The new_port and del_port device attributes call nsim_drv_port_add() and
nsim_drv_port_del(), which fetch the driver private data with
dev_get_drvdata(). If the device has been unbound from the driver, that
private data is NULL and priv_to_devlink() turns it into a bogus pointer,
so a write to either attribute faults in devl_lock():
BUG: unable to handle page fault for address: fffffffffffffeb0
RIP: 0010:__lock_acquire
Call Trace:
...
nsim_drv_port_add
new_port_store
sriov_numvfs_store() already guards against this by taking device_lock()
and checking dev_get_drvdata(). Do the same in new_port_store() and
del_port_store(). Holding device_lock() also prevents the private data
from going away between the check and its use.
Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion")
Reported-by: <redacted>
Closes: https://syzkaller.appspot.com/bug?extid=b3fca27eb4005f0111f4
Signed-off-by: Shuai Liu <redacted>
---
Tested with the syzbot C reproducer on x86-64 QEMU using a KASAN +
lockdep kernel: without this patch the kernel panics in
nsim_drv_port_add() with a page fault at 0xffffffffffffef0; with it, the
write to new_port returns -ENOENT, the concurrent create/unbind/delete
race loop completes without a report, and adding/deleting a port on a
bound device still works.
AI assistance disclosure: the root-cause analysis and the draft patch
were produced with an AI coding assistant from the syzbot report; the
change was compiled, checkpatch-tested and runtime-verified as described
above.
---
drivers/net/netdevsim/bus.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
index b792ee10b1c1..abcd0f38d85c 100644
--- a/drivers/net/netdevsim/bus.c
+++ b/drivers/net/netdevsim/bus.c
@@ -93,8 +93,13 @@ new_port_store(struct device *dev, struct device_attribute *attr,
return -EINVAL;
}
- ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index,
- addr_set ? eth_addr : NULL);
+ device_lock(dev);
+ ret = -ENOENT;
+ if (dev_get_drvdata(dev))
+ ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+ port_index, addr_set ? eth_addr : NULL);
+ device_unlock(dev);
+
return ret ? ret : count;
}
@@ -115,7 +120,13 @@ del_port_store(struct device *dev, struct device_attribute *attr,
if (ret)
return ret;
- ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index);
+ device_lock(dev);
+ ret = -ENOENT;
+ if (dev_get_drvdata(dev))
+ ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+ port_index);
+ device_unlock(dev);
+
return ret ? ret : count;
}
--
2.53.0