[PATCH net] ptp: Report clock removal to poll waiters

[Avi Weiss <thnkslprpt@gmail.com>]

ptp_clock_unregister() marks the clock defunct and wake
timestamp waiters before posix_clock_unregister() marks
it inactive. A poll waiter can consume the removal wakeup
while the event queue is empty, return no events, and remain
blocked until timeout after device removal.

Identified while reviewing the PTP polling and removal paths.
Using netdevsim's mock PTP clock in an x86_64 QEMU/KVM guest,
the unpatched kernel missed 8 of 12 removal notifications,
while the patched kernel reported all 12. No kernel
instrumentation or forced fault injection was required.

W=1, ptp_chardev.o compiled under allyesconfig and
allmodconfig on net/main.

Check the defunct state after registering the poll wait
queue and return EPOLLERR when the clock is being removed.

Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 drivers/ptp/ptp_chardev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index f63b45f5ee6a..01adc70ad97b 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -593,6 +593,9 @@ __poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp,
 
 	poll_wait(fp, &ptp->tsev_wq, wait);
 
+	if (READ_ONCE(ptp->defunct))
+		return EPOLLERR;
+
 	return queue_cnt(queue) ? EPOLLIN : 0;
 }
 

base-commit: cb284914e749388eef402938bdb3115fe1f6d337
-- 
2.53.0