linux/net/core
Jiaming Zhang f796a8dec9 net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()
The ethtool tsconfig Netlink path can trigger a null pointer
dereference. A call chain such as:

  tsconfig_prepare_data() ->
  dev_get_hwtstamp_phylib() ->
  vlan_hwtstamp_get() ->
  generic_hwtstamp_get_lower() ->
  generic_hwtstamp_ioctl_lower()

results in generic_hwtstamp_ioctl_lower() being called with
kernel_cfg->ifr as NULL.

The generic_hwtstamp_ioctl_lower() function does not expect
a NULL ifr and dereferences it, leading to a system crash.

Fix this by adding a NULL check for kernel_cfg->ifr in
generic_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL.

Fixes: 6e9e2eed4f ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config")
Closes: https://lore.kernel.org/cd6a7056-fa6d-43f8-b78a-f5e811247ba8@linux.dev
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Link: https://patch.msgid.link/20251111173652.749159-2-r772577952@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-13 17:23:21 -08:00
..
Makefile queue_api: add support for fetching per queue DMA dev 2025-08-28 16:05:31 -07:00
bpf_sk_storage.c bpf: Remove unnecessary BTF lookups in bpf_sk_storage_tracing_allowed 2025-01-29 08:51:51 -08:00
datagram.c net: datagram: introduce datagram_poll_queue for custom receive queues 2025-10-23 15:46:04 +02:00
dev.c net: core: fix lockdep splat on device unregister 2025-10-14 19:27:20 -07:00
dev.h net: add NUMA awareness to skb_attempt_defer_free() 2025-09-30 15:45:53 +02:00
dev_addr_lists.c net: s/dev_pre_changeaddr_notify/netif_pre_changeaddr_notify/ 2025-07-18 17:27:47 -07:00
dev_addr_lists_test.c
dev_api.c net: define an enum for the napi threaded state 2025-07-24 18:34:55 -07:00
dev_ioctl.c net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() 2025-11-13 17:23:21 -08:00
devmem.c net: devmem: refresh devmem TX dst in case of route invalidation 2025-10-29 19:23:21 -07:00
devmem.h net: devmem: pull out dma_dev out of net_devmem_bind_dmabuf 2025-08-28 16:05:32 -07:00
drop_monitor.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
dst.c net: dst: introduce dst->dev_rcu 2025-08-29 19:36:31 -07:00
dst_cache.c net: dst: annotate data-races around dst->obsolete 2025-07-02 14:32:29 -07:00
failover.c
fib_notifier.c
fib_rules.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-04-17 12:26:50 -07:00
filter.c bpf: Reject negative head_room in __bpf_skb_change_head 2025-10-28 14:54:56 -07:00
flow_dissector.c net: remove '__' from __skb_flow_get_ports() 2025-02-24 14:27:53 -08:00
flow_offload.c
gen_estimator.c net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y 2025-08-29 19:04:20 -07:00
gen_stats.c
gro.c net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb() 2025-10-16 15:42:49 -07:00
gro_cells.c net: gro_cells: Reduce lock scope in gro_cell_poll 2025-11-05 17:41:29 -08:00
gso.c
hotdata.c tcp: move tcp_memory_allocated into net_aligned_data 2025-07-02 14:22:02 -07:00
hwbm.c
ieee8021q_helpers.c net: ieee8021q: fix insufficient table-size assertion 2025-07-01 12:55:49 +02:00
link_watch.c net: replace use of system_unbound_wq with system_dfl_wq 2025-09-22 17:40:30 -07:00
lock_debug.c netdev: fix the locking for netdev notifications 2025-04-17 18:55:14 -07:00
lwt_bpf.c ipv4: Convert ->flowi4_tos to dscp_t. 2025-08-26 17:34:31 -07:00
lwtunnel.c inet: Remove rtnl_is_held arg of lwtunnel_valid_encap_type(_attr)?(). 2025-05-20 19:18:24 -07:00
mp_dmabuf_devmem.h
neighbour.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-07-26 11:49:45 -07:00
net-procfs.c net: use NUMA drop counters for softnet_data.dropped 2025-09-14 11:35:17 -07:00
net-sysfs.c Networking changes for 6.18. 2025-10-02 15:17:01 -07:00
net-sysfs.h net: remove RTNL use for /proc/sys/net/core/rps_default_mask 2025-07-07 18:42:12 -07:00
net-traces.c
net_namespace.c namespace-6.18-rc1 2025-09-29 11:20:29 -07:00
net_test.c
netclassid_cgroup.c net, bpf: Fix RCU usage in task_cls_state() for BPF programs 2025-06-11 21:30:29 +02:00
netdev-genl-gen.c net: define an enum for the napi threaded state 2025-07-24 18:34:55 -07:00
netdev-genl-gen.h net: devmem: TCP tx netlink api 2025-05-13 11:12:48 +02:00
netdev-genl.c net: devmem: allow binding on rx queues with same DMA devices 2025-08-28 16:05:32 -07:00
netdev_queues.c queue_api: add support for fetching per queue DMA dev 2025-08-28 16:05:31 -07:00
netdev_rx_queue.c net: add helper to pre-check if PP for an Rx queue will be unreadable 2025-09-04 10:19:17 +02:00
netevent.c
netmem_priv.h page_pool: Track DMA-mapped pages and unmap them when destroying the pool 2025-04-14 16:30:29 -07:00
netpoll.c net: netpoll: fix incorrect refcount handling causing incorrect cleanup 2025-11-10 18:34:44 -08:00
netprio_cgroup.c
of_net.c
page_pool.c page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches 2025-10-06 12:14:04 -07:00
page_pool_priv.h net: page_pool: don't try to stash the napi id 2025-01-27 14:37:41 -08:00
page_pool_user.c net: use napi_id_valid helper 2025-02-17 16:43:04 -08:00
pktgen.c net: pktgen: Use min()/min_t() to improve pktgen_finalize_skb() 2025-08-21 10:12:11 +02:00
ptp_classifier.c
request_sock.c tcp: Remove stale locking comment for TFO. 2025-09-23 18:21:36 -07:00
rtnetlink.c rtnetlink: Allow deleting FDB entries in user namespace 2025-10-16 16:09:56 -07:00
scm.c scm: use masked_user_access_begin() in put_cmsg() 2025-09-29 18:03:42 -07:00
secure_seq.c net: Retire DCCP socket. 2025-04-11 18:58:10 -07:00
selftests.c net: selftests: add PHY-loopback test for bad TCP checksums 2025-07-18 17:19:46 -07:00
skb_fault_injection.c
skbuff.c udp: do not use skb_release_head_state() before skb_attempt_defer_free() 2025-10-16 16:03:07 +02:00
skmsg.c net: replace use of system_wq with system_percpu_wq 2025-09-22 17:40:30 -07:00
sock.c net: move sk->sk_err_soft and sk->sk_sndbuf 2025-09-22 17:55:24 -07:00
sock_destructor.h
sock_diag.c net: WQ_PERCPU added to alloc_workqueue users 2025-09-22 17:40:30 -07:00
sock_map.c bpf: Remove attach_type in sockmap_link 2025-07-11 10:51:55 -07:00
sock_reuseport.c
stream.c net: stream: add description for sk_stream_write_space() 2025-07-18 16:57:21 -07:00
sysctl_net_core.c net: remove RTNL use for /proc/sys/net/core/rps_default_mask 2025-07-07 18:42:12 -07:00
timestamping.c net: Add the possibility to support a selected hwtstamp in netdevice 2024-12-16 12:51:40 +00:00
tso.c
utils.c net: Fix checksum update for ILA adj-transport 2025-05-30 19:53:51 -07:00
xdp.c net: xdp: pass full flags to xdp_update_skb_shared_info() 2025-09-11 12:00:20 +02:00