diff options
Diffstat (limited to '0015-ptp-free-ptp-device-pin-descriptors-properly.patch')
| -rw-r--r-- | 0015-ptp-free-ptp-device-pin-descriptors-properly.patch | 50 |
1 files changed, 0 insertions, 50 deletions
diff --git a/0015-ptp-free-ptp-device-pin-descriptors-properly.patch b/0015-ptp-free-ptp-device-pin-descriptors-properly.patch deleted file mode 100644 index 6298fa443499..000000000000 --- a/0015-ptp-free-ptp-device-pin-descriptors-properly.patch +++ /dev/null @@ -1,50 +0,0 @@ -From b89e9f6a3ec61a96b5abced31813ad043bda3827 Mon Sep 17 00:00:00 2001 -From: Vladis Dronov <vdronov@redhat.com> -Date: Mon, 13 Jan 2020 14:00:09 +0100 -Subject: [PATCH 15/16] ptp: free ptp device pin descriptors properly - -There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups() -first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs -them to destroy a related sysfs device. - -These functions can not be just swapped, as posix_clock_unregister() frees -ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling -ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed. - -This makes this patch fix an UAF bug in a patch which fixes an UAF bug. - -Reported-by: Antti Laakso <antti.laakso@intel.com> -Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") -Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/ -Signed-off-by: Vladis Dronov <vdronov@redhat.com> -Acked-by: Richard Cochran <richardcochran@gmail.com> ---- - drivers/ptp/ptp_clock.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c -index 61fafe0374ce..b84f16bbd6f2 100644 ---- a/drivers/ptp/ptp_clock.c -+++ b/drivers/ptp/ptp_clock.c -@@ -170,6 +170,7 @@ static void ptp_clock_release(struct device *dev) - { - struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev); - -+ ptp_cleanup_pin_groups(ptp); - mutex_destroy(&ptp->tsevq_mux); - mutex_destroy(&ptp->pincfg_mux); - ida_simple_remove(&ptp_clocks_map, ptp->index); -@@ -302,9 +303,8 @@ int ptp_clock_unregister(struct ptp_clock *ptp) - if (ptp->pps_source) - pps_unregister_source(ptp->pps_source); - -- ptp_cleanup_pin_groups(ptp); -- - posix_clock_unregister(&ptp->clock); -+ - return 0; - } - EXPORT_SYMBOL(ptp_clock_unregister); --- -2.25.0 - |