RE: [PATCH net-next 7/7] net: dsa: netc: add PTP one-step timestamping support

> > +struct sk_buff *netc_onestep_sync_handler(struct dsa_switch *ds, int port,
> > +					  struct sk_buff *skb)
> > +{
> > +	struct netc_port *np = NETC_PORT(ds, port);
> > +	struct netc_switch *priv = ds->priv;
> > +	u64 tstamp;
> > +
> > +	/* Serialize one-step Sync packets: only one can be in-flight at a
> > +	 * time because the SINGLE_STEP register is shared and must match the
> > +	 * packet currently being transmitted. Claim the in-flight slot under
> > +	 * ptp_lock. If another one-step Sync is already in-flight, queue this
> > +	 * skb and return NULL; ownership is transferred to the queue, so no
> > +	 * extra reference is needed and netc_xmit() stops processing it.
> > +	 */
> > +	spin_lock_bh(&np->ptp_lock);
> > +	if (test_bit(NETC_FLAG_ONESTEP_IN_PROGRESS, &np->flags)) {
> > +		__skb_queue_tail(&np->skb_onestep_queue, skb);
> > +		spin_unlock_bh(&np->ptp_lock);
> > +
> > +		return NULL;
> 
> [Severity: High]
> Is there a risk of memory exhaustion if an external source floods the port
> with forwarded PTP Sync packets? Since this queue has no length limit and
> returning NULL consumes the SKB, dsa_user_xmit() will return NETDEV_TX_OK,
> bypassing qdisc backpressure mechanisms.
> 

The concern is based on an incorrect model of the data path.
netc_onestep_sync_handler() is reached only through the tagger's .xmit
(netc_xmit → netc_onestep_sync_process), which DSA invokes exclusively
on the TX path (dsa_user_xmit). It is not on the RX path and not on the
hardware forwarding path.

Forwarded/received packets never reach this code. An external source
flooding the port with PTP Sync frames results in either RX to the CPU
(netc_rcv) or switch-internal port-to-port forwarding. Neither goes
through dsa_user_xmit / .xmit / netc_onestep_sync_handler. So "external
source floods the port with forwarded PTP Sync packets" cannot exercise
this queue at all.

Enqueuing requires local sender configuration, not just any packet. The
one-step path is entered only when all of the following hold: the frame
originates from a local send() on the DSA user netdev, the sending socket
enabled hardware TX timestamping (SKBTX_HW_TSTAMP), the port was
configured via SIOCSHWTSTAMP to HWTSTAMP_TX_ONESTEP_SYNC, and
ptp_classify_raw() identifies it as PTP. A remote attacker on the wire
cannot set SKBTX_HW_TSTAMP on a local socket, so this path is not
remotely reachable.