[PATCH net] netdevsim: take device_lock in new_port and del_port sysfs handlers

[PATCH net] netdevsim: take device_lock in new_port and del_port sysfs handlers

[Ömer Mete Kaya]

new_port_store() and del_port_store() access the driver via
dev_get_drvdata() without holding device_lock() or checking for NULL.
The sysfs attributes are attached to the bus device type, so they
remain accessible after the driver is unbound.  Writing to new_port or
del_port after unbind causes a NULL dereference or use-after-free.

Protect both handlers with device_lock() and a NULL drvdata check,
matching the existing numvfs_store() pattern.

Discovered by Sashiko, not triggered, not runtime tested.

Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion")
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
 drivers/net/netdevsim/bus.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
index b792ee10b1c1..822651e00776 100644
--- a/drivers/net/netdevsim/bus.c
+++ b/drivers/net/netdevsim/bus.c
@@ -93,8 +93,14 @@ new_port_store(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}

-	ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index,
-				addr_set ? eth_addr : NULL);
+	device_lock(dev);
+	ret = -ENOENT;
+	if (dev_get_drvdata(dev))
+		ret = nsim_drv_port_add(nsim_bus_dev,
+					NSIM_DEV_PORT_TYPE_PF, port_index,
+					addr_set ? eth_addr : NULL);
+	device_unlock(dev);
+
 	return ret ? ret : count;
 }

@@ -115,7 +121,13 @@ del_port_store(struct device *dev, struct device_attribute *attr,
 	if (ret)
 		return ret;

-	ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index);
+	device_lock(dev);
+	ret = -ENOENT;
+	if (dev_get_drvdata(dev))
+		ret = nsim_drv_port_del(nsim_bus_dev,
+					NSIM_DEV_PORT_TYPE_PF, port_index);
+	device_unlock(dev);
+
 	return ret ? ret : count;
 }

--
2.56.0