RE: [PATCH net-next 6/7] net: dsa: netc: add PTP two-step timestamping support

> > +static void netc_free_ports_resources(struct netc_switch *priv)
> > +{
> > +	struct dsa_port *dp;
> > +
> > +	dsa_switch_for_each_available_port(dp, priv->ds) {
> > +		struct netc_port *np = priv->ports[dp->index];
> > +
> > +		if (!dsa_port_is_user(dp))
> > +			continue;
> > +
> > +		/* No new SKBs can be enqueued during teardown. Purge without
> > +		 * the spinlock to avoid calling kfree_skb() with a destructor
> > +		 * (sock_efree) while holding a spinlock.
> > +		 */
> > +		__skb_queue_purge(&np->skb_txtstamp_queue);
> 
> [Severity: High]
> During switch teardown (e.g., driver unbind), the DSA teardown sequence
> destroys the switch before the master/conduit interface's RX handler is
> unregistered. Is it possible for late timestamp responses to still arrive?
> 
> If they do arrive, netc_twostep_tstamp_handler() will iterate over
> skb_txtstamp_queue under ptp_lock.
> 
> Does calling __skb_queue_purge() here without the lock risk corrupting the
> list pointers while the RX softirq is concurrently traversing them?

this is a false positive: dsa_conduit_teardown() clears conduit->dsa_ptr
(with a barrier) before ds->ops->teardown runs, so the handler cannot be
invoked concurrently with the purge, and there is no list-corruption risk.