[lvc-project] [PATCH 6.1] ice: Don't process extts if PTP is disabled

[Votokina Victoria]

From: Victoria Votokina <Victoria.Votokina at kaspersky.com>

commit 996422e3230e41468f652d754fefd1bdbcd4604e upstream

The ice_ptp_extts_event() function can race with ice_ptp_release() and
result in a NULL pointer dereference which leads to a kernel panic.

Panic occurs because the ice_ptp_extts_event() function calls
ptp_clock_event() with a NULL pointer. The ice driver has already
released the PTP clock by the time the interrupt for the next external
timestamp event occurs.

To fix this, modify the ice_ptp_extts_event() function to check the
PTP state and bail early if PTP is not ready.

Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel at intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller at intel.com>
Signed-off-by: Karol Kolacinski <karol.kolacinski at intel.com>
Reviewed-by: Simon Horman <horms at kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha at intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>
Link: https://patch.msgid.link/20240702171459.2606611-3-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
[ Victoria: commit 8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8 ("ice: introduce PTP state machine") 
 does not backported so pf->ptp.state and ICE_PTP_READY are missing in 6.1. 
 The existing ICE_FLAG_PTP and pf->flags via the test_bit are used instead.]
Signed-off-by: Victoria Votokina <Victoria.Votokina at kaspersky.com>
---
Backport fix for CVE-2024-42107
 drivers/net/ethernet/intel/ice/ice_ptp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 46b0063a5e12..7354663b02f0 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -1488,6 +1488,10 @@ void ice_ptp_extts_event(struct ice_pf *pf)
 	u8 chan, tmr_idx;
 	u32 hi, lo;
 
+	/* Don't process timestamp events if PTP is not ready */
+	if (!test_bit(ICE_FLAG_PTP, pf->flags))
+		return;
+
 	tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned;
 	/* Event time is captured by one of the two matched registers
 	 *      GLTSYN_EVNT_L: 32 LSB of sampled time event
-- 
2.43.0