Re: [PATCH net v2] dpll: fix NULL deref in dpll_device_ops() during teardown race
| Newsgroups | org.kernel.vger.netdev,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178699921389.1728655.16194826179389072857.git-patchwork-notify@kernel.org> |
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>: On Thu, 13 Aug 2026 16:08:17 +0200 you wrote: > When the last owner of a dpll device unregisters while a foreign driver > still holds a pin on it via dpll_pin_on_pin_register(), the dpll object > stays alive with an empty registration list. A pin notification queued > before the unregister (e.g. ice reacting to zl3073x_i2c removal) then > walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and > dereferences the missing registration. dpll_lock cannot help because the > notification work was queued before the unregistering driver took the > lock. > > [...] Here is the summary with links: - [net,v2] dpll: fix NULL deref in dpll_device_ops() during teardown race https://git.kernel.org/netdev/net/c/33f016b23a21 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html