Re: [syzbot] [net?] WARNING: refcount bug in new_device_store

[Hillf Danton <hdanton@sina.com>]

> Date: Fri, 14 Aug 2026 04:06:24 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    2f1baf1fc892 Merge tag 'trace-v7.2-rc7' of git://git.kerne..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=170d8a25580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
> dashboard link: https://syzkaller.appspot.com/bug?extid=989ff6506f5c6d1ff56b
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=148d8a25580000

#syz test

--- x/drivers/net/netdevsim/bus.c
+++ y/drivers/net/netdevsim/bus.c
@@ -521,18 +521,18 @@ void nsim_bus_exit(void)
 {
 	struct nsim_bus_dev *nsim_bus_dev, *tmp;
 
+	mutex_lock(&nsim_bus_dev_list_lock);
 	/* Disallow using resources */
 	smp_store_release(&nsim_bus_enable, false);
-	if (refcount_dec_and_test(&nsim_bus_devs))
-		complete(&nsim_bus_devs_released);
 
-	mutex_lock(&nsim_bus_dev_list_lock);
 	list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) {
 		list_del(&nsim_bus_dev->list);
 		nsim_bus_dev_del(nsim_bus_dev);
 	}
 	mutex_unlock(&nsim_bus_dev_list_lock);
 
+	if (refcount_dec_and_test(&nsim_bus_devs))
+		complete(&nsim_bus_devs_released);
 	wait_for_completion(&nsim_bus_devs_released);
 
 	driver_unregister(&nsim_driver);
--