The blamed commit introduced support for specifying individual lanes as
OF nodes in the device, and these can have status = "disabled".

When that happens, for_each_available_child_of_node() skips them and
lynx_28g_probe_lane() -> devm_phy_create() is not called, so lane->phy
will be NULL. Yet it will be dereferenced in lynx_28g_cdr_lock_check(),
resulting in a crash.

This used to be well handled in v3 of that patch:
https://lore.kernel.org/linux-phy/20250926180505.760089-14-vladimir.oltean@nxp.com/
but until v5 was merged, the logic to support per-lane OF nodes was
split into a separate change, and the per-SoC compatible strings patch
was deferred to a "part 2" set. The splitting was done improperly, and
that handling of NULL lane->phy pointers was not integrated into the
proper commit.

Fixes: 7df7d58abbd6 ("phy: lynx-28g: support individual lanes as OF PHY providers")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
---
This is a resend of patch 1/8 from:
https://patchwork.kernel.org/project/linux-phy/patch/20260114152111.625350-2-vladimir.oltean@nxp.com/
which was a fix for code which was in linux-phy/next at the time.

The merge window has passed, so it is now for linux-phy/fixes.

Note that further linux-phy/next changes depend on this, so please make
a note to merge 'fixes' into 'next' after the PR containing this gets
accepted.

Thanks!

 drivers/phy/freescale/phy-fsl-lynx-28g.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/phy/freescale/phy-fsl-lynx-28g.c b/drivers/phy/freescale/phy-fsl-lynx-28g.c
index 0fcc0354e76b..518720b61539 100644
--- a/drivers/phy/freescale/phy-fsl-lynx-28g.c
+++ b/drivers/phy/freescale/phy-fsl-lynx-28g.c
@@ -1069,6 +1069,8 @@ static void lynx_28g_cdr_lock_check(struct work_struct *work)
 
 	for (i = 0; i < LYNX_28G_NUM_LANE; i++) {
 		lane = &priv->lane[i];
+		if (!lane->phy)
+			continue;
 
 		mutex_lock(&lane->phy->mutex);
 
-- 
2.43.0

On Thu, 26 Feb 2026 20:28:53 +0200, Vladimir Oltean wrote:
> The blamed commit introduced support for specifying individual lanes as
> OF nodes in the device, and these can have status = "disabled".
> 
> When that happens, for_each_available_child_of_node() skips them and
> lynx_28g_probe_lane() -> devm_phy_create() is not called, so lane->phy
> will be NULL. Yet it will be dereferenced in lynx_28g_cdr_lock_check(),
> resulting in a crash.
> 
> [...]

Applied, thanks!

[1/1] phy: lynx-28g: skip CDR lock workaround for lanes disabled in the device tree
      commit: a258d843a3e4cb687da19437f8f81fee55ad7d35

Best regards,
-- 
~Vinod