* [PATCH] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() [not found] <20251029110651.25c4936d@kmaincent-XPS-13-7390> @ 2025-10-30 9:36 ` Jiaming Zhang 2025-10-30 9:40 ` kernel test robot 2025-10-30 10:14 ` Kory Maincent 0 siblings, 2 replies; 5+ messages in thread From: Jiaming Zhang @ 2025-10-30 9:36 UTC (permalink / raw) To: kory.maincent Cc: davem, edumazet, horms, kuba, kuniyu, linux-kernel, netdev, pabeni, r772577952, sdf, syzkaller, vladimir.oltean, stable The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as: tsconfig_prepare_data() -> dev_get_hwtstamp_phylib() -> vlan_hwtstamp_get() -> generic_hwtstamp_get_lower() -> generic_hwtstamp_ioctl_lower() results in generic_hwtstamp_ioctl_lower() being called with kernel_cfg->ifr as NULL. The generic_hwtstamp_ioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash. Fix this by adding a NULL check for kernel_cfg->ifr in generic_hwtstamp_get/set_lower(). If ifr is NULL, return -EOPNOTSUPP to prevent the call to the legacy IOCTL helper. Fixes: 6e9e2eed4f39 ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Closes: https://lore.kernel.org/lkml/cd6a7056-fa6d-43f8-b78a-f5e811247ba8@linux.dev/T/#mf5df538e21753e3045de98f25aa18d948be07df3 Signed-off-by: Jiaming Zhang <r772577952@gmail.com> --- net/core/dev_ioctl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c index ad54b12d4b4c..39eaf6ba981a 100644 --- a/net/core/dev_ioctl.c +++ b/net/core/dev_ioctl.c @@ -474,6 +474,10 @@ int generic_hwtstamp_get_lower(struct net_device *dev, return err; } + /* Netlink path with unconverted driver */ + if (!kernel_cfg->ifr) + return -EOPNOTSUPP; + /* Legacy path: unconverted lower driver */ return generic_hwtstamp_ioctl_lower(dev, SIOCGHWTSTAMP, kernel_cfg); } @@ -498,6 +502,10 @@ int generic_hwtstamp_set_lower(struct net_device *dev, return err; } + /* Netlink path with unconverted driver */ + if (!kernel_cfg->ifr) + return -EOPNOTSUPP; + /* Legacy path: unconverted lower driver */ return generic_hwtstamp_ioctl_lower(dev, SIOCSHWTSTAMP, kernel_cfg); } -- 2.34.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() 2025-10-30 9:36 ` [PATCH] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() Jiaming Zhang @ 2025-10-30 9:40 ` kernel test robot 2025-10-30 10:14 ` Kory Maincent 1 sibling, 0 replies; 5+ messages in thread From: kernel test robot @ 2025-10-30 9:40 UTC (permalink / raw) To: Jiaming Zhang; +Cc: stable, oe-kbuild-all Hi, Thanks for your patch. FYI: kernel test robot notices the stable kernel rule is not satisfied. The check is based on https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#option-1 Rule: add the tag "Cc: stable@vger.kernel.org" in the sign-off area to have the patch automatically included in the stable tree. Subject: [PATCH] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() Link: https://lore.kernel.org/stable/20251030093621.3563440-1-r772577952%40gmail.com -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() 2025-10-30 9:36 ` [PATCH] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() Jiaming Zhang 2025-10-30 9:40 ` kernel test robot @ 2025-10-30 10:14 ` Kory Maincent 2025-10-30 10:49 ` [PATCH v2] " Jiaming Zhang 1 sibling, 1 reply; 5+ messages in thread From: Kory Maincent @ 2025-10-30 10:14 UTC (permalink / raw) To: Jiaming Zhang Cc: davem, edumazet, horms, kuba, kuniyu, linux-kernel, netdev, pabeni, sdf, syzkaller, vladimir.oltean, stable On Thu, 30 Oct 2025 09:36:21 +0000 Jiaming Zhang <r772577952@gmail.com> wrote: > The ethtool tsconfig Netlink path can trigger a null pointer > dereference. A call chain such as: > > tsconfig_prepare_data() -> > dev_get_hwtstamp_phylib() -> > vlan_hwtstamp_get() -> > generic_hwtstamp_get_lower() -> > generic_hwtstamp_ioctl_lower() > > results in generic_hwtstamp_ioctl_lower() being called with > kernel_cfg->ifr as NULL. > > The generic_hwtstamp_ioctl_lower() function does not expect a > NULL ifr and dereferences it, leading to a system crash. > > Fix this by adding a NULL check for kernel_cfg->ifr in > generic_hwtstamp_get/set_lower(). If ifr is NULL, return > -EOPNOTSUPP to prevent the call to the legacy IOCTL helper. > > Fixes: 6e9e2eed4f39 ("net: ethtool: Add support for tsconfig command to > get/set hwtstamp config") Closes: > https://lore.kernel.org/lkml/cd6a7056-fa6d-43f8-b78a-f5e811247ba8@linux.dev/T/#mf5df538e21753e3045de98f25aa18d948be07df3 > Signed-off-by: Jiaming Zhang <r772577952@gmail.com> --- > net/core/dev_ioctl.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c > index ad54b12d4b4c..39eaf6ba981a 100644 > --- a/net/core/dev_ioctl.c > +++ b/net/core/dev_ioctl.c > @@ -474,6 +474,10 @@ int generic_hwtstamp_get_lower(struct net_device *dev, > return err; > } > > + /* Netlink path with unconverted driver */ nit: "lower driver", to be precise. With this change: Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Thank you! > + if (!kernel_cfg->ifr) > + return -EOPNOTSUPP; > + > /* Legacy path: unconverted lower driver */ > return generic_hwtstamp_ioctl_lower(dev, SIOCGHWTSTAMP, kernel_cfg); > } > @@ -498,6 +502,10 @@ int generic_hwtstamp_set_lower(struct net_device *dev, > return err; > } > > + /* Netlink path with unconverted driver */ same. > + if (!kernel_cfg->ifr) > + return -EOPNOTSUPP; > + > /* Legacy path: unconverted lower driver */ > return generic_hwtstamp_ioctl_lower(dev, SIOCSHWTSTAMP, kernel_cfg); > } -- Köry Maincent, Bootlin Embedded Linux and kernel engineering https://bootlin.com ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() 2025-10-30 10:14 ` Kory Maincent @ 2025-10-30 10:49 ` Jiaming Zhang 2025-10-30 10:50 ` kernel test robot 0 siblings, 1 reply; 5+ messages in thread From: Jiaming Zhang @ 2025-10-30 10:49 UTC (permalink / raw) To: kory.maincent Cc: davem, edumazet, horms, kuba, kuniyu, linux-kernel, netdev, pabeni, r772577952, sdf, stable, syzkaller, vladimir.oltean The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as: tsconfig_prepare_data() -> dev_get_hwtstamp_phylib() -> vlan_hwtstamp_get() -> generic_hwtstamp_get_lower() -> generic_hwtstamp_ioctl_lower() results in generic_hwtstamp_ioctl_lower() being called with kernel_cfg->ifr as NULL. The generic_hwtstamp_ioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash. Fix this by adding a NULL check for kernel_cfg->ifr in generic_hwtstamp_get/set_lower(). If ifr is NULL, return -EOPNOTSUPP to prevent the call to the legacy IOCTL helper. Fixes: 6e9e2eed4f39 ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Closes: https://lore.kernel.org/lkml/cd6a7056-fa6d-43f8-b78a-f5e811247ba8@linux.dev/T/#mf5df538e21753e3045de98f25aa18d948be07df3 Signed-off-by: Jiaming Zhang <r772577952@gmail.com> --- net/core/dev_ioctl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c index ad54b12d4b4c..a32e1036f12a 100644 --- a/net/core/dev_ioctl.c +++ b/net/core/dev_ioctl.c @@ -474,6 +474,10 @@ int generic_hwtstamp_get_lower(struct net_device *dev, return err; } + /* Netlink path with unconverted lower driver */ + if (!kernel_cfg->ifr) + return -EOPNOTSUPP; + /* Legacy path: unconverted lower driver */ return generic_hwtstamp_ioctl_lower(dev, SIOCGHWTSTAMP, kernel_cfg); } @@ -498,6 +502,10 @@ int generic_hwtstamp_set_lower(struct net_device *dev, return err; } + /* Netlink path with unconverted lower driver */ + if (!kernel_cfg->ifr) + return -EOPNOTSUPP; + /* Legacy path: unconverted lower driver */ return generic_hwtstamp_ioctl_lower(dev, SIOCSHWTSTAMP, kernel_cfg); } -- 2.34.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() 2025-10-30 10:49 ` [PATCH v2] " Jiaming Zhang @ 2025-10-30 10:50 ` kernel test robot 0 siblings, 0 replies; 5+ messages in thread From: kernel test robot @ 2025-10-30 10:50 UTC (permalink / raw) To: Jiaming Zhang; +Cc: stable, oe-kbuild-all Hi, Thanks for your patch. FYI: kernel test robot notices the stable kernel rule is not satisfied. The check is based on https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#option-1 Rule: add the tag "Cc: stable@vger.kernel.org" in the sign-off area to have the patch automatically included in the stable tree. Subject: [PATCH v2] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() Link: https://lore.kernel.org/stable/20251030104942.18561-1-r772577952%40gmail.com -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-10-30 10:51 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20251029110651.25c4936d@kmaincent-XPS-13-7390>
2025-10-30 9:36 ` [PATCH] net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() Jiaming Zhang
2025-10-30 9:40 ` kernel test robot
2025-10-30 10:14 ` Kory Maincent
2025-10-30 10:49 ` [PATCH v2] " Jiaming Zhang
2025-10-30 10:50 ` kernel test robot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox