Re: [PATCH net v2] net: ravb: fix use-after-free in ravb_get_ts_info

On 2026-08-04 18:08:55 -0700, Jakub Kicinski wrote:
> On Sun, 2 Aug 2026 14:17:27 +0200 Niklas Söderlund wrote:
> > > The PHC is registered by ravb_open() and unregistered by ravb_close().
> > > However, ravb_ptp_stop() leaves priv->ptp.clock pointing at the freed
> > > clock. Since the netdev remains registered after ndo_stop, get_ts_info
> > > can still pass the dangling pointer to ptp_clock_index(), resulting in a
> > > use-after-free.
> > > 
> > > Clear the pointer after unregistering the clock and only advertise hardware
> > > timestamping support when a PHC is available.
> > > 
> > > Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
> > > Cc: [email protected]
> > > Signed-off-by: Xuanqiang Luo <[email protected]>  
> > 
> > Thanks for re spinning this,
> 
> The AI reivewer has more comments, but at high level - why unregister
> the PHC when the device goes down? The clocks stop?

Yes, PTP clock is in the same power domain as the ndev. When the device 
go down runtime PM suspends the device so the clock also stops.

-- 
Kind Regards,
Niklas Söderlund