[PATCH net] netdevsim: delete ports added after a failed reload

[PATCH net] netdevsim: delete ports added after a failed reload

[Joas Antonio dos Santos]

When a devlink reload fails, nsim_dev_reload_down() has already torn
the device down through nsim_dev_reload_destroy(), and
nsim_dev_reload_destroy() returns early on every later call because
devlink_is_reload_failed() is set.  new_port still works in that state
though: nsim_drv_port_add() does not look at the reload state and adds
the port to nsim_dev->port_list.  Nothing ever deletes it.  When the
device is removed, nsim_drv_remove() destroys the BPF offload device
and frees the devlink instance while the port's netdev is still
registered:

  WARNING: kernel/bpf/offload.c:794 at bpf_offload_dev_destroy+0x50/0x78
   nsim_bpf_dev_exit+0x7c/0xbc
  WARNING: net/devlink/core.c:557 at devlink_free+0x30c/0x3ec

and the leftover netdev then points to freed memory.  Bringing it up
afterwards:

  BUG: KASAN: slab-use-after-free in devlink_bus_name+0xa0/0xac
  Read of size 8 at addr fff000001a313118 by task ip/120
   devlink_bus_name+0xa0/0xac
   devlink_nl_port_handle_size+0x38/0x80
   if_nlmsg_size+0x340/0x7a8
   rtmsg_ifinfo_build_skb+0x74/0x218
   rtmsg_ifinfo+0xa0/0x18c
   __dev_notify_flags+0x1d8/0x2f4
   netif_change_flags+0xe0/0x150
   dev_change_flags+0x8c/0x1e4
   devinet_ioctl+0x9c0/0x1360

A successful reload after the failed one has the same problem:
nsim_dev_reload_destroy() skips the ports again and
nsim_dev_reload_create() then reinitializes port_list over them.

The ports are the only thing that can be created after the failed
reload, so delete them on the early-return path too.  The port_list is
valid there: the failed reload emptied it with nsim_dev_port_del_all()
and nsim_dev_reload_up() fails before nsim_dev_reload_create().

Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload")
Reported-by: syzbot+88435e204734072bf39a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=88435e204734072bf39a
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
Assisted-by: Yaga Agent HackerSec Claude:claude-opus-5-5
---
Tested on net/main 94cea342e891 (arm64, QEMU, generic KASAN) with the
syzbot C reproducer (sets fail_reload, does a devlink reload, adds a
port with new_port, then del_device), followed by "ip link set <dev>
up" on any netdev left behind.  Without this patch both WARNINGs above
fire, the port's netdev survives del_device, and bringing it up gives
the KASAN report above (2 of 2 boots).  With it, 3 of 3 boots show no
WARNING or KASAN report and no netdev is left behind.
drivers/net/netdevsim/dev.o builds cleanly with W=1.  The
reload-after-failed-reload case was not tested separately.

 drivers/net/netdevsim/dev.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index feb88cc..a871790 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -1697,8 +1697,13 @@ static void nsim_dev_reload_destroy(struct nsim_dev *nsim_dev)
 {
 	struct devlink *devlink = priv_to_devlink(nsim_dev);
 
-	if (devlink_is_reload_failed(devlink))
+	if (devlink_is_reload_failed(devlink)) {
+		/* The failed reload already tore everything down, but ports
+		 * can still be added through new_port after that.
+		 */
+		nsim_dev_port_del_all(nsim_dev);
 		return;
+	}
 	debugfs_remove(nsim_dev->take_snapshot);
 
 	if (nsim_dev_get_vfs(nsim_dev)) {
-- 
2.39.5