Re: [PATCH net-next v2 08/10] net: dsa: microchip: add KSZ8463 tail tag handling

[Simon Horman]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
https://sashiko.dev/#/patchset/20260713-ksz-new-ptp-v2-1-7209c05058ef@xxxxxxxxxxx?part=8
---
--- Patch [8]: [PATCH net-next v2 08/10] net: dsa: microchip: add KSZ8463 tail tag handling ---
commit bc95662a9488a7827d30f83890008a818f0a5228
Author: Bastien Curutchet (Schneider Electric) <bastien.curutchet@xxxxxxxxxxx>

net: dsa: microchip: add KSZ8463 tail tag handling

KSZ8463 uses the KSZ9893 DSA TAG driver, but uses reserved fields in the PTP
header for timestamps instead of the tail tag. This commit adds a
KSZ8463-specific DSA_TAG driver to handle KSZ8463 timestamps.

> diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
> index f8b40437c5fa4..477f2997c1a34 100644
> --- a/net/dsa/tag_ksz.c
> +++ b/net/dsa/tag_ksz.c

[ ... ]

> +static struct sk_buff *ksz8463_rcv(struct sk_buff *skb, struct net_device *dev)
> +{
> +	unsigned int len = KSZ_EGRESS_TAG_LEN;
> +	struct ptp_header *ptp_hdr;
> +	unsigned int ptp_class;
> +	unsigned int port;
> +	ktime_t ts;
> +	u8 *tag;
> +
> +	if (skb_linearize(skb)) {
> +		kfree_skb(skb);
> +		return NULL;
> +	}
> +
> +	/* Tag decoding */
> +	tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
> +	port = tag[0] & KSZ8463_TAIL_TAG_EG_PORT_M;
> +
> +	__skb_push(skb, ETH_HLEN);
> +	ptp_class = ptp_classify_raw(skb);
> +	__skb_pull(skb, ETH_HLEN);
> +	if (ptp_class == PTP_CLASS_NONE)
> +		goto common_rcv;
> +
> +	ptp_hdr = ptp_parse_header(skb, ptp_class);
> +	if (ptp_hdr) {
> +		ts = ksz_decode_tstamp(get_unaligned_be32(&ptp_hdr->reserved2));
> +		KSZ_SKB_CB(skb)->tstamp = ts;
> +		ptp_hdr->reserved2 = 0;
> +		skb->ip_summed = CHECKSUM_NONE;

[Severity: High]
Does this unconditionally modify the payload of all PTP packets?

If a PTPv1 packet is received, ptp_classify_raw() identifies it as PTP, but
the PTPv1 header structure is different. Blindly casting and zeroing
ptp_hdr->reserved2 aliases bytes 16-19, which corrupts the subdomain string.
Should this check that ptp_class includes PTP_CLASS_V2?

Additionally, altering the UDP payload without updating the UDP checksum and
setting skb->ip_summed = CHECKSUM_NONE forces the network stack to verify the
now-invalid checksum, which causes the packet to be dropped.

> +	}

[Severity: High]
Can this leak uninitialized memory to userspace if a truncated PTP packet is
received?

If ptp_parse_header() returns NULL, KSZ_SKB_CB(skb)->tstamp is left
uninitialized. Later, when the DSA core calls dsa_skb_defer_rx_timestamp(),
this uninitialized value is read and exposed to userspace:

drivers/net/dsa/microchip/ksz_ptp.c:ksz_port_rxtstamp() {
    tstamp = KSZ_SKB_CB(skb)->tstamp;
    memset(hwtstamps, 0, sizeof(*hwtstamps));
    hwtstamps->hwtstamp = ksz_tstamp_reconstruct(dev, tstamp);
    ...
}

> +
> +common_rcv:
> +	return ksz_common_rcv(skb, dev, port, len);
> +}