linux-kernel - ntp: Adjustment of time_maxerror with 500ppm instead of 15ppm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <fed2cedc-0458-4dfe-9e14-6d64be618165@kenogo.org>
Date: Wed, 7 May 2025 11:15:12 +0200
From: Keno Goertz <contact@...ogo.org>
To: linux-kernel@...r.kernel.org
Subject: ntp: Adjustment of time_maxerror with 500ppm instead of 15ppm

Hello,

I've been looking into the kernel's NTP code and found what I understand 
to be a deviation from NTP as standardized by RFC 5905.  The 
documentation of this part of the kernel is pretty sparse, so there may 
be some motivation behind this that I don't know of.  Perhaps someone 
with more knowledge can explain this.

The doc string of `struct ntp_data` states that `time_maxerror` holds 
the "NTP sync distance (NTP dispersion + delay / 2)".

ntpd indeed sets this value to what RFC 5905 calls the "root 
synchronization distance" LAMBDA.

In RFC 5905, this LAMBDA increases over time because the root dispersion 
increases at a rate of PHI, which is set to 15ppm.  Running

$ ntpq -c "rv 0 rootdisp"

a couple of times confirms that the root dispersion reported by ntpd 
increases with this rate.  Consequently, so does the root 
synchronization distance LAMBDA.

However, the function `ntp.c:second_overflow()` instead increases the 
value of `time_maxerror` with the rate MAXFREQ, which is set to 500ppm.

This leads to standard library functions like ntp_gettime() reporting 
much bigger values of `maxerror` than ntpd is working with.  This can be 
confirmed by running

$ adjtimex -p

a couple of times.

MAXFREQ *can* be found in the reference implementation of RFC 5905 and 
is also set to 500ppm there, but it is used in a different context: 
MAXFREQ is an upper bound for the local clock's frequency offset, while 
PHI is an upper bound for the frequency drift of a clock synchronized 
with NTP.

At least this is my understanding.  Can someone explain this?

Best regards
Keno