AZL-67569

In the Linux kernel, the following vulnerability has been resolved:

ptp: ocp: fix use-after-free bugs causing by ptpocpwatchdog

The ptpocpdetach() only shuts down the watchdog timer if it is pending. However, if the timer handler is already running, the timerdeletesync() is not called. This leads to race conditions where the devlink that contains the ptp_ocp is deallocated while the timer handler is still accessing it, resulting in use-after-free bugs. The following details one of the race scenarios.

(thread 1) | (thread 2) ptpocpremove() | ptpocpdetach() | ptpocpwatchdog() if (timerpending(&bp->watchdog))| bp = timercontainerof() timerdeletesync() | | devlinkfree(devlink) //free | | bp-> //use

Resolve this by unconditionally calling timerdeletesync() to ensure the timer is reliably deactivated, preventing any access after free.