[PATCH net] ptp: ocp: prevent watchdog rearming during detach

[Runyu Xiao]

ptp_ocp_detach() uses timer_delete_sync() to stop the watchdog before
freeing the ptp_ocp state. timer_delete_sync() waits for a callback that is
already running but does not prevent the callback from rearming the timer.

Since ptp_ocp_watchdog() unconditionally calls mod_timer(), detach can
return with the watchdog pending. A later callback can access freed state.

Use timer_shutdown_sync() for the final watchdog teardown. This ensures the
callback is complete and cannot rearm the timer before the state is freed.

Fixes: 773bda964921 ("ptp: ocp: Expose various resources on the timecard.")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
 drivers/ptp/ptp_ocp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
index 3d26ec1f7..6b5f615a2 100644
--- a/drivers/ptp/ptp_ocp.c
+++ b/drivers/ptp/ptp_ocp.c
@@ -4870,7 +4870,7 @@ ptp_ocp_detach(struct ptp_ocp *bp)
 	ptp_ocp_debugfs_remove_device(bp);
 	ptp_ocp_detach_sysfs(bp);
 	ptp_ocp_attr_group_del(bp);
-	timer_delete_sync(&bp->watchdog);
+	timer_shutdown_sync(&bp->watchdog);
 	/* Disable interrupts on all timestampers */
 	if (bp->ts0)
 		ptp_ocp_ts_enable(bp->ts0, 0, false);
-- 
2.34.1