[PATCH net-next] net: ethernet: xscale: Check for PTP support properly

[PATCH net-next] net: ethernet: xscale: Check for PTP support properly

[Linus Walleij]

In ixp4xx_get_ts_info() ixp46x_ptp_find() is called
unconditionally despite this feature only existing on
ixp46x, leading to the following splat from tcpdump:

root@OpenWrt:~# tcpdump -vv -X -i eth0
(...)
Unable to handle kernel NULL pointer dereference at virtual address
  00000238 when read
(...)
Call trace:
 ptp_clock_index from ixp46x_ptp_find+0x1c/0x38
 ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64
 ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108
 __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648
 __dev_ethtool from dev_ethtool+0x160/0x234
 dev_ethtool from dev_ioctl+0x2cc/0x460
 dev_ioctl from sock_ioctl+0x1ec/0x524
 sock_ioctl from sys_ioctl+0x51c/0xa94
 sys_ioctl from ret_fast_syscall+0x0/0x44
 (...)
Segmentation fault

Check for ixp46x support before calling PTP.

Fixes: c14e1ecefd9e ("net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()")
Signed-off-by: Linus Walleij <linusw@kernel.org>
---
 drivers/net/ethernet/xscale/ixp4xx_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index e1e7f65553e7..fa3a7694087a 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -1014,7 +1014,7 @@ static int ixp4xx_get_ts_info(struct net_device *dev,
 {
 	struct port *port = netdev_priv(dev);
 
-	if (port->phc_index < 0)
+	if (cpu_is_ixp46x() && (port->phc_index < 0))
 		ixp46x_ptp_find(&port->timesync_regs, &port->phc_index);
 
 	info->phc_index = port->phc_index;

---
base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
change-id: 20260116-ixp4xx-fix-ethernet-4fa36d900ccc

Best regards,
-- 
Linus Walleij <linusw@kernel.org>

Re: [PATCH net-next] net: ethernet: xscale: Check for PTP support properly

[Vladimir Oltean]

On Fri, Jan 16, 2026 at 03:27:29PM +0100, Linus Walleij wrote:
> In ixp4xx_get_ts_info() ixp46x_ptp_find() is called
> unconditionally despite this feature only existing on
> ixp46x, leading to the following splat from tcpdump:
> 
> root@OpenWrt:~# tcpdump -vv -X -i eth0
> (...)
> Unable to handle kernel NULL pointer dereference at virtual address
>   00000238 when read
> (...)
> Call trace:
>  ptp_clock_index from ixp46x_ptp_find+0x1c/0x38
>  ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64
>  ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108
>  __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648
>  __dev_ethtool from dev_ethtool+0x160/0x234
>  dev_ethtool from dev_ioctl+0x2cc/0x460
>  dev_ioctl from sock_ioctl+0x1ec/0x524
>  sock_ioctl from sys_ioctl+0x51c/0xa94
>  sys_ioctl from ret_fast_syscall+0x0/0x44
>  (...)
> Segmentation fault
> 
> Check for ixp46x support before calling PTP.
> 
> Fixes: c14e1ecefd9e ("net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()")

I fail to see how this commit affected the ethtool_get_ts_info() code
path, and how the problem wasn't already there.

What do you think about commit 9055a2f59162 ("ixp4xx_eth: make ptp
support a platform driver")? Before it, ixp4xx_get_ts_info() had a
cpu_is_ixp46x() test. Now it lacks it, and it relies on ixp46x_ptp_find()
to not crash when the platform device driver for the PTP clock didn't
probe (something which obviously doesn't happen currently).

> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---
>  drivers/net/ethernet/xscale/ixp4xx_eth.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
> index e1e7f65553e7..fa3a7694087a 100644
> --- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
> +++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
> @@ -1014,7 +1014,7 @@ static int ixp4xx_get_ts_info(struct net_device *dev,
>  {
>  	struct port *port = netdev_priv(dev);
>  
> -	if (port->phc_index < 0)
> +	if (cpu_is_ixp46x() && (port->phc_index < 0))
>  		ixp46x_ptp_find(&port->timesync_regs, &port->phc_index);
>  
>  	info->phc_index = port->phc_index;
> 
> ---
> base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
> change-id: 20260116-ixp4xx-fix-ethernet-4fa36d900ccc
> 
> Best regards,
> -- 
> Linus Walleij <linusw@kernel.org>
>

Re: [PATCH net-next] net: ethernet: xscale: Check for PTP support properly

[Vadim Fedorenko]

On 16/01/2026 14:37, Vladimir Oltean wrote:
> On Fri, Jan 16, 2026 at 03:27:29PM +0100, Linus Walleij wrote:
>> In ixp4xx_get_ts_info() ixp46x_ptp_find() is called
>> unconditionally despite this feature only existing on
>> ixp46x, leading to the following splat from tcpdump:
>>
>> root@OpenWrt:~# tcpdump -vv -X -i eth0
>> (...)
>> Unable to handle kernel NULL pointer dereference at virtual address
>>    00000238 when read
>> (...)
>> Call trace:
>>   ptp_clock_index from ixp46x_ptp_find+0x1c/0x38
>>   ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64
>>   ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108
>>   __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648
>>   __dev_ethtool from dev_ethtool+0x160/0x234
>>   dev_ethtool from dev_ioctl+0x2cc/0x460
>>   dev_ioctl from sock_ioctl+0x1ec/0x524
>>   sock_ioctl from sys_ioctl+0x51c/0xa94
>>   sys_ioctl from ret_fast_syscall+0x0/0x44
>>   (...)
>> Segmentation fault
>>
>> Check for ixp46x support before calling PTP.
>>
>> Fixes: c14e1ecefd9e ("net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()")
> 
> I fail to see how this commit affected the ethtool_get_ts_info() code
> path, and how the problem wasn't already there.
> 
> What do you think about commit 9055a2f59162 ("ixp4xx_eth: make ptp
> support a platform driver")? Before it, ixp4xx_get_ts_info() had a
> cpu_is_ixp46x() test. Now it lacks it, and it relies on ixp46x_ptp_find()
> to not crash when the platform device driver for the PTP clock didn't
> probe (something which obviously doesn't happen currently).

I agree, 9055a2f59162 ("ixp4xx_eth: make ptp support a platform driver")
did introduce the regression while NDO hwtstamp conversion didn't touch
capabilities code.

And the fix should be applied to ixp46x_ptp_find() as it's obviously
wrong.

> 
>> Signed-off-by: Linus Walleij <linusw@kernel.org>
>> ---
>>   drivers/net/ethernet/xscale/ixp4xx_eth.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
>> index e1e7f65553e7..fa3a7694087a 100644
>> --- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
>> +++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
>> @@ -1014,7 +1014,7 @@ static int ixp4xx_get_ts_info(struct net_device *dev,
>>   {
>>   	struct port *port = netdev_priv(dev);
>>   
>> -	if (port->phc_index < 0)
>> +	if (cpu_is_ixp46x() && (port->phc_index < 0))
>>   		ixp46x_ptp_find(&port->timesync_regs, &port->phc_index);
>>   
>>   	info->phc_index = port->phc_index;
>>
>> ---
>> base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
>> change-id: 20260116-ixp4xx-fix-ethernet-4fa36d900ccc
>>
>> Best regards,
>> -- 
>> Linus Walleij <linusw@kernel.org>
>>