tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: stmmac: ptp: limit n_per_out

ptp_clock_ops.n_per_out sets the number of PPS outputs, which the PTP
subsystem uses to validate userspace input, such as the index number
used in a PTP_CLK_REQ_PEROUT request.

stmmac_enable() uses this to index the priv->pps array, which is an
array of size STMMAC_PPS_MAX. ptp_clock_ops.n_per_out is initialised
using priv->dma_cap.pps_out_num, which is a three bit field read from
hardware.

Documentation that I've checked suggests that values >= 5 are reserved,
but that doesn't mean such values won't appear, and if they do, we
can overrun the priv->pps array in stmmac_enable().

stmmac_ptp_register() has protection against this in its loop, but it
doesn't act to limit ptp_clock_ops.n_per_out.

Fix this by introducing a local variable, pps_out_num which is limited
to STMMAC_PPS_MAX, and use that when initialising the array and setting
priv->ptp_clock_ops.n_per_out. Print a warning when we limit the number
of outputs.

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/E1vvBhn-0000000ArCg-4C4u@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Russell King (Oracle) and committed by
Jakub Kicinski 5c894879 0314e382

+11 -6
+11 -6
drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
··· 334 334 */ 335 335 void stmmac_ptp_register(struct stmmac_priv *priv) 336 336 { 337 + unsigned int pps_out_num = priv->dma_cap.pps_out_num; 337 338 int i; 338 339 339 - for (i = 0; i < priv->dma_cap.pps_out_num; i++) { 340 - if (i >= STMMAC_PPS_MAX) 341 - break; 342 - priv->pps[i].available = true; 340 + if (pps_out_num > STMMAC_PPS_MAX) { 341 + dev_warn(priv->device, 342 + "pps outputs (%u) exceeds driver maximum, limiting to %u\n", 343 + pps_out_num, STMMAC_PPS_MAX); 344 + pps_out_num = STMMAC_PPS_MAX; 343 345 } 346 + 347 + for (i = 0; i < pps_out_num; i++) 348 + priv->pps[i].available = true; 344 349 345 350 /* Calculate the clock domain crossing (CDC) error if necessary */ 346 351 priv->plat->cdc_error_adj = 0; ··· 355 350 /* Update the ptp clock parameters based on feature discovery, when 356 351 * available 357 352 */ 358 - if (priv->dma_cap.pps_out_num) 359 - priv->ptp_clock_ops.n_per_out = priv->dma_cap.pps_out_num; 353 + if (pps_out_num) 354 + priv->ptp_clock_ops.n_per_out = pps_out_num; 360 355 361 356 if (priv->dma_cap.aux_snapshot_n) 362 357 priv->ptp_clock_ops.n_ext_ts = priv->dma_cap.aux_snapshot_n;