Commit e9f35294 authored by I Viswanath's avatar I Viswanath Committed by Jakub Kicinski
Browse files

ptp: Add a upper bound on max_vclocks 



syzbot reported WARNING in max_vclocks_store.

This occurs when the argument max is too large for kcalloc to handle.

Extend the guard to guard against values that are too large for
kcalloc

Reported-by: default avatar <syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df


Tested-by: default avatar <syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com>
Fixes: 73f37068 ("ptp: support ptp physical/virtual clocks conversion")
Signed-off-by: default avatarI Viswanath <viswanathiyyappan@gmail.com>
Acked-by: default avatarRichard Cochran <richardcochran@gmail.com>
Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 958baf5e

drivers/ptp/ptp_private.h

+1 −0
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#define PTP_MAX_TIMESTAMPS 128

#define PTP_BUF_TIMESTAMPS 30

#define PTP_DEFAULT_MAX_VCLOCKS 20

#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))

#define PTP_MAX_CHANNELS 2048



enum {

drivers/ptp/ptp_sysfs.c

+1 −1
Original line number Diff line number Diff line
@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev, 
	size_t size;

	u32 max;



	if (kstrtou32(buf, 0, &max) || max == 0)

	if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)

		return -EINVAL;



	if (max == ptp->max_vclocks)