netdev - Re: [PATCH net-next] net: ethernet: xscale: Check for PTP support properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260116143754.6xfhqrlhgtsewifd@skbuf>
Date: Fri, 16 Jan 2026 16:37:54 +0200
From: Vladimir Oltean <vladimir.oltean@....com>
To: Linus Walleij <linusw@...nel.org>
Cc: Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Richard Cochran <richardcochran@...il.com>,
	Vadim Fedorenko <vadim.fedorenko@...ux.dev>, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] net: ethernet: xscale: Check for PTP support
 properly

On Fri, Jan 16, 2026 at 03:27:29PM +0100, Linus Walleij wrote:
> In ixp4xx_get_ts_info() ixp46x_ptp_find() is called
> unconditionally despite this feature only existing on
> ixp46x, leading to the following splat from tcpdump:
> 
> root@...nWrt:~# tcpdump -vv -X -i eth0
> (...)
> Unable to handle kernel NULL pointer dereference at virtual address
>   00000238 when read
> (...)
> Call trace:
>  ptp_clock_index from ixp46x_ptp_find+0x1c/0x38
>  ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64
>  ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108
>  __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648
>  __dev_ethtool from dev_ethtool+0x160/0x234
>  dev_ethtool from dev_ioctl+0x2cc/0x460
>  dev_ioctl from sock_ioctl+0x1ec/0x524
>  sock_ioctl from sys_ioctl+0x51c/0xa94
>  sys_ioctl from ret_fast_syscall+0x0/0x44
>  (...)
> Segmentation fault
> 
> Check for ixp46x support before calling PTP.
> 
> Fixes: c14e1ecefd9e ("net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()")

I fail to see how this commit affected the ethtool_get_ts_info() code
path, and how the problem wasn't already there.

What do you think about commit 9055a2f59162 ("ixp4xx_eth: make ptp
support a platform driver")? Before it, ixp4xx_get_ts_info() had a
cpu_is_ixp46x() test. Now it lacks it, and it relies on ixp46x_ptp_find()
to not crash when the platform device driver for the PTP clock didn't
probe (something which obviously doesn't happen currently).

> Signed-off-by: Linus Walleij <linusw@...nel.org>
> ---
>  drivers/net/ethernet/xscale/ixp4xx_eth.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
> index e1e7f65553e7..fa3a7694087a 100644
> --- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
> +++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
> @@ -1014,7 +1014,7 @@ static int ixp4xx_get_ts_info(struct net_device *dev,
>  {
>  	struct port *port = netdev_priv(dev);
>  
> -	if (port->phc_index < 0)
> +	if (cpu_is_ixp46x() && (port->phc_index < 0))
>  		ixp46x_ptp_find(&port->timesync_regs, &port->phc_index);
>  
>  	info->phc_index = port->phc_index;
> 
> ---
> base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
> change-id: 20260116-ixp4xx-fix-ethernet-4fa36d900ccc
> 
> Best regards,
> -- 
> Linus Walleij <linusw@...nel.org>
>