* [PATCH net 0/2] gve: Bug fixes for header-split and PTP
@ 2026-08-07 22:43 Harshitha Ramamurthy
2026-08-07 22:43 ` [PATCH net 1/2] gve: fix zero-length skb frag with header-split Harshitha Ramamurthy
2026-08-07 22:43 ` [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine Harshitha Ramamurthy
0 siblings, 2 replies; 6+ messages in thread
From: Harshitha Ramamurthy @ 2026-08-07 22:43 UTC (permalink / raw)
To: netdev
Cc: joshwash, hramamurthy, andrew+netdev, davem, edumazet, kuba,
pabeni, richardcochran, thostet, jordanrhee, ziweixiao, willemb,
nktgrg, pkaligineedi, linux-kernel, stable
This series contains 2 bug fixes for gve.
Patch 1 fixes an issue which causes TX timeouts due to HW detection of
an illegal descriptor. This happens when receiving header-only packets
with header split enabled - this produces an SKB with a zero-length
fragment.
Patch 2 prevents a kernel NULL pointer dereference by stubbing the PTP
adjfine callback.
Jordan Rhee (2):
gve: fix zero-length skb frag with header-split
gve: fix NULL dereference due to missing ptp adjfine
drivers/net/ethernet/google/gve/gve_ptp.c | 6 ++++++
drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 +++++
2 files changed, 11 insertions(+)
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net 1/2] gve: fix zero-length skb frag with header-split
2026-08-07 22:43 [PATCH net 0/2] gve: Bug fixes for header-split and PTP Harshitha Ramamurthy
@ 2026-08-07 22:43 ` Harshitha Ramamurthy
2026-08-07 22:43 ` [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine Harshitha Ramamurthy
1 sibling, 0 replies; 6+ messages in thread
From: Harshitha Ramamurthy @ 2026-08-07 22:43 UTC (permalink / raw)
To: netdev
Cc: joshwash, hramamurthy, andrew+netdev, davem, edumazet, kuba,
pabeni, richardcochran, thostet, jordanrhee, ziweixiao, willemb,
nktgrg, pkaligineedi, linux-kernel, stable
From: Jordan Rhee <jordanrhee@google.com>
When header split is enabled and a header-only packet is
received such as a pure TCP ACK, GVE will indicate an
RX SKB with a zero-length fragment. If this SKB is then
hairpinned and sent back out, the GVE TX path will emit
a zero-length descriptor. Hardware considers this
an illegal descriptor and stops the queue, causing a
TX timeout and interface reset.
Fix it by not adding the zero-length skb frag.
Cc: stable@vger.kernel.org
Fixes: 5e37d8254e7f ("gve: Add header split data path")
Suggested-by: Praveen Kaligineedi <pkaligineedi@google.com>
Co-developed-by: Ziwei Xiao <ziweixiao@google.com>
Signed-off-by: Ziwei Xiao <ziweixiao@google.com>
Signed-off-by: Jordan Rhee <jordanrhee@google.com>
Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
---
drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
index 8271f731a91f..0ece2f6fdffb 100644
--- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
@@ -886,6 +886,11 @@ static int gve_rx_dqo(struct napi_struct *napi, struct gve_rx_ring *rx,
rx->rx_hsplit_unsplit_pkt += unsplit;
rx->rx_hsplit_bytes += hdr_len;
u64_stats_update_end(&rx->statss);
+
+ if (!buf_len) {
+ gve_free_buffer(rx, buf_state);
+ return 0;
+ }
} else if (!rx->ctx.skb_head && rx->dqo.page_pool &&
netmem_is_net_iov(buf_state->page_info.netmem)) {
/* when header split is disabled, the header went to the packet
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine
2026-08-07 22:43 [PATCH net 0/2] gve: Bug fixes for header-split and PTP Harshitha Ramamurthy
2026-08-07 22:43 ` [PATCH net 1/2] gve: fix zero-length skb frag with header-split Harshitha Ramamurthy
@ 2026-08-07 22:43 ` Harshitha Ramamurthy
2026-08-08 15:26 ` Vadim Fedorenko
1 sibling, 1 reply; 6+ messages in thread
From: Harshitha Ramamurthy @ 2026-08-07 22:43 UTC (permalink / raw)
To: netdev
Cc: joshwash, hramamurthy, andrew+netdev, davem, edumazet, kuba,
pabeni, richardcochran, thostet, jordanrhee, ziweixiao, willemb,
nktgrg, pkaligineedi, linux-kernel, stable
From: Jordan Rhee <jordanrhee@google.com>
Fix NULL dereference due to missing implementation of adjfine, which can
be triggered from usermode as follows:
sudo ./testptp -d /dev/ptp0 -f 0
[ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
[ 552.061946] Call Trace:
[ 552.064487] <TASK>
[ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0
[ 552.070874] ? get_clock_desc+0x6b/0xb0
[ 552.074825] pc_clock_adjtime+0x78/0xc0
[ 552.078755] __do_sys_clock_adjtime+0x85/0x110
[ 552.083293] do_syscall_64+0xea/0x610
Cc: stable@vger.kernel.org
Fixes: acd16380523b ("gve: Add initial PTP device support")
Signed-off-by: Jordan Rhee <jordanrhee@google.com>
Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
---
drivers/net/ethernet/google/gve/gve_ptp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/ethernet/google/gve/gve_ptp.c b/drivers/net/ethernet/google/gve/gve_ptp.c
index 06b1cf4a5efc..1d6c59f4ead3 100644
--- a/drivers/net/ethernet/google/gve/gve_ptp.c
+++ b/drivers/net/ethernet/google/gve/gve_ptp.c
@@ -26,6 +26,11 @@ int gve_clock_nic_ts_read(struct gve_priv *priv)
return 0;
}
+static int gve_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
+{
+ return -EOPNOTSUPP;
+}
+
static int gve_ptp_gettimex64(struct ptp_clock_info *info,
struct timespec64 *ts,
struct ptp_system_timestamp *sts)
@@ -60,6 +65,7 @@ static long gve_ptp_do_aux_work(struct ptp_clock_info *info)
static const struct ptp_clock_info gve_ptp_caps = {
.owner = THIS_MODULE,
.name = "gve clock",
+ .adjfine = gve_ptp_adjfine,
.gettimex64 = gve_ptp_gettimex64,
.settime64 = gve_ptp_settime64,
.do_aux_work = gve_ptp_do_aux_work,
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine
2026-08-07 22:43 ` [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine Harshitha Ramamurthy
@ 2026-08-08 15:26 ` Vadim Fedorenko
2026-08-10 15:55 ` Jordan Rhee
0 siblings, 1 reply; 6+ messages in thread
From: Vadim Fedorenko @ 2026-08-08 15:26 UTC (permalink / raw)
To: Harshitha Ramamurthy, netdev
Cc: joshwash, andrew+netdev, davem, edumazet, kuba, pabeni,
richardcochran, thostet, jordanrhee, ziweixiao, willemb, nktgrg,
pkaligineedi, linux-kernel, stable
On 07/08/2026 23:43, Harshitha Ramamurthy wrote:
> From: Jordan Rhee <jordanrhee@google.com>
>
> Fix NULL dereference due to missing implementation of adjfine, which can
> be triggered from usermode as follows:
>
> sudo ./testptp -d /dev/ptp0 -f 0
> [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> [ 552.061946] Call Trace:
> [ 552.064487] <TASK>
> [ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0
> [ 552.070874] ? get_clock_desc+0x6b/0xb0
> [ 552.074825] pc_clock_adjtime+0x78/0xc0
> [ 552.078755] __do_sys_clock_adjtime+0x85/0x110
> [ 552.083293] do_syscall_64+0xea/0x610
>
> Cc: stable@vger.kernel.org
> Fixes: acd16380523b ("gve: Add initial PTP device support")
> Signed-off-by: Jordan Rhee <jordanrhee@google.com>
> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
> ---
> drivers/net/ethernet/google/gve/gve_ptp.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/google/gve/gve_ptp.c b/drivers/net/ethernet/google/gve/gve_ptp.c
> index 06b1cf4a5efc..1d6c59f4ead3 100644
> --- a/drivers/net/ethernet/google/gve/gve_ptp.c
> +++ b/drivers/net/ethernet/google/gve/gve_ptp.c
> @@ -26,6 +26,11 @@ int gve_clock_nic_ts_read(struct gve_priv *priv)
> return 0;
> }
>
> +static int gve_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
> +{
> + return -EOPNOTSUPP;
> +}
> +
> static int gve_ptp_gettimex64(struct ptp_clock_info *info,
> struct timespec64 *ts,
> struct ptp_system_timestamp *sts)
> @@ -60,6 +65,7 @@ static long gve_ptp_do_aux_work(struct ptp_clock_info *info)
> static const struct ptp_clock_info gve_ptp_caps = {
> .owner = THIS_MODULE,
> .name = "gve clock",
> + .adjfine = gve_ptp_adjfine,
> .gettimex64 = gve_ptp_gettimex64,
> .settime64 = gve_ptp_settime64,
> .do_aux_work = gve_ptp_do_aux_work,
.adjtime has to be implemented as well - neither adjfine nor adjtime are
checked within ptp_clock_adjtime()
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine
2026-08-08 15:26 ` Vadim Fedorenko
@ 2026-08-10 15:55 ` Jordan Rhee
2026-08-10 16:15 ` Vadim Fedorenko
0 siblings, 1 reply; 6+ messages in thread
From: Jordan Rhee @ 2026-08-10 15:55 UTC (permalink / raw)
To: Vadim Fedorenko
Cc: Harshitha Ramamurthy, netdev, joshwash, andrew+netdev, davem,
edumazet, kuba, pabeni, richardcochran, thostet, ziweixiao,
willemb, nktgrg, pkaligineedi, linux-kernel, stable
On Sat, Aug 8, 2026 at 8:27 AM Vadim Fedorenko
<vadim.fedorenko@linux.dev> wrote:
>
> On 07/08/2026 23:43, Harshitha Ramamurthy wrote:
> > From: Jordan Rhee <jordanrhee@google.com>
> >
> > Fix NULL dereference due to missing implementation of adjfine, which can
> > be triggered from usermode as follows:
> >
> > sudo ./testptp -d /dev/ptp0 -f 0
> > [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000
> > [...]
> > [ 552.061946] Call Trace:
> > [ 552.064487] <TASK>
> > [ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0
> > [ 552.070874] ? get_clock_desc+0x6b/0xb0
> > [ 552.074825] pc_clock_adjtime+0x78/0xc0
> > [ 552.078755] __do_sys_clock_adjtime+0x85/0x110
> > [ 552.083293] do_syscall_64+0xea/0x610
> >
> > Cc: stable@vger.kernel.org
> > Fixes: acd16380523b ("gve: Add initial PTP device support")
> > Signed-off-by: Jordan Rhee <jordanrhee@google.com>
> > Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
> > ---
> > drivers/net/ethernet/google/gve/gve_ptp.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/drivers/net/ethernet/google/gve/gve_ptp.c b/drivers/net/ethernet/google/gve/gve_ptp.c
> > index 06b1cf4a5efc..1d6c59f4ead3 100644
> > --- a/drivers/net/ethernet/google/gve/gve_ptp.c
> > +++ b/drivers/net/ethernet/google/gve/gve_ptp.c
> > @@ -26,6 +26,11 @@ int gve_clock_nic_ts_read(struct gve_priv *priv)
> > return 0;
> > }
> >
> > +static int gve_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
> > +{
> > + return -EOPNOTSUPP;
> > +}
> > +
> > static int gve_ptp_gettimex64(struct ptp_clock_info *info,
> > struct timespec64 *ts,
> > struct ptp_system_timestamp *sts)
> > @@ -60,6 +65,7 @@ static long gve_ptp_do_aux_work(struct ptp_clock_info *info)
> > static const struct ptp_clock_info gve_ptp_caps = {
> > .owner = THIS_MODULE,
> > .name = "gve clock",
> > + .adjfine = gve_ptp_adjfine,
> > .gettimex64 = gve_ptp_gettimex64,
> > .settime64 = gve_ptp_settime64,
> > .do_aux_work = gve_ptp_do_aux_work,
>
> .adjtime has to be implemented as well - neither adjfine nor adjtime are
> checked within ptp_clock_adjtime()
adjtime() can only be reached if gettimex64() succeeds. Since GVE
currently returns -EOPNOTSUPP in gettimex64(), ptp_clock_adjtime()
will short circuit before calling the driver's adjtime callback. We
will need to provide a stub for adjtime() when we implement
gettimex64().
My understanding is that fixes should only address real, reproducible
issues which is why we only sent adjfine in this patch. If the
maintainers would prefer we send adjtime() as well, just let us know.
That said, our preference would be not to delay the other patch in
this series ("gve: fix zero-length skb frag with header-split").
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine
2026-08-10 15:55 ` Jordan Rhee
@ 2026-08-10 16:15 ` Vadim Fedorenko
0 siblings, 0 replies; 6+ messages in thread
From: Vadim Fedorenko @ 2026-08-10 16:15 UTC (permalink / raw)
To: Jordan Rhee
Cc: Harshitha Ramamurthy, netdev, joshwash, andrew+netdev, davem,
edumazet, kuba, pabeni, richardcochran, thostet, ziweixiao,
willemb, nktgrg, pkaligineedi, linux-kernel, stable
On 10/08/2026 16:55, Jordan Rhee wrote:
> On Sat, Aug 8, 2026 at 8:27 AM Vadim Fedorenko
> <vadim.fedorenko@linux.dev> wrote:
>>
>> On 07/08/2026 23:43, Harshitha Ramamurthy wrote:
>>> From: Jordan Rhee <jordanrhee@google.com>
>>>
>>> Fix NULL dereference due to missing implementation of adjfine, which can
>>> be triggered from usermode as follows:
>>>
>>> sudo ./testptp -d /dev/ptp0 -f 0
>>> [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000000
>>> [...]
>>> [ 552.061946] Call Trace:
>>> [ 552.064487] <TASK>
>>> [ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0
>>> [ 552.070874] ? get_clock_desc+0x6b/0xb0
>>> [ 552.074825] pc_clock_adjtime+0x78/0xc0
>>> [ 552.078755] __do_sys_clock_adjtime+0x85/0x110
>>> [ 552.083293] do_syscall_64+0xea/0x610
>>>
>>> Cc: stable@vger.kernel.org
>>> Fixes: acd16380523b ("gve: Add initial PTP device support")
>>> Signed-off-by: Jordan Rhee <jordanrhee@google.com>
>>> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
>>> ---
>>> drivers/net/ethernet/google/gve/gve_ptp.c | 6 ++++++
>>> 1 file changed, 6 insertions(+)
>>>
>>> diff --git a/drivers/net/ethernet/google/gve/gve_ptp.c b/drivers/net/ethernet/google/gve/gve_ptp.c
>>> index 06b1cf4a5efc..1d6c59f4ead3 100644
>>> --- a/drivers/net/ethernet/google/gve/gve_ptp.c
>>> +++ b/drivers/net/ethernet/google/gve/gve_ptp.c
>>> @@ -26,6 +26,11 @@ int gve_clock_nic_ts_read(struct gve_priv *priv)
>>> return 0;
>>> }
>>>
>>> +static int gve_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
>>> +{
>>> + return -EOPNOTSUPP;
>>> +}
>>> +
>>> static int gve_ptp_gettimex64(struct ptp_clock_info *info,
>>> struct timespec64 *ts,
>>> struct ptp_system_timestamp *sts)
>>> @@ -60,6 +65,7 @@ static long gve_ptp_do_aux_work(struct ptp_clock_info *info)
>>> static const struct ptp_clock_info gve_ptp_caps = {
>>> .owner = THIS_MODULE,
>>> .name = "gve clock",
>>> + .adjfine = gve_ptp_adjfine,
>>> .gettimex64 = gve_ptp_gettimex64,
>>> .settime64 = gve_ptp_settime64,
>>> .do_aux_work = gve_ptp_do_aux_work,
>>
>> .adjtime has to be implemented as well - neither adjfine nor adjtime are
>> checked within ptp_clock_adjtime()
>
> adjtime() can only be reached if gettimex64() succeeds. Since GVE
> currently returns -EOPNOTSUPP in gettimex64(), ptp_clock_adjtime()
> will short circuit before calling the driver's adjtime callback. We
> will need to provide a stub for adjtime() when we implement
> gettimex64().
>
> My understanding is that fixes should only address real, reproducible
> issues which is why we only sent adjfine in this patch. If the
> maintainers would prefer we send adjtime() as well, just let us know.
> That said, our preference would be not to delay the other patch in
> this series ("gve: fix zero-length skb frag with header-split").
ah, yeah, I see that gve_ptp_gettimex64 is -EOPNOTSUPP.
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-10 16:15 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-07 22:43 [PATCH net 0/2] gve: Bug fixes for header-split and PTP Harshitha Ramamurthy
2026-08-07 22:43 ` [PATCH net 1/2] gve: fix zero-length skb frag with header-split Harshitha Ramamurthy
2026-08-07 22:43 ` [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine Harshitha Ramamurthy
2026-08-08 15:26 ` Vadim Fedorenko
2026-08-10 15:55 ` Jordan Rhee
2026-08-10 16:15 ` Vadim Fedorenko
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.