Re: [PATCH v3 net-next 7/8] net: dsa: netc: add PTP two-step timestamping support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing NULL check for `tagger_data` in `netc_twostep_tstamp_process` can cause a kernel panic if a packet is received during or after teardown.
--

commit 148461a2244d72398b05dc311c1c2fbd45e48502
Author: Wei Fang <wei.fang@nxp.com>

net: dsa: netc: add PTP two-step timestamping support
    
This commit adds two-step TX timestamping and RX timestamping for the NETC
switch. It installs ingress port filter table (IPFT) rules for RX and
configures switch tags to capture timestamp responses for the TX path.

> diff --git a/net/dsa/tag_netc.c b/net/dsa/tag_netc.c
> index df72a61796ad5..d46576ae2f751 100644
> --- a/net/dsa/tag_netc.c
> +++ b/net/dsa/tag_netc.c
[ ... ]
> +static void netc_twostep_tstamp_process(struct netc_tag_th_subtype2 *tag,
> +					struct sk_buff *skb)
> +{
> +	u8 ts_req_id = FIELD_GET(NETC_TAG_TS_REQ_ID, tag->hr_tsreq_id);
> +	struct dsa_port *dp = dsa_user_to_port(skb->dev);
> +	u64 ts = get_unaligned_be64(&tag->timestamp);
> +	struct netc_tagger_data *tagger_data;
> +	struct dsa_switch *ds = dp->ds;
> +
> +	tagger_data = ds->tagger_data;
> +	if (unlikely(!tagger_data->twostep_tstamp_handler))

[Severity: High]
Can tagger_data be NULL here, leading to a kernel panic?

In the DSA teardown sequence (dsa_tree_teardown()),
dsa_switch_teardown_tag_protocol() is called first, invoking
netc_disconnect() which frees ds->tagger_data and sets it to NULL.

However, the conduit device's rx_handler is not removed until
dsa_tree_teardown_conduits() is called later. If a hardware-generated To_Host
subtype 2 response arrives in this window, the conduit's rx_handler will
still invoke netc_rcv(), eventually calling netc_twostep_tstamp_process().
This would result in a NULL pointer dereference when evaluating
!tagger_data->twostep_tstamp_handler.

Note that a follow-up patch (8/8) introduces a similar unchecked dereference
in netc_onestep_sync_enqueue(), so this issue might still be present at the
end of the series.

> +		return;
> +
> +	tagger_data->twostep_tstamp_handler(ds, dp->index, ts_req_id, ts);
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831082335.1184605-1-wei.fang@oss.nxp.com?part=7