8bf935cf78
The ptp_ocp_detach() only shuts down the watchdog timer if it is
pending. However, if the timer handler is already running, the
timer_delete_sync() is not called. This leads to race conditions
where the devlink that contains the ptp_ocp is deallocated while
the timer handler is still accessing it, resulting in use-after-free
bugs. The following details one of the race scenarios.
(thread 1) | (thread 2)
ptp_ocp_remove() |
ptp_ocp_detach() | ptp_ocp_watchdog()
if (timer_pending(&bp->watchdog))| bp = timer_container_of()
timer_delete_sync() |
|
devlink_free(devlink) //free |
| bp-> //use
Resolve this by unconditionally calling timer_delete_sync() to ensure
the timer is reliably deactivated, preventing any access after free.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| ptp_chardev.c | ||
| ptp_clock.c | ||
| ptp_clockmatrix.c | ||
| ptp_clockmatrix.h | ||
| ptp_dfl_tod.c | ||
| ptp_dte.c | ||
| ptp_fc3.c | ||
| ptp_fc3.h | ||
| ptp_idt82p33.c | ||
| ptp_idt82p33.h | ||
| ptp_ines.c | ||
| ptp_kvm_arm.c | ||
| ptp_kvm_common.c | ||
| ptp_kvm_x86.c | ||
| ptp_mock.c | ||
| ptp_ocp.c | ||
| ptp_pch.c | ||
| ptp_private.h | ||
| ptp_qoriq.c | ||
| ptp_qoriq_debugfs.c | ||
| ptp_s390.c | ||
| ptp_sysfs.c | ||
| ptp_vclock.c | ||
| ptp_vmclock.c | ||
| ptp_vmw.c | ||