Re: [PATCH net v2] net: ravb: fix use-after-free in ravb_get_ts_info

On Sun, 2 Aug 2026 14:17:27 +0200 Niklas Söderlund wrote:

quoted

The PHC is registered by ravb_open() and unregistered by ravb_close().
However, ravb_ptp_stop() leaves priv->ptp.clock pointing at the freed
clock. Since the netdev remains registered after ndo_stop, get_ts_info
can still pass the dangling pointer to ptp_clock_index(), resulting in a
use-after-free.

Clear the pointer after unregistering the clock and only advertise hardware
timestamping support when a PHC is available.

Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <redacted>  

Thanks for re spinning this,

The AI reivewer has more comments, but at high level - why unregister
the PHC when the device goes down? The clocks stop?