Re: [PATCH net-next v2 08/10] net: dsa: microchip: add KSZ8463 tail tag handling

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
https://sashiko.dev/#/patchset/20260713-ksz-new-ptp-v2-1-7209c05058ef@bootlin.com?part=8
---

--- Patch [8]: [PATCH net-next v2 08/10] net: dsa: microchip: add KSZ8463 tail tag handling ---

commit bc95662a9488a7827d30f83890008a818f0a5228
Author: Bastien Curutchet (Schneider Electric) [off-list ref]

net: dsa: microchip: add KSZ8463 tail tag handling

KSZ8463 uses the KSZ9893 DSA TAG driver, but uses reserved fields in the PTP
header for timestamps instead of the tail tag. This commit adds a
KSZ8463-specific DSA_TAG driver to handle KSZ8463 timestamps.

[ ... ]

+static struct sk_buff *ksz8463_rcv(struct sk_buff *skb, struct net_device *dev)
+{
+	unsigned int len = KSZ_EGRESS_TAG_LEN;
+	struct ptp_header *ptp_hdr;
+	unsigned int ptp_class;
+	unsigned int port;
+	ktime_t ts;
+	u8 *tag;
+
+	if (skb_linearize(skb)) {
+		kfree_skb(skb);
+		return NULL;
+	}
+
+	/* Tag decoding */
+	tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+	port = tag[0] & KSZ8463_TAIL_TAG_EG_PORT_M;
+
+	__skb_push(skb, ETH_HLEN);
+	ptp_class = ptp_classify_raw(skb);
+	__skb_pull(skb, ETH_HLEN);
+	if (ptp_class == PTP_CLASS_NONE)
+		goto common_rcv;
+
+	ptp_hdr = ptp_parse_header(skb, ptp_class);
+	if (ptp_hdr) {
+		ts = ksz_decode_tstamp(get_unaligned_be32(&ptp_hdr->reserved2));
+		KSZ_SKB_CB(skb)->tstamp = ts;
+		ptp_hdr->reserved2 = 0;
+		skb->ip_summed = CHECKSUM_NONE;

[Severity: High]
Does this unconditionally modify the payload of all PTP packets?

If a PTPv1 packet is received, ptp_classify_raw() identifies it as PTP, but
the PTPv1 header structure is different. Blindly casting and zeroing
ptp_hdr->reserved2 aliases bytes 16-19, which corrupts the subdomain string.
Should this check that ptp_class includes PTP_CLASS_V2?

Additionally, altering the UDP payload without updating the UDP checksum and
setting skb->ip_summed = CHECKSUM_NONE forces the network stack to verify the
now-invalid checksum, which causes the packet to be dropped.

+	}

[Severity: High]
Can this leak uninitialized memory to userspace if a truncated PTP packet is
received?

If ptp_parse_header() returns NULL, KSZ_SKB_CB(skb)->tstamp is left
uninitialized. Later, when the DSA core calls dsa_skb_defer_rx_timestamp(),
this uninitialized value is read and exposed to userspace:

drivers/net/dsa/microchip/ksz_ptp.c:ksz_port_rxtstamp() {
    tstamp = KSZ_SKB_CB(skb)->tstamp;
    memset(hwtstamps, 0, sizeof(*hwtstamps));
    hwtstamps->hwtstamp = ksz_tstamp_reconstruct(dev, tstamp);
    ...
}

+
+common_rcv:
+	return ksz_common_rcv(skb, dev, port, len);
+}