Re: [PATCH net v2] net: ravb: fix use-after-free in ravb_get_ts_info

On Sun, 2 Aug 2026 14:17:27 +0200 Niklas S=C3=B6derlund wrote:
> > The PHC is registered by ravb_open() and unregistered by ravb_close().
> > However, ravb_ptp_stop() leaves priv->ptp.clock pointing at the freed
> > clock. Since the netdev remains registered after ndo_stop, get_ts_info
> > can still pass the dangling pointer to ptp_clock_index(), resulting in a
> > use-after-free.
> >=20
> > Clear the pointer after unregistering the clock and only advertise hard=
ware
> > timestamping support when a PHC is available.
> >=20
> > Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
> > Cc: [email protected]
> > Signed-off-by: Xuanqiang Luo <[email protected]> =20
>=20
> Thanks for re spinning this,

The AI reivewer has more comments, but at high level - why unregister
the PHC when the device goes down? The clocks stop?