[PATCH net] netdevsim: reject port addition and clean up ports after a failed reload
flat view
WARM2d
From: Ömer Mete Kaya <hidden>
Date: 2026-10-29 14:59:01
Also in:
lkml, stable
Subsystem:
netdevsim, networking drivers, the rest · Maintainers:
Jakub Kicinski, Andrew Lunn, "David S. Miller", Eric Dumazet, Paolo Abeni, Linus Torvalds
nsim_drv_port_add() does not check devlink_is_reload_failed(), so ports can be added via new_port after a failed reload. nsim_dev_reload_destroy() returns early in that state, leaving them behind. nsim_drv_remove() then hits WARN_ON in bpf_offload_dev_destroy() and a subsequent use-after-free. Block port creation with -EIO when reload has failed, and delete any leftover ports on the early-return path as a safety net. Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload") Reported-by: <redacted> Closes: https://syzkaller.appspot.com/bug?extid=88435e204734072bf39a Cc: <redacted> Signed-off-by: Ömer Mete Kaya <redacted> --- Tested with syzbot C reproducer. drivers/net/netdevsim/dev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index feb88ccbbced..61f0824ce4d3 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c@@ -1697,8 +1697,10 @@ static void nsim_dev_reload_destroy(struct nsim_dev *nsim_dev) { struct devlink *devlink = priv_to_devlink(nsim_dev); - if (devlink_is_reload_failed(devlink)) + if (devlink_is_reload_failed(devlink)) { + nsim_dev_port_del_all(nsim_dev); return; + } debugfs_remove(nsim_dev->take_snapshot); if (nsim_dev_get_vfs(nsim_dev)) {
@@ -1758,7 +1760,9 @@ int nsim_drv_port_add(struct nsim_bus_dev *nsim_bus_dev, enum nsim_dev_port_type int err; devl_lock(priv_to_devlink(nsim_dev)); - if (__nsim_dev_port_lookup(nsim_dev, type, port_index)) + if (devlink_is_reload_failed(priv_to_devlink(nsim_dev))) + err = -EIO; + else if (__nsim_dev_port_lookup(nsim_dev, type, port_index)) err = -EEXIST; else err = __nsim_dev_port_add(nsim_dev, type, port_index, perm_addr); --
2.56.0