)]}'
{
  "commit": "603a0c40d414ea12509fc45f2b930449a8d4aad2",
  "tree": "b13460a9a1656293e3195ad841bf3b1e9b9f9423",
  "parents": [
    "cd74322d83d88c8407f751cb09dbc51d0ebc5a41"
  ],
  "author": {
    "name": "Yu Zhang",
    "email": "yuz08559@gmail.com",
    "time": "Mon Oct 26 20:05:35 2026 +1000"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Fri Oct 30 16:04:08 2026 -0700"
  },
  "message": "ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked\n\nextts_fifo_show() walks ptp-\u003etsevqs with list_count_nodes() and then\nlist_first_entry() without holding ptp-\u003etsevqs_lock, the spinlock that\n\"protects tsevqs from concurrent access\". Every other accessor of the\nlist honours it: ptp_open() (list_add_tail), ptp_release() (list_del\nfollowed by kfree of the per-fd queue), ptp_clock_release() and\nptp_clock_event() all take tsevqs_lock. extts_fifo_show() is the only\none that does not.\n\nA per-fd timestamp queue is appended to tsevqs on open(\"/dev/ptpN\") and\nremoved and freed on close(), both under tsevqs_lock:\n\n\tscoped_guard(spinlock_irq, \u0026ptp-\u003etsevqs_lock)\n\t\tlist_del(\u0026queue-\u003eqlist);\n\tbitmap_free(queue-\u003emask);\n\tkfree(queue);\n\nSo a read of /sys/class/ptp/ptpN/fifo running concurrently with a\nclose() of a /dev/ptpN fd can have list_count_nodes() walk into the\nqueue that close() is removing and freeing, dereferencing freed memory\n(use-after-free) or a poisoned list pointer.\n\nTake tsevqs_lock around the list walk. The fifo only ever draws from the\nfirst queue, which is the registration-time queue created in\nptp_clock_register() and freed only in ptp_clock_release(); that cannot\nrun while the sysfs attribute is being read, so the dequeue from\nqueue-\u003ebuf under queue-\u003elock may stay outside tsevqs_lock and the lock\norder is unchanged.\n\nFixes: d26ab5a35ad9 (\"ptp: Replace timestamp event queue with linked list\")\nCc: stable@vger.kernel.org\nSigned-off-by: Yu Zhang \u003cyuz08559@gmail.com\u003e\nLink: https://patch.msgid.link/20261026100535.68114-1-yuz08559@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dc398c6b75284bf58ee37522249f2e1942db3443",
      "old_mode": 33188,
      "old_path": "drivers/ptp/ptp_sysfs.c",
      "new_id": "7d09256aca7242ee8364e926baf8e18da6a1c1b2",
      "new_mode": 33188,
      "new_path": "drivers/ptp/ptp_sysfs.c"
    }
  ]
}