netdev - Re: [PATCH net-next] net: ethernet: xscale: Check for PTP support properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <42614b10-549b-4cb2-a226-b9db30ff26c0@linux.dev>
Date: Fri, 16 Jan 2026 16:59:46 +0000
From: Vadim Fedorenko <vadim.fedorenko@...ux.dev>
To: Vladimir Oltean <vladimir.oltean@....com>,
 Linus Walleij <linusw@...nel.org>
Cc: Andrew Lunn <andrew+netdev@...n.ch>, "David S. Miller"
 <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Richard Cochran <richardcochran@...il.com>, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] net: ethernet: xscale: Check for PTP support
 properly

On 16/01/2026 14:37, Vladimir Oltean wrote:
> On Fri, Jan 16, 2026 at 03:27:29PM +0100, Linus Walleij wrote:
>> In ixp4xx_get_ts_info() ixp46x_ptp_find() is called
>> unconditionally despite this feature only existing on
>> ixp46x, leading to the following splat from tcpdump:
>>
>> root@...nWrt:~# tcpdump -vv -X -i eth0
>> (...)
>> Unable to handle kernel NULL pointer dereference at virtual address
>>    00000238 when read
>> (...)
>> Call trace:
>>   ptp_clock_index from ixp46x_ptp_find+0x1c/0x38
>>   ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64
>>   ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108
>>   __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648
>>   __dev_ethtool from dev_ethtool+0x160/0x234
>>   dev_ethtool from dev_ioctl+0x2cc/0x460
>>   dev_ioctl from sock_ioctl+0x1ec/0x524
>>   sock_ioctl from sys_ioctl+0x51c/0xa94
>>   sys_ioctl from ret_fast_syscall+0x0/0x44
>>   (...)
>> Segmentation fault
>>
>> Check for ixp46x support before calling PTP.
>>
>> Fixes: c14e1ecefd9e ("net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()")
> 
> I fail to see how this commit affected the ethtool_get_ts_info() code
> path, and how the problem wasn't already there.
> 
> What do you think about commit 9055a2f59162 ("ixp4xx_eth: make ptp
> support a platform driver")? Before it, ixp4xx_get_ts_info() had a
> cpu_is_ixp46x() test. Now it lacks it, and it relies on ixp46x_ptp_find()
> to not crash when the platform device driver for the PTP clock didn't
> probe (something which obviously doesn't happen currently).

I agree, 9055a2f59162 ("ixp4xx_eth: make ptp support a platform driver")
did introduce the regression while NDO hwtstamp conversion didn't touch
capabilities code.

And the fix should be applied to ixp46x_ptp_find() as it's obviously
wrong.

> 
>> Signed-off-by: Linus Walleij <linusw@...nel.org>
>> ---
>>   drivers/net/ethernet/xscale/ixp4xx_eth.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
>> index e1e7f65553e7..fa3a7694087a 100644
>> --- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
>> +++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
>> @@ -1014,7 +1014,7 @@ static int ixp4xx_get_ts_info(struct net_device *dev,
>>   {
>>   	struct port *port = netdev_priv(dev);
>>   
>> -	if (port->phc_index < 0)
>> +	if (cpu_is_ixp46x() && (port->phc_index < 0))
>>   		ixp46x_ptp_find(&port->timesync_regs, &port->phc_index);
>>   
>>   	info->phc_index = port->phc_index;
>>
>> ---
>> base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
>> change-id: 20260116-ixp4xx-fix-ethernet-4fa36d900ccc
>>
>> Best regards,
>> -- 
>> Linus Walleij <linusw@...nel.org>
>>