Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38;
From:   Rahul Rameshbabu <rrameshbabu@nvidia.com>
To:     Lizhi Xu <lizhi.xu@windriver.com>
Cc:     <syzbot+8a78ecea7ac1a2ea26e5@syzkaller.appspotmail.com>,
        <davem@davemloft.net>, <linux-kernel@vger.kernel.org>,
        <netdev@vger.kernel.org>, <reibax@gmail.com>,
        <richardcochran@gmail.com>, <syzkaller-bugs@googlegroups.com>
Subject: Re: [PATCH] ptp: fix null ptr deref in ptp_ioctrl
References: <000000000000e7b62806096c7d67@google.com>
        <20231106011926.2928881-1-lizhi.xu@windriver.com>
Date:   Sun, 05 Nov 2023 18:12:14 -0800
In-Reply-To: <20231106011926.2928881-1-lizhi.xu@windriver.com> (Lizhi Xu's
        message of "Mon, 6 Nov 2023 09:19:26 +0800")
Message-ID: <877cmvhbpd.fsf@nvidia.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?f1+vanvGcMIaeKHmHBOmeh4X61mMUmLb+kZzYU9e1RrHEBrpTUI81eAnIw8+?=
 =?us-ascii?Q?JwQ/29ufmYZS9U+RadAURzhcGlfK+rUMyPegJnh3wkgBXEq6uuGurqnVBBml?=
 =?us-ascii?Q?+mwMV2J9kjvPszVNS4fbjTnfH2t052XiekeUV3ZGShfNJrjAbIDIiMdZ0eSL?=
 =?us-ascii?Q?UiA7ekQWiKSt4a7N5G2dJ02Tq1IX896HWl+qWi1RCgtQwRwGYUCc7fjOR6YU?=
 =?us-ascii?Q?XunBVUwx5C2FFZCOmiLpC/4vUMePApws7v5CLQzpPClBPYwwpFQpXKIvDJ0q?=
 =?us-ascii?Q?dHSMgpl3gg0JXaxdwMnaP241aqrTgs6F7kcktYEofP5N8mRSoRxx5+26nQjR?=
 =?us-ascii?Q?NdXpw12gLlNj1DulnFI+NNSnMLwLBR0whOKtxfa4yLxz+wdeWdnatXh6oqBS?=
 =?us-ascii?Q?gX4Myi7+TaMp/uxXB01e9AKnZE0Sm/QJ58erjyyDlJ1p/kwHFFV4HD7cHNYk?=
 =?us-ascii?Q?KZmP0v3VhdfcgtcMae88e5LbSW6EypxJr2o3u2DqcXiRKA474Fyuyz1GukXx?=
 =?us-ascii?Q?SXzy2xWB9qUfiFWgVry/UYFAtAJ73M8naG52nxlgmRcQNp6pTiUpmKNcF5PU?=
 =?us-ascii?Q?qlP9hNFLHmVHEULtq1ZPOgKHy4Dy3rzYrECbLJpwRKO7ancMcdBsso7+n7KJ?=
 =?us-ascii?Q?6CvFudy0GH/1Afbjr9Ae7ZCBARw3nEQzBKB6mK6w/aMB6Y4rPUxBOQHjWmvY?=
 =?us-ascii?Q?Fe9vhH5ajJkCnVZmUBUMY0fQnjyd7qq8gpzy4Sk3rfbfn05AgrI1jDyqYFF6?=
 =?us-ascii?Q?EKZYFVk3kfmC+TBqN2KP+1jDSavOZx4nnQOYXyd0hD0GUApnj1+871lezGac?=
 =?us-ascii?Q?wqP1RpijixA6YQ04XrM2tTOJLVLdzGbpRgqwi+58oxH8D6NggGGkANuQ7WFm?=
 =?us-ascii?Q?NNvYU6vJr06ocSMHHRyH2GB/DYqxQflnRItt3QdXCiZ3lR/rb6khHzZ4XlmP?=
 =?us-ascii?Q?pad4m0LPJGk0K7wlr5enhkDFPHRPPRmxYVDAkc7JKBuPx9Mm2WoSrBYja+Wb?=
 =?us-ascii?Q?ZYI72lhwvDNCQyh/5oOiIfrBJUSB1fJfHWa8OH3qHDAgv/We1cbUCNury2x1?=
 =?us-ascii?Q?tyQDYNy9PlwyWEgMzxqthbosQO3qR+VG+8R45z/ha6QWZ18bAhxCzk0SMM7h?=
 =?us-ascii?Q?JY1VvHQE9W/bVr21sRUlm/3MwpHFEIr4UopI9r6579oFxh7khutohEpPe8ZK?=
 =?us-ascii?Q?omzskv/hFHATYcOaAUkXPc8vw58vnbJ9map19hvn5Fd/vRpchtuHNcgjRki8?=
 =?us-ascii?Q?tviBc9Z2JmobZlA4dnYu5f4+sbEOOSJs3HXi9Ddcqpc8cxhZm8VqLdcf3Sy+?=
 =?us-ascii?Q?Vb0emnqr0BVXjUttP/fSg76IJIpMUs9aWaOvRpxC/FWsjTEp/cFwAxdKZToE?=
 =?us-ascii?Q?Kpp9I9MNtp/9j3DwagLIDSqSi/OmG9k6rnQHs4xkhk0p14qP8ukuFMuUvNDh?=
 =?us-ascii?Q?Iv0PKJZsO8oOKfRZ4YRM9/X9xQj3/uSb/eqm4VsBAXw8lPJNZFY2+TgP2aRA?=
 =?us-ascii?Q?kY8xexNelcNY5vBO4Akc49DVe7V3au0cwS541nRnU6KGiLkFik9LCTnEX5UJ?=
 =?us-ascii?Q?V7v/yMcTsKQTKLjjvvAQnFrUTYulC2z0u1ZoDG8r?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d0900799-c8e6-41c2-ea53-08dbde6dd0cd
X-MS-Exchange-CrossTenant-AuthSource: BYAPR12MB2743.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Nov 2023 02:12:24.0705
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 25T3iwknh/bXD3HKt7cJpDQnu75tdZysk7Mmq5nf1KZLPHvpQfR4iFh1YpG9c84+b6Xorgob4CLd/+NLZG32gQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR12MB6433
X-Spam-Status: No, score=-1.4 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE
	autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Sun, 05 Nov 2023 18:12:43 -0800 (PST)

On Mon, 06 Nov, 2023 09:19:26 +0800 Lizhi Xu <lizhi.xu@windriver.com> wrote:

<snip>

>
> It can be confirmed that after the execution of "read (3, 0x20000080, 90)",
> ptp_release() will be called to release the queue and set
> pccontext->private_clkdata = NULL at the same time, this is unreasonable and
> incorrect. The queue is not the memory requested in ptp_read() and should not
> be released in ptp_read().
>
> Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
> ---
>  drivers/ptp/ptp_chardev.c | 2 --
>  1 file changed, 2 deletions(-)
>
> diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
> index 282cd7d24077..27c1ef493617 100644
> --- a/drivers/ptp/ptp_chardev.c
> +++ b/drivers/ptp/ptp_chardev.c
> @@ -585,7 +585,5 @@ ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags,
>  free_event:
>  	kfree(event);
>  exit:
> -	if (result < 0)
> -		ptp_release(pccontext);
>  	return result;
>  }

There is already an ongoing review for a patch submission that covers this.

  https://lore.kernel.org/netdev/tencent_856E1C97CCE9E2ED66CC087B526CD42ED50A@qq.com/

--
Thanks,

Rahul Rameshbabu