[PATCH net 0/2] gve: Fix NULL dereferencing with PTP clock

[PATCH net 0/2] gve: Fix NULL dereferencing with PTP clock

[Joshua Washington]

From: Tim Hostetler <thostet@google.com>

This patch series fixes NULL dereferences that are possible with gve's
PTP clock due to not stubbing certain ptp_clock_info callbacks.

Tim Hostetler (2):
  gve: Implement gettimex64 with -EOPNOTSUPP
  gve: Implement settime64 with -EOPNOTSUPP

 drivers/net/ethernet/google/gve/gve_ptp.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

-- 
2.51.2.997.g839fc31de9-goog

[PATCH net 1/2] gve: Implement gettimex64 with -EOPNOTSUPP

[Joshua Washington]

From: Tim Hostetler <thostet@google.com>

gve implemented a ptp_clock for sole use of do_aux_work at this time.
ptp_clock_gettime() and ptp_sys_offset() assume every ptp_clock has
implemented either gettimex64 or gettime64. Stub gettimex64 and return
-EOPNOTSUPP to prevent NULL dereferencing.

Fixes: acd16380523b ("gve: Add initial PTP device support")
Reported-by: syzbot+c8c0e7ccabd456541612@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c8c0e7ccabd456541612
Signed-off-by: Tim Hostetler <thostet@google.com>
Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Joshua Washington <joshwash@google.com>
---
 drivers/net/ethernet/google/gve/gve_ptp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/google/gve/gve_ptp.c b/drivers/net/ethernet/google/gve/gve_ptp.c
index e96247c9d68d..19ae699d4b18 100644
--- a/drivers/net/ethernet/google/gve/gve_ptp.c
+++ b/drivers/net/ethernet/google/gve/gve_ptp.c
@@ -26,6 +26,13 @@ int gve_clock_nic_ts_read(struct gve_priv *priv)
 	return 0;
 }
 
+static int gve_ptp_gettimex64(struct ptp_clock_info *info,
+			      struct timespec64 *ts,
+			      struct ptp_system_timestamp *sts)
+{
+	return -EOPNOTSUPP;
+}
+
 static long gve_ptp_do_aux_work(struct ptp_clock_info *info)
 {
 	const struct gve_ptp *ptp = container_of(info, struct gve_ptp, info);
@@ -47,6 +54,7 @@ static long gve_ptp_do_aux_work(struct ptp_clock_info *info)
 static const struct ptp_clock_info gve_ptp_caps = {
 	.owner          = THIS_MODULE,
 	.name		= "gve clock",
+	.gettimex64	= gve_ptp_gettimex64,
 	.do_aux_work	= gve_ptp_do_aux_work,
 };
 
-- 
2.51.2.997.g839fc31de9-goog

[PATCH net 2/2] gve: Implement settime64 with -EOPNOTSUPP

[Joshua Washington]

From: Tim Hostetler <thostet@google.com>

ptp_clock_settime() assumes every ptp_clock has implemented settime64().
Stub it with -EOPNOTSUPP to prevent a NULL dereference.

Fixes: acd16380523b ("gve: Add initial PTP device support")
Reported-by: syzbot+a546141ca6d53b90aba3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a546141ca6d53b90aba3
Signed-off-by: Tim Hostetler <thostet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Joshua Washington <joshwash@google.com>
---
 drivers/net/ethernet/google/gve/gve_ptp.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/google/gve/gve_ptp.c b/drivers/net/ethernet/google/gve/gve_ptp.c
index 19ae699d4b18..a384a9ed4914 100644
--- a/drivers/net/ethernet/google/gve/gve_ptp.c
+++ b/drivers/net/ethernet/google/gve/gve_ptp.c
@@ -33,6 +33,12 @@ static int gve_ptp_gettimex64(struct ptp_clock_info *info,
 	return -EOPNOTSUPP;
 }
 
+static int gve_ptp_settime64(struct ptp_clock_info *info,
+			     const struct timespec64 *ts)
+{
+	return -EOPNOTSUPP;
+}
+
 static long gve_ptp_do_aux_work(struct ptp_clock_info *info)
 {
 	const struct gve_ptp *ptp = container_of(info, struct gve_ptp, info);
@@ -55,6 +61,7 @@ static const struct ptp_clock_info gve_ptp_caps = {
 	.owner          = THIS_MODULE,
 	.name		= "gve clock",
 	.gettimex64	= gve_ptp_gettimex64,
+	.settime64	= gve_ptp_settime64,
 	.do_aux_work	= gve_ptp_do_aux_work,
 };
 
-- 
2.51.2.997.g839fc31de9-goog

Re: [PATCH net 0/2] gve: Fix NULL dereferencing with PTP clock

[Simon Horman]

On Wed, Oct 29, 2025 at 11:45:38AM -0700, Joshua Washington wrote:
> From: Tim Hostetler <thostet@google.com>
> 
> This patch series fixes NULL dereferences that are possible with gve's
> PTP clock due to not stubbing certain ptp_clock_info callbacks.
> 
> Tim Hostetler (2):
>   gve: Implement gettimex64 with -EOPNOTSUPP
>   gve: Implement settime64 with -EOPNOTSUPP
> 
>  drivers/net/ethernet/google/gve/gve_ptp.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)

Hi Joshua and Tim,

I think that the approach of enhancing the caller to only
call these callbacks if they are non NULL, as per the patch below,
seems more robust. It would fix all drivers in one go.

- [PATCH] ptp: guard ptp_clock_gettime() if neither gettimex64 nor
  https://lore.kernel.org/all/20251028095143.396385-1-junjie.cao@intel.com/

Re: [PATCH net 0/2] gve: Fix NULL dereferencing with PTP clock

[Simon Horman]

On Thu, Oct 30, 2025 at 09:43:57AM +0000, Simon Horman wrote:
> On Wed, Oct 29, 2025 at 11:45:38AM -0700, Joshua Washington wrote:
> > From: Tim Hostetler <thostet@google.com>
> > 
> > This patch series fixes NULL dereferences that are possible with gve's
> > PTP clock due to not stubbing certain ptp_clock_info callbacks.
> > 
> > Tim Hostetler (2):
> >   gve: Implement gettimex64 with -EOPNOTSUPP
> >   gve: Implement settime64 with -EOPNOTSUPP
> > 
> >  drivers/net/ethernet/google/gve/gve_ptp.c | 15 +++++++++++++++
> >  1 file changed, 15 insertions(+)
> 
> Hi Joshua and Tim,
> 
> I think that the approach of enhancing the caller to only
> call these callbacks if they are non NULL, as per the patch below,
> seems more robust. It would fix all drivers in one go.
> 
> - [PATCH] ptp: guard ptp_clock_gettime() if neither gettimex64 nor
>   https://lore.kernel.org/all/20251028095143.396385-1-junjie.cao@intel.com/

Oops, I see that I should have read to the end of that thread
where Tim joins the discussion.

It seems that this patchset is appropriate as it's expected
that drivers expect an implementation of a variant of these callbacks.

Re: [PATCH net 0/2] gve: Fix NULL dereferencing with PTP clock

[Tim Hostetler]

On Thu, Oct 30, 2025 at 2:48 AM Simon Horman <horms@kernel.org> wrote:
>
> On Thu, Oct 30, 2025 at 09:43:57AM +0000, Simon Horman wrote:
> > On Wed, Oct 29, 2025 at 11:45:38AM -0700, Joshua Washington wrote:
> > > From: Tim Hostetler <thostet@google.com>
> > >
> > > This patch series fixes NULL dereferences that are possible with gve's
> > > PTP clock due to not stubbing certain ptp_clock_info callbacks.
> > >
> > > Tim Hostetler (2):
> > >   gve: Implement gettimex64 with -EOPNOTSUPP
> > >   gve: Implement settime64 with -EOPNOTSUPP
> > >
> > >  drivers/net/ethernet/google/gve/gve_ptp.c | 15 +++++++++++++++
> > >  1 file changed, 15 insertions(+)
> >
> > Hi Joshua and Tim,
> >
> > I think that the approach of enhancing the caller to only
> > call these callbacks if they are non NULL, as per the patch below,
> > seems more robust. It would fix all drivers in one go.
> >
> > - [PATCH] ptp: guard ptp_clock_gettime() if neither gettimex64 nor
> >   https://lore.kernel.org/all/20251028095143.396385-1-junjie.cao@intel.com/
>
> Oops, I see that I should have read to the end of that thread
> where Tim joins the discussion.
>
> It seems that this patchset is appropriate as it's expected
> that drivers expect an implementation of a variant of these callbacks.

Right, one of the gettime64 variants and settime64 are required
(whereas the other function callbacks aren't required from my
inspection). I actually have a patch I'll be sending out pretty soon
that will prevent the registration of a ptp_clock that doesn't
implement the required callbacks to prevent a bug like this from
happening again.

Re: [PATCH net 0/2] gve: Fix NULL dereferencing with PTP clock

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 29 Oct 2025 11:45:38 -0700 you wrote:
> From: Tim Hostetler <thostet@google.com>
> 
> This patch series fixes NULL dereferences that are possible with gve's
> PTP clock due to not stubbing certain ptp_clock_info callbacks.
> 
> Tim Hostetler (2):
>   gve: Implement gettimex64 with -EOPNOTSUPP
>   gve: Implement settime64 with -EOPNOTSUPP
> 
> [...]

Here is the summary with links:
  - [net,1/2] gve: Implement gettimex64 with -EOPNOTSUPP
    https://git.kernel.org/netdev/net/c/6ab753b5d8e5
  - [net,2/2] gve: Implement settime64 with -EOPNOTSUPP
    https://git.kernel.org/netdev/net/c/329d050bbe63

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html