ptp_clock_unregister() marks the clock defunct and wake timestamp waiters before posix_clock_unregister() marks it inactive. A poll waiter can consume the removal wakeup while the event queue is empty, return no events, and remain blocked until timeout after device removal. Identified while reviewing the PTP polling and removal paths. Using netdevsim's mock PTP clock in an x86_64 QEMU/KVM guest, the unpatched kernel missed 8 of 12 removal notifications, while the patched kernel reported all 12. No kernel instrumentation or forced fault injection was required. W=1, ptp_chardev.o compiled under allyesconfig and allmodconfig on net/main. Check the defunct state after registering the poll wait queue and return EPOLLERR when the clock is being removed. Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.") Signed-off-by: Avi Weiss --- drivers/ptp/ptp_chardev.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c index f63b45f5ee6a..01adc70ad97b 100644 --- a/drivers/ptp/ptp_chardev.c +++ b/drivers/ptp/ptp_chardev.c @@ -593,6 +593,9 @@ __poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp, poll_wait(fp, &ptp->tsev_wq, wait); + if (READ_ONCE(ptp->defunct)) + return EPOLLERR; + return queue_cnt(queue) ? EPOLLIN : 0; } base-commit: cb284914e749388eef402938bdb3115fe1f6d337 -- 2.53.0