1SVGvndjG9D36wQXfWVOMrucSRQqK+cHJZvmsL7Cfj7EYntoVRMlIoO6aRBtXFq Z6D+hfHxANzV3tr+hRv0j79adVyoqjOF+5O57sSOiy5vJpm3lhHX6K7KkHAWeRWs1yU4undxHWRJ o+luZ11shxDC+bpjPXZx1WrLHRCx0Amw/dNvO8xFKdEw8TE5wI1ufRp8qJHTcZ8RhxugjlscK78R YI7dH8/ijMiYKzTfnf9jSIv1EtSIe0URSADDLffEvT/dRkm2P3uMAiNWPm66LqMx2Jy8QRwQxero CW0k7FMRXJaUp7nEe2Dxc+H1NnwB2ujqMl14qubeHNmZivTbFz4U6c9fGX6uy8cIkFCMHS4sYdwB DuMskGWDwlHjWK1EKCkv5ObcoNdreQp5PVy0ZFOfW6opaoX+7YBX9cFmxoQTXbyk3ncf2nULj1jK J5lfVz455FZXLeU1WTFPsAAEHw5Z9EONfaIrrEw88Xj/cQjAIsPqdFrcmIOEQHmjg8A7IrKbYyWJ +NhKQK/+IylclrDEPRtjmVOnumVTOMR96A5rK1S3I3e5BXMvIQdY1h6yyV0fU3O7GKhrWFvGTQ2O 9f42afWN5M7b/wgd2iccs1zYBzZigWShPxhSvc3Ml6miL1jsNw1YgvNhddBtiMKHMGzVnK0TgEbY fUBWgmzQPt8YvhTiIHdCLq4SV95/YCDY+Txjs8IhCAA81oyj1qrBqU2LyZmIHRAdg64E45wJyp2n 00D1VF8qeF70rbdGGtMiicuCiLTrfdJyaUg8BEL2k= X-QQ-XMRINFO: Nq+8W0+stu50PRdwbJxPCL0= From: Edward Adam Davis To: richardcochran@gmail.com Cc: davem@davemloft.net, eadavis@qq.com, habetsm.xilinx@gmail.com, jeremy@jcline.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, reibax@gmail.com, syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Subject: [PATCH net-next V7 2/2] ptp: ptp_read should not release queue Date: Mon, 6 Nov 2023 21:41:35 +0800 X-OQ-MSGID: <20231106134133.3882778-4-eadavis@qq.com> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231106134133.3882778-3-eadavis@qq.com> References: <20231106134133.3882778-3-eadavis@qq.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org Firstly, queue is not the memory allocated in ptp_read; Secondly, other processes may block at ptp_read and wait for conditions to be met to perform read operations. Reported-and-tested-by: syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Fixes: 8f5de6fb2453 ("ptp: support multiple timestamp event readers") Signed-off-by: Edward Adam Davis --- drivers/ptp/ptp_chardev.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c index 473b6d992507..3f7a74788802 100644 --- a/drivers/ptp/ptp_chardev.c +++ b/drivers/ptp/ptp_chardev.c @@ -588,7 +588,5 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags, free_event: kfree(event); exit: - if (result < 0) - ptp_release(pccontext); return result; }