From patchwork Tue Nov 7 08:00:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Edward Adam Davis X-Patchwork-Id: 13448016 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1B77CA6E for ; Tue, 7 Nov 2023 08:00:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="QgJ6PrhS" Received: from out203-205-221-190.mail.qq.com (out203-205-221-190.mail.qq.com [203.205.221.190]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C895E122; Tue, 7 Nov 2023 00:00:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1699344042; bh=Y13edSMPHSTeEjO4Q2T9XMLjGfxpFO+4U5U506LRl6w=; h=From:To:Cc:Subject:Date; b=QgJ6PrhSIkxp2QSK9llo4k4rBfFqW5XsjbZlNQbyFAM/UyZ/MZoq0vJvYc2i/7kHz siCdnYr0xXbd3qCpSP0/H0O3bG0IyWtQEq+AMe08/Q31FMyzTUH15aVtHL43cTTOZZ 0Yv7rlug7iNtvDP3Gs3nhabykPL3IGYB1hTQJgiM= Received: from pek-lxu-l1.wrs.com ([111.198.228.56]) by newxmesmtplogicsvrsza10-0.qq.com (NewEsmtp) with SMTP id 278C277; Tue, 07 Nov 2023 16:00:39 +0800 X-QQ-mid: xmsmtpt1699344039tpv5sb9xv Message-ID: X-QQ-XMAILINFO: NkHKfw09D6j8tFugrFYQ+3Wix8FlP2Gsy0h2yucQcoYwN2n0NKVSDpBhqJXEWD V/Y2cmflXS2EzCnHedqj4pMynetU3KC5j0gkJ2h5z9iQ2MU0gA36QLYJrdik28SoQg92tfPBFqK7 YoNYWJ5uRiSYDy9bcnyDsjivDJK54mhukxQ723NjLgZdCoS6czS6hIE1AB1mU0NJn2cXuZ3Jm6qQ adsAJqDI6zoLzKxM1zpuec3PqbNgwa2lHd7MXrWyj7vsQ6vhngGibMCJsp2l71bBPAZ6gjQyPxLW zhtthg6+QEghKoNBGAz+l/n9OTV1oUo/8iGkcRW4QS7RZrNIdmxuoT5OsHudbMaC6OYVjX+qId/R wEM+h3ZX3nPZEOwWaOBt1ek4gssKLjDhWQySXU9hIUfUEndJXvPqK6FxEm3isrmL/ClkHILG5Rm3 ZUW0/LqDpxvJ5MVvhG/FmpQDqENgTgzKJCGxaJ0a1GYhTgr+DEFT4KojlpriUFWyG7fOxNjgaPGk JgxiX8pO83/0It6wm2dfase5mFUvwK2MMLTJP4G9hLJv34NN0PHKpCBoOO3dlJqT1UkDH3JWEjNO 8LWj1F0L+UEAHse1B+m2T1iMhelaJUcccbjQ47s/46JE0Po7Q1bOSrZbiXEP0LwoWtcjGkTzrQRO Tqn2MkPfkF7oca3TkfgFpyrULHyqYWgbUd5mg0B8JLpK4xMAvHBf5d2KBS19q+EVKz8rJNpM0nHk QR1j/5j3WsQgXokxGyPW8LpgnpWA+xjXmgih2yhqVcGv1AWJlzANBcRKxpW1ifTMZdD43GHr7nXp 4kWyR7zCyw49Z5QxbdG5WGq5Icsxa9OJAJGoESQDDSJowboX0S6y2Y5nqMFtdHDm5uVjpAAKiiRN 3eupL3B2Qx2xO/fstgkQfIzhn7o+xz4pnC/FA6UIkOviz/EV8t776zQ3GgTt+xqJQVRxgkr8qRxG COMVNkS2I= X-QQ-XMRINFO: NS+P29fieYNw95Bth2bWPxk= From: Edward Adam Davis To: richardcochran@gmail.com Cc: davem@davemloft.net, eadavis@qq.com, habetsm.xilinx@gmail.com, jeremy@jcline.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, reibax@gmail.com, syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Subject: [PATCH net V9 1/2] ptp: ptp_read should not release queue Date: Tue, 7 Nov 2023 16:00:40 +0800 X-OQ-MSGID: <20231107080039.436253-3-eadavis@qq.com> X-Mailer: git-send-email 2.42.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org Firstly, queue is not the memory allocated in ptp_read; Secondly, other processes may block at ptp_read and wait for conditions to be met to perform read operations. Acked-by: Richard Cochran Reported-and-tested-by: syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Fixes: 8f5de6fb2453 ("ptp: support multiple timestamp event readers") Signed-off-by: Edward Adam Davis --- drivers/ptp/ptp_chardev.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c index 473b6d992507..3f7a74788802 100644 --- a/drivers/ptp/ptp_chardev.c +++ b/drivers/ptp/ptp_chardev.c @@ -588,7 +588,5 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags, free_event: kfree(event); exit: - if (result < 0) - ptp_release(pccontext); return result; } From patchwork Tue Nov 7 08:00:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Edward Adam Davis X-Patchwork-Id: 13448017 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F31BDD2F6 for ; Tue, 7 Nov 2023 08:00:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="CdGTlmK4" Received: from out203-205-251-59.mail.qq.com (out203-205-251-59.mail.qq.com [203.205.251.59]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6BA4A114; Tue, 7 Nov 2023 00:00:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1699344044; bh=/3hYxG4N3WJw8nBKqrjTVQUWUiQVmDcgYis0QEzy/6s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CdGTlmK4VnFzXa0sitWFEt7Nvjmpm8NEA3Wc5ufYvHj0fJhS54nl6HQt8jcjJ2EEX mDZClP0qs8x1rJi2M9kFD/1EgyvtQEicoQ8XeYD6C4g4wz4+30xyz2K8esNC9obfMt IPcafEqd/0RdacsjQWHJ+KMdovx4WBgXQ24oo+Fc= Received: from pek-lxu-l1.wrs.com ([111.198.228.56]) by newxmesmtplogicsvrsza10-0.qq.com (NewEsmtp) with SMTP id 278C277; Tue, 07 Nov 2023 16:00:39 +0800 X-QQ-mid: xmsmtpt1699344042t3zlf7rlw Message-ID: X-QQ-XMAILINFO: NDThGJ6G3IIARYpJUjkKX0n0/eFol7V1uSZbsttNLyb9F/jJnznpXGClj0A6SD Eq1yVfIhAG69EZ0t/YA8KdwgytGv+nDPcHqtvg2qfeii5KUy8mDzb/AHoPZBqQ+3uK+nAGO5InMQ 46Bc9JxTUo6pfGrc11tMxU2UgrKl1JNCgott2uhIv1ELBSw0knOsNERRmKoG0eiHifnrzFTPBZc2 EPyvP4Cwy2ygbvDEnPyXMW1MLiGV5rItY2fBTj1R2og0RogUZaLykwThrZ1rxtqNvFnHfsry2gkw ZpQQ1e3O1C/lgZO2RKT+VWJ1iZ8J7TZa0lZgBbh/pwaWKa2k/ZkCHCMhQlCArnsrGgv8YT4uJWs6 CtMj191fMSRI73EwMCaYiXnm/UzSvbCbSz/+q7HUvJlft6ZdaP0JFBfFRgoEqUN3q1ZxPpwyZ/LX dSPI+fXTGycwdfKL7Ad6lVAP/uAb3qfQ1iWZc0GLp+nb+Gm0WSaZKaHjewfd49d10ZWJsqQlmeEI AY/UR3GDInYpOOyN7BTRetBcCB7GX27nfDml/NVs9ymvoMW5RPwG/PEec8yxRoCnk1wbJjMHsUsJ zpv2sPHp0VQ+J66ajd6hUp47NxGxOjJmV6YJeEU8IGyOLtSHt28OVWVNNttIwouuNVMIoA2ch94A Yd1gxc1Uczr1ZZlbddAVE+dzYPLdCJPKEvuzm6WELPZtXWVYBW/BAhg3hCPwdKQLw1QnbM8x3iaS NjQx4XdWxIfuMKiS6TP+TW+XtmsHjul0BVFfPUsffGEHg4Lq8QZJxiYz+qhlIaV1jorehK4TmRWA 8ShUXXx6Mla29N81UwzkAzMmmVHcJB/0MUBL/vr0heH2lp9NI+4yG+rtHZDB0Zna/cbNXgyV4D0Z KR4DGuHhv6G/FS+VkNX0WRASstuNLNCfA5LhOVhgyEG/zbcypSjTnhSbCPC+UpIGqC3u8r4O086t ty1PrcWItUktrlVXmP4JupE/wBWxa1M049R7zuy7s= X-QQ-XMRINFO: OWPUhxQsoeAVDbp3OJHYyFg= From: Edward Adam Davis To: richardcochran@gmail.com Cc: davem@davemloft.net, eadavis@qq.com, habetsm.xilinx@gmail.com, jeremy@jcline.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, reibax@gmail.com, syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Subject: [PATCH net V9 2/2] ptp: fix corrupted list in ptp_open Date: Tue, 7 Nov 2023 16:00:41 +0800 X-OQ-MSGID: <20231107080039.436253-4-eadavis@qq.com> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231107080039.436253-3-eadavis@qq.com> References: <20231107080039.436253-3-eadavis@qq.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org There is no lock protection when writing ptp->tsevqs in ptp_open() and ptp_release(), which can cause data corruption, use spin lock to avoid this issue. Moreover, ptp_release() should not be used to release the queue in ptp_read(), and it should be deleted altogether. Acked-by: Richard Cochran Reported-and-tested-by: syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Fixes: 8f5de6fb2453 ("ptp: support multiple timestamp event readers") Signed-off-by: Edward Adam Davis --- drivers/ptp/ptp_chardev.c | 21 ++++++++++++--------- drivers/ptp/ptp_clock.c | 8 ++++++-- drivers/ptp/ptp_private.h | 1 + 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c index 282cd7d24077..473b6d992507 100644 --- a/drivers/ptp/ptp_chardev.c +++ b/drivers/ptp/ptp_chardev.c @@ -108,6 +108,7 @@ int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode) container_of(pccontext->clk, struct ptp_clock, clock); struct timestamp_event_queue *queue; char debugfsname[32]; + unsigned long flags; queue = kzalloc(sizeof(*queue), GFP_KERNEL); if (!queue) @@ -119,7 +120,9 @@ int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode) } bitmap_set(queue->mask, 0, PTP_MAX_CHANNELS); spin_lock_init(&queue->lock); + spin_lock_irqsave(&ptp->tsevqs_lock, flags); list_add_tail(&queue->qlist, &ptp->tsevqs); + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); pccontext->private_clkdata = queue; /* Debugfs contents */ @@ -139,16 +142,16 @@ int ptp_release(struct posix_clock_context *pccontext) { struct timestamp_event_queue *queue = pccontext->private_clkdata; unsigned long flags; + struct ptp_clock *ptp = + container_of(pccontext->clk, struct ptp_clock, clock); - if (queue) { - debugfs_remove(queue->debugfs_instance); - pccontext->private_clkdata = NULL; - spin_lock_irqsave(&queue->lock, flags); - list_del(&queue->qlist); - spin_unlock_irqrestore(&queue->lock, flags); - bitmap_free(queue->mask); - kfree(queue); - } + debugfs_remove(queue->debugfs_instance); + pccontext->private_clkdata = NULL; + spin_lock_irqsave(&ptp->tsevqs_lock, flags); + list_del(&queue->qlist); + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); + bitmap_free(queue->mask); + kfree(queue); return 0; } diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c index 3d1b0a97301c..b901f2910963 100644 --- a/drivers/ptp/ptp_clock.c +++ b/drivers/ptp/ptp_clock.c @@ -179,11 +179,11 @@ static void ptp_clock_release(struct device *dev) mutex_destroy(&ptp->pincfg_mux); mutex_destroy(&ptp->n_vclocks_mux); /* Delete first entry */ + spin_lock_irqsave(&ptp->tsevqs_lock, flags); tsevq = list_first_entry(&ptp->tsevqs, struct timestamp_event_queue, qlist); - spin_lock_irqsave(&tsevq->lock, flags); list_del(&tsevq->qlist); - spin_unlock_irqrestore(&tsevq->lock, flags); + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); bitmap_free(tsevq->mask); kfree(tsevq); debugfs_remove(ptp->debugfs_root); @@ -247,6 +247,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, if (!queue) goto no_memory_queue; list_add_tail(&queue->qlist, &ptp->tsevqs); + spin_lock_init(&ptp->tsevqs_lock); queue->mask = bitmap_alloc(PTP_MAX_CHANNELS, GFP_KERNEL); if (!queue->mask) goto no_memory_bitmap; @@ -407,6 +408,7 @@ void ptp_clock_event(struct ptp_clock *ptp, struct ptp_clock_event *event) { struct timestamp_event_queue *tsevq; struct pps_event_time evt; + unsigned long flags; switch (event->type) { @@ -415,10 +417,12 @@ void ptp_clock_event(struct ptp_clock *ptp, struct ptp_clock_event *event) case PTP_CLOCK_EXTTS: /* Enqueue timestamp on selected queues */ + spin_lock_irqsave(&ptp->tsevqs_lock, flags); list_for_each_entry(tsevq, &ptp->tsevqs, qlist) { if (test_bit((unsigned int)event->index, tsevq->mask)) enqueue_external_timestamp(tsevq, event); } + spin_unlock_irqrestore(&ptp->tsevqs_lock, flags); wake_up_interruptible(&ptp->tsev_wq); break; diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h index 52f87e394aa6..35fde0a05746 100644 --- a/drivers/ptp/ptp_private.h +++ b/drivers/ptp/ptp_private.h @@ -44,6 +44,7 @@ struct ptp_clock { struct pps_device *pps_source; long dialed_frequency; /* remembers the frequency adjustment */ struct list_head tsevqs; /* timestamp fifo list */ + spinlock_t tsevqs_lock; /* protects tsevqs from concurrent access */ struct mutex pincfg_mux; /* protect concurrent info->pin_config access */ wait_queue_head_t tsev_wq; int defunct; /* tells readers to go away when clock is being removed */