ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting tx->freq to ppb and comparing it against ops->max_adj. On 64-bit systems that conversion can overflow s64 and wrap the result back into range, so a crafted tx->freq bypasses the check and reaches ->adjfine() unclamped.
Patch 1 rejects the overflow in ptp_clock_adjtime(). Patch 2 adds a regression test that crafts struct timex.freq directly (testptp's int-ppb path cannot express the value) and confirms it is rejected with -ERANGE. Changes in v2: - patch 1: unchanged, added Reviewed-by from Vadim Fedorenko. - patch 2 (all from Simon Horman's review): - cast fd to unsigned before the shift in FD_TO_CLOCKID (UBSan) - only set the 64-bit test value on 64-bit builds (32-bit -Woverflow) - save and restore the clock frequency - skip instead of fail on -EBUSY (free-running clock) Link to v1: https://lore.kernel.org/netdev/[email protected]/ Deep Shah (2): ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb() selftests: ptp: add a regression test for the frequency adjustment overflow drivers/ptp/ptp_clock.c | 14 ++- tools/testing/selftests/ptp/Makefile | 2 +- .../testing/selftests/ptp/ptp_freq_overflow.c | 99 +++++++++++++++++++ 3 files changed, 113 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c base-commit: 1c975de3343cdef506f2eecc833cc1f14b0401c4 -- 2.43.0
