RE: [PATCH v3 net-next 7/8] net: dsa: netc: add PTP two-step timestamping support

["Wei Fang (OSS)" <wei.fang@oss.nxp.com>]

> > +static void netc_twostep_tstamp_process(struct netc_tag_th_subtype2 *tag,
> > +					struct sk_buff *skb)
> > +{
> > +	u8 ts_req_id = FIELD_GET(NETC_TAG_TS_REQ_ID, tag->hr_tsreq_id);
> > +	struct dsa_port *dp = dsa_user_to_port(skb->dev);
> > +	u64 ts = get_unaligned_be64(&tag->timestamp);
> > +	struct netc_tagger_data *tagger_data;
> > +	struct dsa_switch *ds = dp->ds;
> > +
> > +	tagger_data = ds->tagger_data;
> > +	if (unlikely(!tagger_data->twostep_tstamp_handler))
> 
> [Severity: High]
> Can tagger_data be NULL here, leading to a kernel panic?
> 
> In the DSA teardown sequence (dsa_tree_teardown()),
> dsa_switch_teardown_tag_protocol() is called first, invoking
> netc_disconnect() which frees ds->tagger_data and sets it to NULL.
> 
> However, the conduit device's rx_handler is not removed until
> dsa_tree_teardown_conduits() is called later. If a hardware-generated To_Host
> subtype 2 response arrives in this window, the conduit's rx_handler will still
> invoke netc_rcv(), eventually calling netc_twostep_tstamp_process().
> This would result in a NULL pointer dereference when
> evaluating !tagger_data->twostep_tstamp_handler.
> 
> Note that a follow-up patch (8/8) introduces a similar unchecked dereference
> in netc_onestep_sync_enqueue(), so this issue might still be present at the end
> of the series.

False positive — the teardown ordering is reversed.

In dsa_tree_teardown(), the conduit is torn down before the switch.
netc_disconnect() (which frees tagger_data and sets it NULL) runs during
switch teardown, which happens after the conduit is already shut down.

DSA RX into the tagger is gated by the conduit's dsa_ptr. Conduit teardown
clears dsa_ptr (with a barrier), so no further frames reach netc_rcv() from
that point on. By the time tagger_data is freed, the RX path is already stopped,
so the window you describe ("tagger_data NULL but frames still arriving") never
occurs. No NULL dereference is possible, and the same ordering covers the 8/8
case too. No check needed.