Re: [PATCH net] dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 10 Jul 2026 21:36:25 +0200 you wrote:
> When a dpll_pin is shared across multiple dpll_device instances and
> those devices are being unregistered (e.g. during driver module removal),
> a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().
> 
> This happens under the following conditions:
>  - A pin is registered with two or more dpll devices (dpll_A, dpll_B)
>  - The pin has ref_sync pairs with other pins
>  - During unregistration of dpll_A's pins, a ref_sync partner pin is
>    unregistered first, removing it from dpll_A->pin_refs
>  - But since the partner pin is still registered with dpll_B, its
>    dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT
>    run and the partner stays in the pin's ref_sync_pins xarray
>  - When the pin itself is then unregistered from dpll_A, the delete
>    notification calls dpll_msg_add_pin_ref_sync() which finds the
>    partner in ref_sync_pins, passes dpll_pin_available() (partner is
>    still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,
>    partner) returns NULL because partner was already removed from
>    dpll_A->pin_refs
>  - The NULL priv pointer is passed to the driver's ref_sync_get
>    callback, which dereferences it
> 
> [...]

Here is the summary with links:
  - [net] dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
    https://git.kernel.org/netdev/net/c/d2e914a4a0d0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html