ptp: idt82p33: Stop PTP work producers before teardown

Browse source

idt82p33_ptp_clock_unregister_all() cancels each channel's adjtime work
before unregistering its PTP clock. An adjustment callback already in
progress can schedule that work after cancellation returns. Device
removal then frees the channel while its delayed work remains queued,
causing a use-after-free.

Mark the device as stopping under its lock before draining work. Reject
new adjustment and EXTS requests, clear the EXTS polling mask, and
synchronously drain the EXTS and channel adjustment work before the
device storage is released.

With an i2c-stub device and kprobe-controlled callback timing, three
runs of the unmodified driver reported KASAN use-after-free after
unbind. Three runs with this change completed without a kernel
diagnostic. No physical IDT82P33 device was tested.

Cc: stable+noautosel@kernel.org # untested fix to a driver init path race
Signed-off-by: Yibo Tan <lhfff@tju.edu.cn>
Link: https://patch.msgid.link/20260922113601.855416-1-lhfff@tju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Yibo Tan 2026-09-22 19:36:01 +08:00 • committed by Jakub Kicinski

parent e3a46dde23

commit a529f9258d

2 changed files with 22 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

25

drivers/ptp/ptp_idt82p33.c

View file

1

drivers/ptp/ptp_idt82p33.h

View file