Re: [PATCH net-next v2] net: dsa: avoid potential use-after-free error

On Fri, Nov 20, 2020 at 12:59:21PM -0800, Jakub Kicinski wrote:

On Fri, 20 Nov 2020 20:01:49 +0200 Vladimir Oltean wrote:

quoted

On Thu, Nov 19, 2020 at 12:09:06PM +0100, Christian Eggers wrote:

quoted

If dsa_switch_ops::port_txtstamp() returns false, clone will be freed
immediately. Shouldn't store a pointer to freed memory.

Signed-off-by: Christian Eggers <ceggers@arri.de>
Fixes: 146d442c2357 ("net: dsa: Keep a pointer to the skb clone for TX timestamping")
---

IMO this is one of the cases to which the following from
Documentation/process/stable-kernel-rules.rst does not apply:

 - It must fix a real bug that bothers people (not a, "This could be a
   problem..." type thing).

Therefore, specifying "net-next" as the target tree here as opposed to
"net" is the correct choice.

The commit message doesn't really explain what happens after.

Is the dangling pointer ever accessed?

Nothing happens afterwards. He explained that he accessed it once while
working on his ksz9477 PTP series. There's no code affected by this in
mainline.