Re: [PATCH net RESEND] net: fec: drain PEROUT requests before canceling the timer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: fec: use-after-free of ptp_clock in fec_pps_interrupt
--

commit ab1057fad6a311f8c4eada4b450b44f774123656
Author: Myeonghun Pak <mhun512@gmail.com>

net: fec: drain PEROUT requests before canceling the timer

Unregister the PTP clock first so all in-flight ioctls have returned
before canceling the timer. Clear the PEROUT state and compare channel
afterward, then disable PPS. Serialize the channel write with PTP clock
shutdown and skip it when that clock is off.

> diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
> index 56801c2009d59..67901e036ac32 100644
> --- a/drivers/net/ethernet/freescale/fec_ptp.c
> +++ b/drivers/net/ethernet/freescale/fec_ptp.c

[ ... ]

> @@ -856,11 +859,12 @@ void fec_ptp_stop(struct platform_device *pdev)
>  	struct net_device *ndev = platform_get_drvdata(pdev);
>  	struct fec_enet_private *fep = netdev_priv(ndev);
>  
> -	if (fep->pps_enable)
> -		fec_ptp_enable_pps(fep, 0);
> -
>  	cancel_delayed_work_sync(&fep->time_keep);
> -	hrtimer_cancel(&fep->perout_timer);
>  	if (fep->ptp_clock)
>  		ptp_clock_unregister(fep->ptp_clock);
> +
> +	/* An in-flight PEROUT ioctl can arm the timer until unregister returns. */
> +	fec_ptp_pps_disable(fep, fep->pps_channel);
> +	if (fep->pps_enable)
> +		fec_ptp_enable_pps(fep, 0);

[Severity: High]
Can fec_pps_interrupt() fire after ptp_clock_unregister() but before
fec_ptp_enable_pps() finishes?

Since ptp_clock_unregister() drops the reference and frees fep->ptp_clock,
and fep->pps_enable is still true in this window, if the hardware timer
interrupts, fec_pps_interrupt() could execute:

drivers/net/ethernet/freescale/fec_ptp.c:fec_pps_interrupt() {
    ...
		if (fep->pps_enable) {
			event.type = PTP_CLOCK_PPS;
			ptp_clock_event(fep->ptp_clock, &event);
		}
    ...
}

Would this dereference the freed fep->ptp_clock pointer causing a
use-after-free?

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001180258.4054391-1-mhun512@gmail.com?part=1