[PATCH net v3] ptp: Add a upper bound on max_vclocks

[PATCH net v3] ptp: Add a upper bound on max_vclocks

[I Viswanath]

syzbot reported WARNING in max_vclocks_store.

This occurs when the argument max is too large for kcalloc to handle.

Extend the guard to guard against values that are too large for
kcalloc

Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
---
This can be reproduced by executing: 

echo x > /sys/devices/virtual/ptp/ptp0/max_vclocks

where x > KMALLOC_MAX_SIZE/(sizeof(int)) which computes to 1048576 on
my system

What would be a reasonable value for PTP_MAX_VCLOCKS_LIMIT?

KMALLOC_MAX_SIZE/(sizeof(int)) is the absolute max value for which the 
memory allocation won't fail

v1:
Link: https://lore.kernel.org/linux-mm/20250922170357.148588-1-viswanathiyyappan@gmail.com/

v2:
- Moved the validation to max_vclocks_store
Link: https://lore.kernel.org/netdev/20250923160622.8096-1-viswanathiyyappan@gmail.com/

v3:
- Removed RFC tag from the patch

 drivers/ptp/ptp_private.h | 1 +
 drivers/ptp/ptp_sysfs.c   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
index b352df4cd3f9..f329263f33aa 100644
--- a/drivers/ptp/ptp_private.h
+++ b/drivers/ptp/ptp_private.h
@@ -22,6 +22,7 @@
 #define PTP_MAX_TIMESTAMPS 128
 #define PTP_BUF_TIMESTAMPS 30
 #define PTP_DEFAULT_MAX_VCLOCKS 20
+#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))
 #define PTP_MAX_CHANNELS 2048
 
 enum {
diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
index 6b1b8f57cd95..200eaf500696 100644
--- a/drivers/ptp/ptp_sysfs.c
+++ b/drivers/ptp/ptp_sysfs.c
@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev,
 	size_t size;
 	u32 max;
 
-	if (kstrtou32(buf, 0, &max) || max == 0)
+	if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)
 		return -EINVAL;
 
 	if (max == ptp->max_vclocks)
-- 
2.47.3

Re: [PATCH net v3] ptp: Add a upper bound on max_vclocks

[Richard Cochran]

On Thu, Sep 25, 2025 at 09:29:08PM +0530, I Viswanath wrote:
> syzbot reported WARNING in max_vclocks_store.
> 
> This occurs when the argument max is too large for kcalloc to handle.
> 
> Extend the guard to guard against values that are too large for
> kcalloc
> 
> Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
> Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
> Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
> Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>

Acked-by: Richard Cochran <richardcochran@gmail.com>

Re: [PATCH net v3] ptp: Add a upper bound on max_vclocks

[Jakub Kicinski]

On Thu, 25 Sep 2025 21:29:08 +0530 I Viswanath wrote:
> This can be reproduced by executing: 
> 
> echo x > /sys/devices/virtual/ptp/ptp0/max_vclocks
> 
> where x > KMALLOC_MAX_SIZE/(sizeof(int)) which computes to 1048576 on
> my system
> 
> What would be a reasonable value for PTP_MAX_VCLOCKS_LIMIT?

I wonder about that, too. Perhaps tying uAPI behavior to
KMALLOC_MAX_SIZE is going to come back to bite us. But I don't
have a great idea for what the max should be.

> KMALLOC_MAX_SIZE/(sizeof(int)) is the absolute max value for which the 
> memory allocation won't fail

Re: [PATCH net v3] ptp: Add a upper bound on max_vclocks

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 25 Sep 2025 21:29:08 +0530 you wrote:
> syzbot reported WARNING in max_vclocks_store.
> 
> This occurs when the argument max is too large for kcalloc to handle.
> 
> Extend the guard to guard against values that are too large for
> kcalloc
> 
> [...]

Here is the summary with links:
  - [net,v3] ptp: Add a upper bound on max_vclocks
    https://git.kernel.org/netdev/net/c/e9f35294e18d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html