From nobody Wed Sep 30 13:30:48 2026 Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B71363D668F for ; Fri, 7 Aug 2026 22:43:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786142600; cv=none; b=WULBty8LPdxxLrlncSQ/DUtV8vMV3ScboI6uY5t3ibLz3MvaQUS7f/TqBk/NvmLHd5BRLfpSQ2/LffTDjioKGkZhPZ4Rftm8Faee+/yHxlxzV/x0oPKOoxZLuTtkJIMHjjaXkX2hoNpI4LV6e4Vc59sY+dfC3Tzq3vj59rC1n/M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786142600; c=relaxed/simple; bh=oo5BQ2YFA1BOj35K9sZFqQ90+w5btbGqx4A0gTKL8gw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=hEP1iJTi66kL/senVwwpvoJcA+pgQtRHZvXHMKZSzpjS4PnslvmCrBvOEBcaVCwv92HBOzc8a6JFBp7rIYR4PidT1YWEQGOV+eTq/yEhe2kGiJ94lqV2BgGRyRBEIrs76e43DzKuesjlb898kLFnTdrHAQbKxDlPpTU6rVMokNo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--hramamurthy.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=NPuYhLsI; arc=none smtp.client-ip=209.85.210.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--hramamurthy.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="NPuYhLsI" Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-84842381150so67560b3a.3 for ; Fri, 07 Aug 2026 15:43:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786142599; x=1786747399; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=nVTmtHFgWt2omJAkKmGW8CxABaT9ZqlHPe4wJSsdn7Y=; b=NPuYhLsIzXE7X3+12SbyjEkyy1EV+M0oWMQnjIiLj/gGcZyS5JbPy/EDlv9c0ib8l3 fddTpC8ezpFWtsC6dJWExmpbjEswukKNxkUlGl/HAl3aSjfjygQpnnPy7YwI+QKrO2re 6hiGo33fGPYMsLZwFqYi/oNSP4ajymC7Nm4Eo2io3Xf2oBBq6rKWpw72hsWWaP5RlRc+ dd9pP8ny9j6C4hq9CXlT0NHfqNud3jah7MUMQDDAgh74sh286VDgfF6wfuIU2liZKXLB OXD8XdU2YuuTNuDZYnUMXlKz4F9oC9AKUthmiECj8dJ8C7iQAjb2K7tWl5C2F1hAdBh2 gKEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786142599; x=1786747399; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nVTmtHFgWt2omJAkKmGW8CxABaT9ZqlHPe4wJSsdn7Y=; b=CRsqAsjKCfVJkJGk3z0dAv9zsKzKCb+q/+SohToCw1K01FPvE6R2FoxvSRKDSb4eQa cNTwjoj8fSrsVO/jN4Vwzh6Y0I4HZob/fc9u6v2CradwJ2K7vUdDtQe58557UXhUH4yc Qt63gqR3X3w50vZJCYueUS/62xgSRb18YNqCpX8q/6ciuAHKGNpau418fhSHHHLzpLxT jwbd856a5UUw6d79kog5CWfsRqA7BrTiff+DqGyPvkjVY3KRunnNlegUTPyAzacCoRKj LMcu76eos/vfFMaP0zS6b/rbzuDiGQqOqMeg/dS3Ays3gT6Ucg9pCNsIi2UudPdV30uJ yokg== X-Forwarded-Encrypted: i=1; AHgh+RqEm4uTN48sB0WZacVbSBXG3K3KUIUcIKA4PDLKAHdHSh7O7dE5be0gCh5rBqT6oaJt+JSa3emP93aJIHI=@vger.kernel.org X-Gm-Message-State: AOJu0Ywd0bW4YElICzd83EGxvbp7R23QQyNh17nAOvj/J6/c6WG35W5a 6nDHpwW+AM8cMVaZ6tg3mBrCbmdhfFotd4+IDMOzOsUmzoJVLgR1imE2SFXHvybKoMnL+oEMvnp oka4oKzW2akYl5L4/hpHJbzwQzw== X-Received: from pfbcv13.prod.google.com ([2002:a05:6a00:44cd:b0:847:7f5d:6b90]) (user=hramamurthy job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:c95:b0:845:3033:6cb7 with SMTP id d2e1a72fcca58-84f2dfc8ec7mr25536940b3a.9.1786142598735; Fri, 07 Aug 2026 15:43:18 -0700 (PDT) Date: Fri, 7 Aug 2026 22:43:14 +0000 In-Reply-To: <20260807224315.234152-1-hramamurthy@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260807224315.234152-1-hramamurthy@google.com> X-Mailer: git-send-email 2.55.0.679.g6767b8d81c-goog Message-ID: <20260807224315.234152-2-hramamurthy@google.com> Subject: [PATCH net 1/2] gve: fix zero-length skb frag with header-split From: Harshitha Ramamurthy To: netdev@vger.kernel.org Cc: joshwash@google.com, hramamurthy@google.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, richardcochran@gmail.com, thostet@google.com, jordanrhee@google.com, ziweixiao@google.com, willemb@google.com, nktgrg@google.com, pkaligineedi@google.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jordan Rhee When header split is enabled and a header-only packet is received such as a pure TCP ACK, GVE will indicate an RX SKB with a zero-length fragment. If this SKB is then hairpinned and sent back out, the GVE TX path will emit a zero-length descriptor. Hardware considers this an illegal descriptor and stops the queue, causing a TX timeout and interface reset. Fix it by not adding the zero-length skb frag. Cc: stable@vger.kernel.org Fixes: 5e37d8254e7f ("gve: Add header split data path") Suggested-by: Praveen Kaligineedi Co-developed-by: Ziwei Xiao Signed-off-by: Ziwei Xiao Signed-off-by: Jordan Rhee Signed-off-by: Harshitha Ramamurthy --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_rx_dqo.c index 8271f731a91f..0ece2f6fdffb 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -886,6 +886,11 @@ static int gve_rx_dqo(struct napi_struct *napi, struct= gve_rx_ring *rx, rx->rx_hsplit_unsplit_pkt +=3D unsplit; rx->rx_hsplit_bytes +=3D hdr_len; u64_stats_update_end(&rx->statss); + + if (!buf_len) { + gve_free_buffer(rx, buf_state); + return 0; + } } else if (!rx->ctx.skb_head && rx->dqo.page_pool && netmem_is_net_iov(buf_state->page_info.netmem)) { /* when header split is disabled, the header went to the packet --=20 2.55.0.679.g6767b8d81c-goog From nobody Wed Sep 30 13:30:48 2026 Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D2EF3D47A6 for ; Fri, 7 Aug 2026 22:43:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786142601; cv=none; b=AOpX19Av2hpNEF8jiHZ8nyGFtMZ0AcXG/dKLEZNpLPO24vDA26FnTD5e9cOIrObW4KIO2iB8Fgv1FbbnaBRcvouXBK6/KKjTdGk32p8P6oc9kGHx5Y1v/qoW+cZk8JnHLxCBcPHBvk0sl3cXpeELdywgchCPAykRZHFxBwNkYqo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786142601; c=relaxed/simple; bh=RHoshScSBq/TXjA4IyzFbnd1hM0s5Vvftuy8gbda57g=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=W09MkzVpvHgx5ayb+pjzErDdVn921Wed1QfSYSZ9K5PONOXxYmagFfhSQxb0zJyOO3nz4mchwsEp10X2j3DFK6mSNVcpaIkv1oFnNHy/WxZGFfSkw5BK7esrS/M8GZ6tK800z0E3kHRTet95UicyV+UPken/MZsLxE7WmJ1W+hE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--hramamurthy.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=pWh2t7BF; arc=none smtp.client-ip=209.85.210.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--hramamurthy.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="pWh2t7BF" Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-84865f326efso74090b3a.0 for ; Fri, 07 Aug 2026 15:43:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786142600; x=1786747400; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=anI89PUz5R/cOuvPIsSAEi7/Ob4r4rENS/4H1jZGfTA=; b=pWh2t7BFbORX1eKU6k3gxRJZ6CetszLoVb2CAXJOPkpHKD74DJBduH+LTJGqedQvJ4 94Kz22vz9C/Bfrfk+DSWivndmq/waPG3Tj+RhPLJBoRS1ip899ihpj3reCeubVJXfw3H YS0gP+b1Xx4PoDZpED67lpPSTFvM1rujCGaVqsVB1w46vyQdl13nUNfLbJN/Y0rUHiG3 iGcjD+tnwpddwynKzuw3AnlEC3J9pamjmCa2qTpeayknB32SNpzEe/LWSerihI3ylV4L cE2e6RZmHlQfZfSEo5HHnOAikGqFlo4iRldVxnta4mFglZfpybYSsebzb6eCTRGcZppF F7Yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786142600; x=1786747400; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=anI89PUz5R/cOuvPIsSAEi7/Ob4r4rENS/4H1jZGfTA=; b=Kgj5po4OjZ3FBY/BElRe5FZ7tMKzaDgDFgwZxib5hlWxf7Gp9WF5jgFcWskO9axj1q IgUY9IlTlsVOQcq7ZXU9O6v1ic09I5+ZqhwZNOPjURVw+yVj8IQjvUbfJ07w3+fGdLic AEHt9FM07QDY81196bgK9ssGhFXTJxzWnC8vZMzOpJQJ2xHJQFfr2dAmT/SgonYwg+qM Ii5Xz/sbzyvqr0qT5OqpcKy18g1jqhYh7uGU7dHTvuzbtaTZ9iTrIdrZAu/y6hCr+IAv TnxDrUXmqDGLX/BL/6ucdMbcQ3QP9Qoufj0BjxI/mzo903LIrBaMLWURftsXvpoQzjn/ bLEA== X-Forwarded-Encrypted: i=1; AHgh+RqE9WA7fyMD0SRdm1CgPPLwRh2Se4tmfup8eKFOpeSoMLGfxwe0JHmQpI1yo47QLw1F+Y0+f5fQo5HhAtI=@vger.kernel.org X-Gm-Message-State: AOJu0YwVNKLeMavZBMJ+8fpJHNpjwL4VUKhztcCR3Q/9Ul8W/7H8pCvE XMRrScNHxDXS4XeiyVOCmF2qyISTSXfXe2qYp6GTYthT20kzzCli0zCZlhNyGXkeVqnZKItBtgz ogaeai1hTpU4h5VEpN4fMNpytGw== X-Received: from pfwy31.prod.google.com ([2002:a05:6a00:1c9f:b0:84c:2a14:d041]) (user=hramamurthy job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:2d8d:b0:846:bc81:3e29 with SMTP id d2e1a72fcca58-84f2e0228aemr24930499b3a.2.1786142599794; Fri, 07 Aug 2026 15:43:19 -0700 (PDT) Date: Fri, 7 Aug 2026 22:43:15 +0000 In-Reply-To: <20260807224315.234152-1-hramamurthy@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260807224315.234152-1-hramamurthy@google.com> X-Mailer: git-send-email 2.55.0.679.g6767b8d81c-goog Message-ID: <20260807224315.234152-3-hramamurthy@google.com> Subject: [PATCH net 2/2] gve: fix NULL dereference due to missing ptp adjfine From: Harshitha Ramamurthy To: netdev@vger.kernel.org Cc: joshwash@google.com, hramamurthy@google.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, richardcochran@gmail.com, thostet@google.com, jordanrhee@google.com, ziweixiao@google.com, willemb@google.com, nktgrg@google.com, pkaligineedi@google.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jordan Rhee Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 [ 551.943697] BUG: kernel NULL pointer dereference, address: 0000000000000= 000 [...] [ 552.061946] Call Trace: [ 552.064487] [ 552.066681] ptp_clock_adjtime+0x1c0/0x2c0 [ 552.070874] ? get_clock_desc+0x6b/0xb0 [ 552.074825] pc_clock_adjtime+0x78/0xc0 [ 552.078755] __do_sys_clock_adjtime+0x85/0x110 [ 552.083293] do_syscall_64+0xea/0x610 Cc: stable@vger.kernel.org Fixes: acd16380523b ("gve: Add initial PTP device support") Signed-off-by: Jordan Rhee Signed-off-by: Harshitha Ramamurthy Reviewed-by: Vadim Fedorenko --- drivers/net/ethernet/google/gve/gve_ptp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/google/gve/gve_ptp.c b/drivers/net/ethern= et/google/gve/gve_ptp.c index 06b1cf4a5efc..1d6c59f4ead3 100644 --- a/drivers/net/ethernet/google/gve/gve_ptp.c +++ b/drivers/net/ethernet/google/gve/gve_ptp.c @@ -26,6 +26,11 @@ int gve_clock_nic_ts_read(struct gve_priv *priv) return 0; } =20 +static int gve_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm) +{ + return -EOPNOTSUPP; +} + static int gve_ptp_gettimex64(struct ptp_clock_info *info, struct timespec64 *ts, struct ptp_system_timestamp *sts) @@ -60,6 +65,7 @@ static long gve_ptp_do_aux_work(struct ptp_clock_info *in= fo) static const struct ptp_clock_info gve_ptp_caps =3D { .owner =3D THIS_MODULE, .name =3D "gve clock", + .adjfine =3D gve_ptp_adjfine, .gettimex64 =3D gve_ptp_gettimex64, .settime64 =3D gve_ptp_settime64, .do_aux_work =3D gve_ptp_do_aux_work, --=20 2.55.0.679.g6767b8d81c-goog