[v1] ptp: fix scaled_ppm_to_ppb() overflow bypassing the max_adj check

[PATCH net 0/2] ptp: fix scaled_ppm_to_ppb() overflow bypassing the max_adj check

Deep Shah posted 2 patches 1 week, 6 days ago

Diff against v2
Download series mbox

There is a newer version of this series

drivers/ptp/ptp_clock.c                       | 14 +++-
tools/testing/selftests/ptp/Makefile          |  2 +-
.../testing/selftests/ptp/ptp_freq_overflow.c | 74 +++++++++++++++++++
3 files changed, 88 insertions(+), 2 deletions(-)
create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c

Expand all Fold all

[PATCH net 0/2] ptp: fix scaled_ppm_to_ppb() overflow bypassing the max_adj check

Posted by Deep Shah 1 week, 6 days ago

ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting
tx->freq to ppb and comparing it against ops->max_adj. On 64-bit systems
that conversion can overflow s64 and wrap the result back into range, so
a crafted tx->freq bypasses the check and reaches ->adjfine() unclamped.

Patch 1 rejects the overflow in ptp_clock_adjtime().
Patch 2 adds a regression test that crafts struct timex.freq directly
(testptp's int-ppb path cannot express the value) and confirms it is
rejected with -ERANGE.

Deep Shah (2):
  ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb()
  selftests: ptp: add a regression test for the frequency adjustment
    overflow

 drivers/ptp/ptp_clock.c                       | 14 +++-
 tools/testing/selftests/ptp/Makefile          |  2 +-
 .../testing/selftests/ptp/ptp_freq_overflow.c | 74 +++++++++++++++++++
 3 files changed, 88 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c


base-commit: 3f1f755366687d051174739fb99f7d560202f60b
-- 
2.43.0

Re: [PATCH net 0/2] ptp: fix scaled_ppm_to_ppb() overflow bypassing the max_adj check

Posted by Vadim Fedorenko 1 week, 6 days ago

On 12/07/2026 05:09, Deep Shah wrote:
> ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting
> tx->freq to ppb and comparing it against ops->max_adj. On 64-bit systems
> that conversion can overflow s64 and wrap the result back into range, so
> a crafted tx->freq bypasses the check and reaches ->adjfine() unclamped.
> 
> Patch 1 rejects the overflow in ptp_clock_adjtime().
> Patch 2 adds a regression test that crafts struct timex.freq directly
> (testptp's int-ppb path cannot express the value) and confirms it is
> rejected with -ERANGE.
> 
> Deep Shah (2):
>    ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb()
>    selftests: ptp: add a regression test for the frequency adjustment
>      overflow
> 
>   drivers/ptp/ptp_clock.c                       | 14 +++-
>   tools/testing/selftests/ptp/Makefile          |  2 +-
>   .../testing/selftests/ptp/ptp_freq_overflow.c | 74 +++++++++++++++++++
>   3 files changed, 88 insertions(+), 2 deletions(-)
>   create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c
> 
> 
> base-commit: 3f1f755366687d051174739fb99f7d560202f60b

For the series:
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>