[PATCH net] dpll: use exact lookup for reference sync pin id

[PATCH net] dpll: use exact lookup for reference sync pin id

[Ivan Vecera]

dpll_pin_ref_sync_state_set() looks up the reference sync pin in the
pin->ref_sync_pins xarray, which is keyed by the sync pin's id (see
dpll_pin_ref_sync_pair_add() using xa_insert() with ref_sync_pin->id).
The pin id to operate on is supplied by userspace via DPLL_A_PIN_ID.

The lookup however used xa_find() with a ULONG_MAX limit, which returns
the first present entry with an index greater than or equal to the
requested id, not the entry stored exactly at that id. If userspace
passes an id that is not paired as a reference sync pin, but another
pin with a higher id is present in the xarray, xa_find() silently
returns that wrong pin and the subsequent ref_sync_set() operates on
it. The request only fails when the given id is larger than every
present key.

Use xa_load() for an exact-key lookup instead, mirroring the deletion
path in dpll_pin_ref_sync_pair_del().

Fixes: 58256a26bfb3 ("dpll: add reference sync get/set")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
---
 drivers/dpll/dpll_netlink.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c
index 45365214fbef..fb24fd53f2e1 100644
--- a/drivers/dpll/dpll_netlink.c
+++ b/drivers/dpll/dpll_netlink.c
@@ -1210,8 +1210,7 @@ dpll_pin_ref_sync_state_set(struct dpll_pin *pin,
 	struct dpll_device *dpll;
 	int ret;
 
-	ref_sync_pin = xa_find(&pin->ref_sync_pins, &ref_sync_pin_idx,
-			       ULONG_MAX, XA_PRESENT);
+	ref_sync_pin = xa_load(&pin->ref_sync_pins, ref_sync_pin_idx);
 	if (!ref_sync_pin) {
 		NL_SET_ERR_MSG(extack, "reference sync pin not found");
 		return -EINVAL;
-- 
2.54.0

Re: [PATCH net] dpll: use exact lookup for reference sync pin id

[Jakub Kicinski]

On Thu, 17 Sep 2026 16:37:36 +0200 Ivan Vecera wrote:
> Subject: [PATCH net] dpll: use exact lookup for reference sync pin id

Thanks for following up on this!

Re: [PATCH net] dpll: use exact lookup for reference sync pin id

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 17 Sep 2026 16:37:36 +0200 you wrote:
> dpll_pin_ref_sync_state_set() looks up the reference sync pin in the
> pin->ref_sync_pins xarray, which is keyed by the sync pin's id (see
> dpll_pin_ref_sync_pair_add() using xa_insert() with ref_sync_pin->id).
> The pin id to operate on is supplied by userspace via DPLL_A_PIN_ID.
> 
> The lookup however used xa_find() with a ULONG_MAX limit, which returns
> the first present entry with an index greater than or equal to the
> requested id, not the entry stored exactly at that id. If userspace
> passes an id that is not paired as a reference sync pin, but another
> pin with a higher id is present in the xarray, xa_find() silently
> returns that wrong pin and the subsequent ref_sync_set() operates on
> it. The request only fails when the given id is larger than every
> present key.
> 
> [...]

Here is the summary with links:
  - [net] dpll: use exact lookup for reference sync pin id
    https://git.kernel.org/netdev/net/c/7cce782d8327

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html