When updating and potentially removing event subscribers, the code uses
the simple list traversal macro.  As a result, the list will become
corrupted whenever a subscriber is removed.  This patch fixes the issue
by using the appropriate macro.

Fixes: 5104e3e56b59 ("Event subscribing")
Signed-off-by: Richard Cochran <richardcoch...@gmail.com>
Reported-by: Michael Walle <mich...@walle.cc>
---
 clock.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/clock.c b/clock.c
index 1668383..6f9cc21 100644
--- a/clock.c
+++ b/clock.c
@@ -145,9 +145,9 @@ static void remove_subscriber(struct clock_subscriber *s)
 static void clock_update_subscription(struct clock *c, struct ptp_message *req,
                                      uint8_t *bitmask, uint16_t duration)
 {
-       struct clock_subscriber *s;
-       int i, remove = 1;
+       struct clock_subscriber *s, *tmp;
        struct timespec now;
+       int i, remove = 1;
 
        for (i = 0; i < EVENT_BITMASK_CNT; i++) {
                if (bitmask[i]) {
@@ -156,12 +156,11 @@ static void clock_update_subscription(struct clock *c, 
struct ptp_message *req,
                }
        }
 
-       LIST_FOREACH(s, &c->subscribers, list) {
+       LIST_FOREACH_SAFE(s, &c->subscribers, list, tmp) {
                if (pid_eq(&s->targetPortIdentity,
                           &req->header.sourcePortIdentity)) {
-                       /* Found, update the transport address and event
-                        * mask. */
                        if (!remove) {
+                               /* Update transport address and event mask. */
                                s->addr = req->address;
                                memcpy(s->events, bitmask, EVENT_BITMASK_CNT);
                                clock_gettime(CLOCK_MONOTONIC, &now);
-- 
2.20.1



_______________________________________________
Linuxptp-devel mailing list
Linuxptp-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linuxptp-devel

Reply via email to