ptp: prevent possible ABBA deadlock in ptp_clock_freerun()

JIRA: https://issues.redhat.com/browse/RHEL-115644

commit 2efe412
Author: Jeongjun Park <aha310510@gmail.com>
Date:   Mon Jul 28 15:26:49 2025 +0900

    ptp: prevent possible ABBA deadlock in ptp_clock_freerun()

    syzbot reported the following ABBA deadlock:

           CPU0                           CPU1
           ----                           ----
      n_vclocks_store()
        lock(&ptp->n_vclocks_mux) [1]
            (physical clock)
                                         pc_clock_adjtime()
                                           lock(&clk->rwsem) [2]
                                            (physical clock)
                                           ...
                                           ptp_clock_freerun()
                                             ptp_vclock_in_use()
                                               lock(&ptp->n_vclocks_mux) [3]
                                                  (physical clock)
        ptp_clock_unregister()
          posix_clock_unregister()
            lock(&clk->rwsem) [4]
              (virtual clock)

    Since ptp virtual clock is registered only under ptp physical clock, both
    ptp_clock and posix_clock must be physical clocks for ptp_vclock_in_use()
    to lock &ptp->n_vclocks_mux and check ptp->n_vclocks.

    However, when unregistering vclocks in n_vclocks_store(), the locking
    ptp->n_vclocks_mux is a physical clock lock, but clk->rwsem of
    ptp_clock_unregister() called through device_for_each_child_reverse()
    is a virtual clock lock.

    Therefore, clk->rwsem used in CPU0 and clk->rwsem used in CPU1 are
    different locks, but in lockdep, a false positive occurs because the
    possibility of deadlock is determined through lock-class.

    To solve this, lock subclass annotation must be added to the posix_clock
    rwsem of the vclock.

    Reported-by: syzbot+7cfb66a237c4a5fb22ad@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=7cfb66a237c4a5fb22ad
    Fixes: 73f3706 ("ptp: support ptp physical/virtual clocks conversion")
    Signed-off-by: Jeongjun Park <aha310510@gmail.com>
    Acked-by: Richard Cochran <richardcochran@gmail.com>
    Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Link: https://patch.msgid.link/20250728062649.469882-1-aha310510@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

Author: CKI Backport Bot

drivers/ptp/ptp_private.h

@@ -20,6 +20,11 @@
 #define PTP_BUF_TIMESTAMPS 30
 #define PTP_DEFAULT_MAX_VCLOCKS 20
 
+enum {
+	PTP_LOCK_PHYSICAL = 0,
+	PTP_LOCK_VIRTUAL,
+};
+
 struct timestamp_event_queue {
 	struct ptp_extts_event buf[PTP_MAX_TIMESTAMPS];
 	int head;

drivers/ptp/ptp_vclock.c

@@ -154,6 +154,11 @@ static long ptp_vclock_refresh(struct ptp_clock_info *ptp)
 	return PTP_VCLOCK_REFRESH_INTERVAL;
 }
 
+static void ptp_vclock_set_subclass(struct ptp_clock *ptp)
+{
+	lockdep_set_subclass(&ptp->clock.rwsem, PTP_LOCK_VIRTUAL);
+}
+
 static const struct ptp_clock_info ptp_vclock_info = {
 	.owner		= THIS_MODULE,
 	.name		= "ptp virtual clock",
@@ -213,6 +218,8 @@ struct ptp_vclock *ptp_vclock_register(struct ptp_clock *pclock)
 		return NULL;
 	}
 
+	ptp_vclock_set_subclass(vclock->clock);
+
 	timecounter_init(&vclock->tc, &vclock->cc, 0);
 	ptp_schedule_worker(vclock->clock, PTP_VCLOCK_REFRESH_INTERVAL);