* [PATCH net v2] ptp: ocp: fix resource freeing order
@ 2026-05-11 16:18 Vadim Fedorenko
2026-05-12 5:32 ` kernel test robot
2026-05-12 10:59 ` kernel test robot
0 siblings, 2 replies; 3+ messages in thread
From: Vadim Fedorenko @ 2026-05-11 16:18 UTC (permalink / raw)
To: Richard Cochran, Andrew Lunn, David S. Miller, Paolo Abeni,
Vladimir Oltean, Russell King (Oracle), Jakub Kicinski
Cc: netdev, Vadim Fedorenko
Commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable
events") added a call to ptp_disable_all_events() which changes the
configuration of pins if they support EXTTS events. In ptp_ocp_detach()
pins resources are freed before ptp_clock_unregister() and it leads to
use-after-free during driver removal. Fix it by changing the order of
free/unregister calls.
Fixes: a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events")
Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
---
v1 -> v2:
* on v1 sashiko mentioned that some IRQs may fire after bp->ptp freed.
it looks like a false positive, because ptp_clock_unregister() will
explicitly disable all EXTTS channels before destroying ptp_clock
structure. But there is a possibility of timestampers being active
without PTP_PF_EXTTS function set. It can be done through sysfs files
and it will change pins configuration directly, but can only be done
for TS1..TS4. Disable them explicitly after detaching sysfs files.
---
drivers/ptp/ptp_ocp.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
index beacc2ffb166..c03db15838ce 100644
--- a/drivers/ptp/ptp_ocp.c
+++ b/drivers/ptp/ptp_ocp.c
@@ -4867,6 +4867,18 @@ ptp_ocp_detach(struct ptp_ocp *bp)
ptp_ocp_detach_sysfs(bp);
ptp_ocp_attr_group_del(bp);
timer_delete_sync(&bp->watchdog);
+ /* Disable interrupts on all timestampers */
+ if (bp->ts1)
+ ptp_ocp_ts_enable(bp->ts1, 0, false)
+ if (bp->ts2)
+ ptp_ocp_ts_enable(bp->ts2, 0, false)
+ if (bp->ts3)
+ ptp_ocp_ts_enable(bp->ts3, 0, false)
+ if (bp->ts4)
+ ptp_ocp_ts_enable(bp->ts4, 0, false)
+ if (bp->ptp)
+ ptp_clock_unregister(bp->ptp);
+ kfree(bp->ptp_info.pin_config);
ptp_ocp_unregister_ext(bp->ts0);
ptp_ocp_unregister_ext(bp->ts1);
ptp_ocp_unregister_ext(bp->ts2);
@@ -4884,9 +4896,6 @@ ptp_ocp_detach(struct ptp_ocp *bp)
clk_hw_unregister_fixed_rate(bp->i2c_clk);
if (bp->n_irqs)
pci_free_irq_vectors(bp->pdev);
- if (bp->ptp)
- ptp_clock_unregister(bp->ptp);
- kfree(bp->ptp_info.pin_config);
device_unregister(&bp->dev);
}
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net v2] ptp: ocp: fix resource freeing order
2026-05-11 16:18 [PATCH net v2] ptp: ocp: fix resource freeing order Vadim Fedorenko
@ 2026-05-12 5:32 ` kernel test robot
2026-05-12 10:59 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-05-12 5:32 UTC (permalink / raw)
To: Vadim Fedorenko, Richard Cochran, Andrew Lunn, David S. Miller,
Paolo Abeni, Vladimir Oltean, Russell King (Oracle),
Jakub Kicinski
Cc: oe-kbuild-all, netdev, Vadim Fedorenko
Hi Vadim,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Vadim-Fedorenko/ptp-ocp-fix-resource-freeing-order/20260512-061754
base: net/main
patch link: https://lore.kernel.org/r/20260511161838.1413499-1-vadim.fedorenko%40linux.dev
patch subject: [PATCH net v2] ptp: ocp: fix resource freeing order
config: sparc64-randconfig-002-20260512 (https://download.01.org/0day-ci/archive/20260512/202605121304.5VA5PtAi-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 8.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260512/202605121304.5VA5PtAi-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605121304.5VA5PtAi-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/ptp/ptp_ocp.c: In function 'ptp_ocp_detach':
>> drivers/ptp/ptp_ocp.c:4872:39: error: expected ';' before 'if'
ptp_ocp_ts_enable(bp->ts1, 0, false)
^
;
if (bp->ts2)
~~
vim +4872 drivers/ptp/ptp_ocp.c
4860
4861 static void
4862 ptp_ocp_detach(struct ptp_ocp *bp)
4863 {
4864 int i;
4865
4866 ptp_ocp_debugfs_remove_device(bp);
4867 ptp_ocp_detach_sysfs(bp);
4868 ptp_ocp_attr_group_del(bp);
4869 timer_delete_sync(&bp->watchdog);
4870 /* Disable interrupts on all timestampers */
4871 if (bp->ts1)
> 4872 ptp_ocp_ts_enable(bp->ts1, 0, false)
4873 if (bp->ts2)
4874 ptp_ocp_ts_enable(bp->ts2, 0, false)
4875 if (bp->ts3)
4876 ptp_ocp_ts_enable(bp->ts3, 0, false)
4877 if (bp->ts4)
4878 ptp_ocp_ts_enable(bp->ts4, 0, false)
4879 if (bp->ptp)
4880 ptp_clock_unregister(bp->ptp);
4881 kfree(bp->ptp_info.pin_config);
4882 ptp_ocp_unregister_ext(bp->ts0);
4883 ptp_ocp_unregister_ext(bp->ts1);
4884 ptp_ocp_unregister_ext(bp->ts2);
4885 ptp_ocp_unregister_ext(bp->ts3);
4886 ptp_ocp_unregister_ext(bp->ts4);
4887 ptp_ocp_unregister_ext(bp->pps);
4888 for (i = 0; i < 4; i++)
4889 ptp_ocp_unregister_ext(bp->signal_out[i]);
4890 for (i = 0; i < __PORT_COUNT; i++)
4891 if (bp->port[i].line != -1)
4892 serial8250_unregister_port(bp->port[i].line);
4893 platform_device_unregister(bp->spi_flash);
4894 platform_device_unregister(bp->i2c_ctrl);
4895 if (bp->i2c_clk)
4896 clk_hw_unregister_fixed_rate(bp->i2c_clk);
4897 if (bp->n_irqs)
4898 pci_free_irq_vectors(bp->pdev);
4899 device_unregister(&bp->dev);
4900 }
4901
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net v2] ptp: ocp: fix resource freeing order
2026-05-11 16:18 [PATCH net v2] ptp: ocp: fix resource freeing order Vadim Fedorenko
2026-05-12 5:32 ` kernel test robot
@ 2026-05-12 10:59 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-05-12 10:59 UTC (permalink / raw)
To: Vadim Fedorenko, Richard Cochran, Andrew Lunn, David S. Miller,
Paolo Abeni, Vladimir Oltean, Russell King (Oracle),
Jakub Kicinski
Cc: llvm, oe-kbuild-all, netdev, Vadim Fedorenko
Hi Vadim,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Vadim-Fedorenko/ptp-ocp-fix-resource-freeing-order/20260512-061754
base: net/main
patch link: https://lore.kernel.org/r/20260511161838.1413499-1-vadim.fedorenko%40linux.dev
patch subject: [PATCH net v2] ptp: ocp: fix resource freeing order
config: riscv-allyesconfig (https://download.01.org/0day-ci/archive/20260512/202605121813.ZVbOZfjr-lkp@intel.com/config)
compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260512/202605121813.ZVbOZfjr-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605121813.ZVbOZfjr-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/ptp/ptp_ocp.c:4872:39: error: expected ';' after expression
ptp_ocp_ts_enable(bp->ts1, 0, false)
^
;
drivers/ptp/ptp_ocp.c:4874:39: error: expected ';' after expression
ptp_ocp_ts_enable(bp->ts2, 0, false)
^
;
drivers/ptp/ptp_ocp.c:4876:39: error: expected ';' after expression
ptp_ocp_ts_enable(bp->ts3, 0, false)
^
;
drivers/ptp/ptp_ocp.c:4878:39: error: expected ';' after expression
ptp_ocp_ts_enable(bp->ts4, 0, false)
^
;
4 errors generated.
vim +4872 drivers/ptp/ptp_ocp.c
4860
4861 static void
4862 ptp_ocp_detach(struct ptp_ocp *bp)
4863 {
4864 int i;
4865
4866 ptp_ocp_debugfs_remove_device(bp);
4867 ptp_ocp_detach_sysfs(bp);
4868 ptp_ocp_attr_group_del(bp);
4869 timer_delete_sync(&bp->watchdog);
4870 /* Disable interrupts on all timestampers */
4871 if (bp->ts1)
> 4872 ptp_ocp_ts_enable(bp->ts1, 0, false)
4873 if (bp->ts2)
4874 ptp_ocp_ts_enable(bp->ts2, 0, false)
4875 if (bp->ts3)
4876 ptp_ocp_ts_enable(bp->ts3, 0, false)
4877 if (bp->ts4)
4878 ptp_ocp_ts_enable(bp->ts4, 0, false)
4879 if (bp->ptp)
4880 ptp_clock_unregister(bp->ptp);
4881 kfree(bp->ptp_info.pin_config);
4882 ptp_ocp_unregister_ext(bp->ts0);
4883 ptp_ocp_unregister_ext(bp->ts1);
4884 ptp_ocp_unregister_ext(bp->ts2);
4885 ptp_ocp_unregister_ext(bp->ts3);
4886 ptp_ocp_unregister_ext(bp->ts4);
4887 ptp_ocp_unregister_ext(bp->pps);
4888 for (i = 0; i < 4; i++)
4889 ptp_ocp_unregister_ext(bp->signal_out[i]);
4890 for (i = 0; i < __PORT_COUNT; i++)
4891 if (bp->port[i].line != -1)
4892 serial8250_unregister_port(bp->port[i].line);
4893 platform_device_unregister(bp->spi_flash);
4894 platform_device_unregister(bp->i2c_ctrl);
4895 if (bp->i2c_clk)
4896 clk_hw_unregister_fixed_rate(bp->i2c_clk);
4897 if (bp->n_irqs)
4898 pci_free_irq_vectors(bp->pdev);
4899 device_unregister(&bp->dev);
4900 }
4901
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-12 10:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-11 16:18 [PATCH net v2] ptp: ocp: fix resource freeing order Vadim Fedorenko
2026-05-12 5:32 ` kernel test robot
2026-05-12 10:59 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox