[PATCH net v1] ptp: fix NULL deref when adjtime/adjfine are missing

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>

ptp_clock_adjtime() invokes ->adjtime and ->adjfine unconditionally,
but both callbacks are optional. clock_adjtime() with ADJ_SETOFFSET
or ADJ_FREQUENCY therefore oopses on a PHC that implements neither.

iavf registers such a read-only clock: no adjtime/adjfine, and
max_adj left at 0. ADJ_SETOFFSET hits the NULL ->adjtime after the
offset is validated. ADJ_FREQUENCY with freq 0 converts to 0 ppb,
passes the max_adj check, and hits the NULL ->adjfine.

Return -EOPNOTSUPP when the requested callback is missing, as the
adjphase path already does, rather than adding driver stubs.

Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.")
Fixes: 75ab70ec5cef ("ptp: remove the .adjfreq interface function")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>

diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index 4111342d64f03..b5df120be4d1b 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -158,6 +158,8 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
 
 		kt = timespec64_to_ktime(ts);
 		delta = ktime_to_ns(kt);
+		if (!ops->adjtime)
+			return -EOPNOTSUPP;
 		err = ops->adjtime(ops, delta);
 	} else if (tx->modes & ADJ_FREQUENCY) {
 		long ppb;
@@ -174,6 +176,8 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
 		ppb = scaled_ppm_to_ppb(tx->freq);
 		if (ppb > ops->max_adj || ppb < -ops->max_adj)
 			return -ERANGE;
+		if (!ops->adjfine)
+			return -EOPNOTSUPP;
 		err = ops->adjfine(ops, tx->freq);
 		if (!err)
 			ptp->dialed_frequency = tx->freq;
-- 
2.43.0