* Forwarded: netdevsim: fix use-after-free in __nsim_dev_port_del
2026-06-17 18:35 [syzbot] [fs?] KASAN: slab-use-after-free Read in debugfs_u32_get (2) syzbot
@ 2026-06-18 7:40 ` syzbot
2026-06-18 8:51 ` Forwarded: Re: [syzbot] netdevsim fix syzbot
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-06-18 7:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: netdevsim: fix use-after-free in __nsim_dev_port_del
Author: hrushirajg23@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
From b3aa94bf5977395e788b457e3bb073c2b7f4580d Mon Sep 17 00:00:00 2001
From: Hrushiraj Gandhi <hrushirajg23@gmail.com>
Date: Thu, 18 Jun 2026 13:03:56 +0530
Subject: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
debugfs files created under a port's ddir (ethtool/get_err,
ethtool/set_err, ring params, bpf_offloaded_id, udp_ports/inject_error,
etc.) store raw pointers directly into the netdevsim struct, which lives
in the net_device private data kmalloc slab.
In __nsim_dev_port_del(), nsim_destroy() was called before
nsim_dev_port_debugfs_exit(), meaning free_netdev() freed the
netdevsim slab while debugfs files still held live pointers into it.
A concurrent reader with the file already open could pass
debugfs_file_get(), then dereference the freed pointer in
debugfs_u32_get(), triggering a slab-use-after-free.
Fix by calling nsim_dev_port_debugfs_exit() first, so
debugfs_remove_recursive() tears down the entire port ddir subtree
(invalidating all stale data pointers) before free_netdev() releases
the backing memory.
Reported-by: syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9
Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com>
---
drivers/net/netdevsim/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index f00fc2f9ebde..77417dd0f752 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -1544,8 +1544,8 @@ static void __nsim_dev_port_del(struct
nsim_dev_port *nsim_dev_port)
list_del(&nsim_dev_port->list);
if (nsim_dev_port_is_vf(nsim_dev_port))
devl_rate_leaf_destroy(&nsim_dev_port->devlink_port);
- nsim_destroy(nsim_dev_port->ns);
nsim_dev_port_debugfs_exit(nsim_dev_port);
+ nsim_destroy(nsim_dev_port->ns);
if (nsim_dev_port_is_pf(nsim_dev_port))
devl_port_resources_unregister(devlink_port);
devl_port_unregister(devlink_port);
--
2.47.3
^ permalink raw reply [flat|nested] 7+ messages in thread* Forwarded: Re: [syzbot] netdevsim fix
2026-06-17 18:35 [syzbot] [fs?] KASAN: slab-use-after-free Read in debugfs_u32_get (2) syzbot
2026-06-18 7:40 ` Forwarded: netdevsim: fix use-after-free in __nsim_dev_port_del syzbot
@ 2026-06-18 8:51 ` syzbot
2026-06-18 9:01 ` Forwarded: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del syzbot
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-06-18 8:51 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] netdevsim fix
Author: hrushirajg23@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index f00fc2f9ebde..77417dd0f752 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -1544,8 +1544,8 @@ static void __nsim_dev_port_del(struct
nsim_dev_port *nsim_dev_port)
list_del(&nsim_dev_port->list);
if (nsim_dev_port_is_vf(nsim_dev_port))
devl_rate_leaf_destroy(&nsim_dev_port->devlink_port);
- nsim_destroy(nsim_dev_port->ns);
nsim_dev_port_debugfs_exit(nsim_dev_port);
+ nsim_destroy(nsim_dev_port->ns);
if (nsim_dev_port_is_pf(nsim_dev_port))
devl_port_resources_unregister(devlink_port);
devl_port_unregister(devlink_port);
^ permalink raw reply [flat|nested] 7+ messages in thread* Forwarded: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
2026-06-17 18:35 [syzbot] [fs?] KASAN: slab-use-after-free Read in debugfs_u32_get (2) syzbot
2026-06-18 7:40 ` Forwarded: netdevsim: fix use-after-free in __nsim_dev_port_del syzbot
2026-06-18 8:51 ` Forwarded: Re: [syzbot] netdevsim fix syzbot
@ 2026-06-18 9:01 ` syzbot
2026-06-18 12:34 ` syzbot
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-06-18 9:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
Author: hrushirajg23@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
debugfs files created under a port's ddir (ethtool/get_err,
ethtool/set_err, ring params, bpf_offloaded_id, udp_ports/inject_error,
etc.) store raw pointers directly into the netdevsim struct, which lives
in the net_device private data kmalloc slab.
In __nsim_dev_port_del(), nsim_destroy() was called before
nsim_dev_port_debugfs_exit(), meaning free_netdev() freed the
netdevsim slab while debugfs files still held live pointers into it.
A concurrent reader with the file already open could pass
debugfs_file_get(), then dereference the freed pointer in
debugfs_u32_get(), triggering a slab-use-after-free.
Fix by calling nsim_dev_port_debugfs_exit() first, so
debugfs_remove_recursive() tears down the entire port ddir subtree
(invalidating all stale data pointers) before free_netdev() releases
the backing memory.
Reported-by: syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9
Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com>
---
drivers/net/netdevsim/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index f00fc2f9ebde..77417dd0f752 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -1544,8 +1544,8 @@ static void __nsim_dev_port_del(struct nsim_dev_port *nsim_dev_port)
list_del(&nsim_dev_port->list);
if (nsim_dev_port_is_vf(nsim_dev_port))
devl_rate_leaf_destroy(&nsim_dev_port->devlink_port);
- nsim_destroy(nsim_dev_port->ns);
nsim_dev_port_debugfs_exit(nsim_dev_port);
+ nsim_destroy(nsim_dev_port->ns);
if (nsim_dev_port_is_pf(nsim_dev_port))
devl_port_resources_unregister(devlink_port);
devl_port_unregister(devlink_port);
--
2.47.3
^ permalink raw reply [flat|nested] 7+ messages in thread* Forwarded: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
2026-06-17 18:35 [syzbot] [fs?] KASAN: slab-use-after-free Read in debugfs_u32_get (2) syzbot
` (2 preceding siblings ...)
2026-06-18 9:01 ` Forwarded: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del syzbot
@ 2026-06-18 12:34 ` syzbot
2026-06-18 13:12 ` syzbot
2026-06-27 5:17 ` Forwarded: [PATCH v3] netdevsim: fix use-after-free of ethtool debugfs data syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-06-18 12:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
Author: hrushirajg23@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
debugfs files created under a port's ddir (ethtool/get_err,
ethtool/set_err, ring params, bpf_offloaded_id, udp_ports/inject_error,
etc.) store raw pointers directly into the netdevsim struct, which lives
in the net_device private data kmalloc slab.
If these files outlive the netdevsim struct, a concurrent reader can
trigger a slab-use-after-free by passing debugfs_file_get() (which only
checks dentry lifetime) and then dereferencing the freed data pointer
in debugfs_u32_get().
In __nsim_dev_port_del(), nsim_destroy() is called before
nsim_dev_port_debugfs_exit(). However, nsim_destroy() calls free_netdev()
at its end, while nsim_dev_port_debugfs_exit() removes the port's
debugfs directory. This means the slab is freed before the debugfs
files are removed.
Fix by calling debugfs_remove_recursive(ns->nsim_dev_port->ddir) in
nsim_destroy() right before free_netdev(). This ensures all per-port
debugfs files are destroyed synchronously before the backing memory is
freed. The subsequent call to nsim_dev_port_debugfs_exit() in
__nsim_dev_port_del() becomes a harmless no-op.
Reported-by: syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9
Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com>
---
drivers/net/netdevsim/netdev.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index a750768912b5..511139d65d69 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -1213,6 +1213,22 @@ void nsim_destroy(struct netdevsim *ns)
ns->page = NULL;
}
+ /*
+ * Remove all per-port debugfs files before free_netdev() releases
+ * the netdevsim struct. Files like ethtool/get_err, bpf_offloaded_id,
+ * etc. store raw pointers into ns (netdev_priv data inside the
+ * net_device slab). A concurrent reader with the file open could pass
+ * debugfs_file_get() and then dereference freed memory if these files
+ * outlive free_netdev(). debugfs_remove_recursive() on the parent ddir
+ * handles this atomically; the subsequent nsim_dev_port_debugfs_exit()
+ * call in __nsim_dev_port_del() becomes a harmless no-op.
+ *
+ * The three explicitly tracked dentries (vlan_dfs, qr_dfs, pp_dfs)
+ * are children of ddir and are covered by the recursive removal below,
+ * so their individual debugfs_remove() calls become no-ops too.
+ */
+ debugfs_remove_recursive(ns->nsim_dev_port->ddir);
+
free_netdev(dev);
}
--
2.47.3
^ permalink raw reply [flat|nested] 7+ messages in thread* Forwarded: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
2026-06-17 18:35 [syzbot] [fs?] KASAN: slab-use-after-free Read in debugfs_u32_get (2) syzbot
` (3 preceding siblings ...)
2026-06-18 12:34 ` syzbot
@ 2026-06-18 13:12 ` syzbot
2026-06-27 5:17 ` Forwarded: [PATCH v3] netdevsim: fix use-after-free of ethtool debugfs data syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-06-18 13:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
Author: hrushirajg23@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
debugfs files created under a port's ddir (ethtool/get_err,
ethtool/set_err, ring params, bpf_offloaded_id, udp_ports/inject_error,
etc.) store raw pointers directly into the netdevsim struct, which lives
in the net_device private data kmalloc slab.
If these files outlive the netdevsim struct, a concurrent reader can
trigger a slab-use-after-free by passing debugfs_file_get() (which only
checks dentry lifetime) and then dereferencing the freed data pointer
in debugfs_u32_get().
In __nsim_dev_port_del(), nsim_destroy() is called before
nsim_dev_port_debugfs_exit(). However, nsim_destroy() calls free_netdev()
at its end, while nsim_dev_port_debugfs_exit() removes the port's
debugfs directory. This means the slab is freed before the debugfs
files are removed.
Fix by calling debugfs_remove_recursive(ns->nsim_dev_port->ddir) in
nsim_destroy() right before free_netdev(). This ensures all per-port
debugfs files are destroyed synchronously before the backing memory is
freed. The subsequent call to nsim_dev_port_debugfs_exit() in
__nsim_dev_port_del() becomes a harmless no-op.
Reported-by: syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9
Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com>
---
drivers/net/netdevsim/netdev.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index a750768912b5..e2d714673c2d 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -1213,6 +1213,23 @@ void nsim_destroy(struct netdevsim *ns)
ns->page = NULL;
}
+ /*
+ * Remove all per-port debugfs files before free_netdev() releases
+ * the netdevsim struct. Files like ethtool/get_err, bpf_offloaded_id,
+ * etc. store raw pointers into ns (netdev_priv data inside the
+ * net_device slab). A concurrent reader with the file open could pass
+ * debugfs_file_get() and then dereference freed memory if these files
+ * outlive free_netdev(). debugfs_remove_recursive() on the parent ddir
+ * handles this atomically; the subsequent nsim_dev_port_debugfs_exit()
+ * call in __nsim_dev_port_del() becomes a harmless no-op.
+ *
+ * The three explicitly tracked dentries (vlan_dfs, qr_dfs, pp_dfs)
+ * are children of ddir and are covered by the recursive removal below,
+ * so their individual debugfs_remove() calls become no-ops too.
+ */
+ debugfs_remove_recursive(ns->nsim_dev_port->ddir);
+ ns->nsim_dev_port->ddir = NULL;
+
free_netdev(dev);
}
--
2.47.3
^ permalink raw reply [flat|nested] 7+ messages in thread* Forwarded: [PATCH v3] netdevsim: fix use-after-free of ethtool debugfs data
2026-06-17 18:35 [syzbot] [fs?] KASAN: slab-use-after-free Read in debugfs_u32_get (2) syzbot
` (4 preceding siblings ...)
2026-06-18 13:12 ` syzbot
@ 2026-06-27 5:17 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-06-27 5:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH v3] netdevsim: fix use-after-free of ethtool debugfs data
Author: hrushirajg23@gmail.com
From: Hrushiraj Gandhi <hrushirajg23@gmail.com>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
debugfs files created by nsim_ethtool_init() store raw pointers
directly into the netdevsim struct, which lives in the net_device
private data kmalloc slab.
If the ethtool subdirectory outlives the netdevsim struct, a concurrent
reader can trigger a slab-use-after-free by passing debugfs_file_get()
(which only checks dentry lifetime) and then dereferencing the freed
data pointer in e.g. debugfs_u32_get().
In __nsim_dev_port_del(), nsim_destroy() is called before
nsim_dev_port_debugfs_exit(). nsim_destroy() ends with free_netdev(),
while nsim_dev_port_debugfs_exit() removes the port's debugfs directory
afterwards. This means the slab is freed before the ethtool debugfs
files that point into it are removed.
The same window exists on nsim_create()'s error path: nsim_ethtool_init()
creates debugfs files under ddir with pointers into ns before
nsim_init_netdevsim()/nsim_init_netdevsim_vf(), which can fail. The
err_free_netdev label then calls free_netdev() while those ethtool
debugfs entries are still live.
All other features that create per-port debugfs files (pp_hold,
queue_reset, vlan) already remove their own entries explicitly in
nsim_destroy() before free_netdev(). ethtool is the only one that does
not. Fix this by saving the ethtool dentry in struct nsim_ethtool and
calling debugfs_remove_recursive() on it before free_netdev() in both
nsim_destroy() and the nsim_create() error path. The port ddir teardown
is left to nsim_dev_port_debugfs_exit() as before.
Reported-by: syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9
Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com>
---
v3:
- Instead of removing the entire port ddir before free_netdev(), save
and remove only the ethtool dentry. All other features (pp_hold,
queue_reset, vlan) already clean up after themselves; ethtool is the
only exception. This aligns ethtool with how the other features
behave, as suggested by Jakub Kicinski.
v2:
- Also fix the same use-after-free window on the error path of
nsim_create() as suggested by Simon Horman.
- Shorten the code comment in nsim_destroy() to be more concise.
---
drivers/net/netdevsim/ethtool.c | 1 +
drivers/net/netdevsim/netdev.c | 9 +++++++++
drivers/net/netdevsim/netdevsim.h | 1 +
3 files changed, 11 insertions(+)
diff --git a/drivers/net/netdevsim/ethtool.c b/drivers/net/netdevsim/ethtool.c
index 9350ba48eb81..a465f3220a7c 100644
--- a/drivers/net/netdevsim/ethtool.c
+++ b/drivers/net/netdevsim/ethtool.c
@@ -252,6 +252,7 @@ void nsim_ethtool_init(struct netdevsim *ns)
ns->ethtool.channels = ns->nsim_bus_dev->num_queues;
ethtool = debugfs_create_dir("ethtool", ns->nsim_dev_port->ddir);
+ ns->ethtool.ddir = ethtool;
debugfs_create_u32("get_err", 0600, ethtool, &ns->ethtool.get_err);
debugfs_create_u32("set_err", 0600, ethtool, &ns->ethtool.set_err);
diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 27e5f109f933..09d86a591fac 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -1165,6 +1165,7 @@ struct netdevsim *nsim_create(struct nsim_dev *nsim_dev,
return ns;
err_free_netdev:
+ debugfs_remove_recursive(ns->ethtool.ddir);
free_netdev(dev);
return ERR_PTR(err);
}
@@ -1214,6 +1215,14 @@ void nsim_destroy(struct netdevsim *ns)
ns->page = NULL;
}
+ /*
+ * Remove the ethtool debugfs directory before free_netdev() releases
+ * the netdevsim struct to prevent use-after-free in concurrent readers.
+ * Other per-port debugfs files are already removed above, and the port
+ * ddir itself is cleaned up by nsim_dev_port_debugfs_exit().
+ */
+ debugfs_remove_recursive(ns->ethtool.ddir);
+
free_netdev(dev);
}
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 4c9cc96dcec3..c08a01af31e9 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -95,6 +95,7 @@ struct nsim_ethtool {
struct ethtool_coalesce coalesce;
struct ethtool_ringparam ring;
struct ethtool_fecparam fec;
+ struct dentry *ddir;
};
struct nsim_rq {
--
2.47.3
^ permalink raw reply [flat|nested] 7+ messages in thread