Re: [PATCH net v1] net: ravb: fix use-after-free in ravb_get_ts_info

Hello Xuanqiang,

Thanks for your work.

On 2026-07-31 14:32:54 +0800, [email protected] wrote:
> From: Xuanqiang Luo <[email protected]>
> 
> The PHC is registered by ravb_open() and unregistered by ravb_close().
> However, ravb_ptp_stop() leaves priv->ptp.clock pointing at the freed
> clock. Since the netdev remains registered after ndo_stop, get_ts_info
> can still pass the dangling pointer to ptp_clock_index(), resulting in a
> use-after-free.
> 
> Clear the pointer after unregistering the clock and only query the index
> while a clock is registered.
> 
> Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
> Cc: [email protected]
> Signed-off-by: Xuanqiang Luo <[email protected]>
> ---
> I don't have access to RAVB hardware to reproduce the issue. To aid
> review, see the similar PHC lifetime fix merged as commit 8da13e6d63c1
> ("net: macb: fix use-after-free access to PTP clock").
> 
>  drivers/net/ethernet/renesas/ravb_main.c | 3 ++-
>  drivers/net/ethernet/renesas/ravb_ptp.c  | 5 ++++-
>  2 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
> index 5f88733094d0f..3a9d9f8718216 100644
> --- a/drivers/net/ethernet/renesas/ravb_main.c
> +++ b/drivers/net/ethernet/renesas/ravb_main.c
> @@ -1779,7 +1779,8 @@ static int ravb_get_ts_info(struct net_device *ndev,
>  			(1 << HWTSTAMP_FILTER_NONE) |
>  			(1 << HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
>  			(1 << HWTSTAMP_FILTER_ALL);
> -		info->phc_index = ptp_clock_index(priv->ptp.clock);
> +		if (priv->ptp.clock)
> +			info->phc_index = ptp_clock_index(priv->ptp.clock);

While this avoids the lifetime issue, the fix is incomplete. The info 
structure will still report HW clock support but there is no PTP clock 
index.

I have a pending series which cleans up most, if not all, of this issue.  
Could you check [1] and see if that covers your concern? I will post a 
new version of that series as soon as vacation time is over and the Gen4 
PTP driver itself is merged.

1.  https://lore.kernel.org/all/[email protected]/

>  	}
>  
>  	return 0;
> diff --git a/drivers/net/ethernet/renesas/ravb_ptp.c b/drivers/net/ethernet/renesas/ravb_ptp.c
> index 226c6c0ab945b..fc8c601ed3a5e 100644
> --- a/drivers/net/ethernet/renesas/ravb_ptp.c
> +++ b/drivers/net/ethernet/renesas/ravb_ptp.c
> @@ -337,5 +337,8 @@ void ravb_ptp_stop(struct net_device *ndev)
>  	ravb_write(ndev, 0, GIC);
>  	ravb_write(ndev, 0, GIS);
>  
> -	ptp_clock_unregister(priv->ptp.clock);
> +	if (priv->ptp.clock) {
> +		ptp_clock_unregister(priv->ptp.clock);
> +		priv->ptp.clock = NULL;
> +	}
>  }
> -- 
> 2.43.0

-- 
Kind Regards,
Niklas Söderlund