CVE-2024-36002

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix dpllpinonpinregister() for multiple parent pins

In scenario where pin is registered with multiple parent pins via dpllpinonpinregister(..), all belonging to the same dpll device. A second call to dpllpinonpinunregister(..) would cause a call trace, as it tries to use already released registration resources (due to fix introduced in b446631f355e). In this scenario pin was registered twice, so resources are not yet expected to be release until each registered pin/pin pair is unregistered.

Currently, the following crash/call trace is produced when ice driver is removed on the system with installed E810T NIC which includes dpll device:

WARNING: CPU: 51 PID: 9155 at drivers/dpll/dpllcore.c:809 dpllpinops+0x20/0x30 RIP: 0010:dpllpin_ops+0x20/0x30 Call Trace: ? __warn+0x7f/0x130 ? dpllpinops+0x20/0x30 dpllmsgaddpinfreq+0x37/0x1d0 dpllcmdpingetone+0x1c0/0x400 ? __nlmsgput+0x63/0x80 dpllpineventsend+0x93/0x140 dpllpinonpinunregister+0x3f/0x100 icedplldeinitpins+0xa1/0x230 [ice] iceremove+0xf1/0x210 [ice]

Fix by adding a parent pointer as a cookie when creating a registration, also when searching for it. For the regular pins pass NULL, this allows to create separated registration for each parent the pin is registered with.