Skip to content

Commit

Permalink
bnx2x: prevent crash when accessing PTP with interface down
Browse files Browse the repository at this point in the history
It is possible to crash the kernel by accessing a PTP device while its
associated bnx2x interface is down. Before the interface is brought up,
the timecounter is not initialized, so accessing it results in NULL
dereference.

Fix it by checking if the interface is up.

Use -ENETDOWN as the error code when the interface is down.
 -EFAULT in bnx2x_ptp_adjfreq() did not seem right.

Tested using phc_ctl get/set/adj/freq commands.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Michal Schmidt authored and David S. Miller committed Mar 7, 2017
1 parent 239870f commit 466e8bf
Showing 1 changed file with 19 additions and 1 deletion.
20 changes: 19 additions & 1 deletion drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
Original file line number Diff line number Diff line change
Expand Up @@ -13738,7 +13738,7 @@ static int bnx2x_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
if (!netif_running(bp->dev)) {
DP(BNX2X_MSG_PTP,
"PTP adjfreq called while the interface is down\n");
return -EFAULT;
return -ENETDOWN;
}

if (ppb < 0) {
Expand Down Expand Up @@ -13797,6 +13797,12 @@ static int bnx2x_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
{
struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);

if (!netif_running(bp->dev)) {
DP(BNX2X_MSG_PTP,
"PTP adjtime called while the interface is down\n");
return -ENETDOWN;
}

DP(BNX2X_MSG_PTP, "PTP adjtime called, delta = %llx\n", delta);

timecounter_adjtime(&bp->timecounter, delta);
Expand All @@ -13809,6 +13815,12 @@ static int bnx2x_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
u64 ns;

if (!netif_running(bp->dev)) {
DP(BNX2X_MSG_PTP,
"PTP gettime called while the interface is down\n");
return -ENETDOWN;
}

ns = timecounter_read(&bp->timecounter);

DP(BNX2X_MSG_PTP, "PTP gettime called, ns = %llu\n", ns);
Expand All @@ -13824,6 +13836,12 @@ static int bnx2x_ptp_settime(struct ptp_clock_info *ptp,
struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
u64 ns;

if (!netif_running(bp->dev)) {
DP(BNX2X_MSG_PTP,
"PTP settime called while the interface is down\n");
return -ENETDOWN;
}

ns = timespec64_to_ns(ts);

DP(BNX2X_MSG_PTP, "PTP settime called, ns = %llu\n", ns);
Expand Down

0 comments on commit 466e8bf

Please sign in to comment.