[Linuxptp-devel] [PATCH] Free peer delay responses and followup messages when sending a new peer delay request

[Delio Brignoli]

If messages are not freed, it is possible (with purposely crafted traffic) to trigger
a peer delay calculation which will use message's data from the previous round.

Signed-off-by: Delio Brignoli <***@audioscience.com>
---
port.c | 10 ++++++++++
1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/port.c b/port.c
index d7a86cc..3b3930f 100644
--- a/port.c
+++ b/port.c
@@ -780,6 +780,16 @@ static int port_delay_request(struct port *p)
struct ptp_message *msg;
int cnt, pdulen;

+ /* Time to send a new request, forget current pdelay resp and fup */
+ if (p->peer_delay_resp) {
+ msg_put(p->peer_delay_resp);
+ p->peer_delay_resp = NULL;
+ }
+ if (p->peer_delay_fup) {
+ msg_put(p->peer_delay_fup);
+ p->peer_delay_fup = NULL;
+ }
+
if (p->delayMechanism == DM_P2P)
return port_pdelay_request(p);

[Richard Cochran]

Post by Delio Brignoli
If messages are not freed, it is possible (with purposely crafted traffic) to trigger
a peer delay calculation which will use message's data from the previous round.

Applied.

Thanks,
Richard