From 45aa981e4a72f9ce9b1d1af8ede6f4c69ab184a8 Mon Sep 17 00:00:00 2001 From: Richard Cochran Date: Fri, 6 Mar 2020 11:01:31 -0800 Subject: [PATCH] clock: Safely remove event subscribers from list. When updating and potentially removing event subscribers, the code uses the simple list traversal macro. As a result, the list will become corrupted whenever a subscriber is removed. This patch fixes the issue by using the appropriate macro. Fixes: 5104e3e56b59 ("Event subscribing") Signed-off-by: Richard Cochran Reported-by: Michael Walle Reviewed-by: Jacob Keller --- clock.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/clock.c b/clock.c index 1668383..6f9cc21 100644 --- a/clock.c +++ b/clock.c @@ -145,9 +145,9 @@ static void remove_subscriber(struct clock_subscriber *s) static void clock_update_subscription(struct clock *c, struct ptp_message *req, uint8_t *bitmask, uint16_t duration) { - struct clock_subscriber *s; - int i, remove = 1; + struct clock_subscriber *s, *tmp; struct timespec now; + int i, remove = 1; for (i = 0; i < EVENT_BITMASK_CNT; i++) { if (bitmask[i]) { @@ -156,12 +156,11 @@ static void clock_update_subscription(struct clock *c, struct ptp_message *req, } } - LIST_FOREACH(s, &c->subscribers, list) { + LIST_FOREACH_SAFE(s, &c->subscribers, list, tmp) { if (pid_eq(&s->targetPortIdentity, &req->header.sourcePortIdentity)) { - /* Found, update the transport address and event - * mask. */ if (!remove) { + /* Update transport address and event mask. */ s->addr = req->address; memcpy(s->events, bitmask, EVENT_BITMASK_CNT); clock_gettime(CLOCK_MONOTONIC, &now);