Re: [syzbot] [net?] BUG: unable to handle kernel paging request in nsim_drv_port_add (2)

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 11/1/26 3:01 PM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    36aad21d50d1 Merge tag 'ksmbd-for-7.4-rc1-part2' of git://..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=1332b159580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=dc4462df6d1062fe
> dashboard link: https://syzkaller.appspot.com/bug?extid=b3fca27eb4005f0111f4
> compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1194b795580000
>
> AI-generated root cause summary:
> In netdevsim, sysfs device attributes such as 'new_port' and 'del_port' are
> exposed at the device level on nsim_bus_dev without holding device_lock or
> checking if the driver is bound. An access via sysfs after the driver has been
> unbound, after a failed probe, or concurrently with device removal finds drvdata
> set to NULL; passing this NULL pointer to priv_to_devlink() computes a negative
> offset from NULL, triggering a kernel page fault crash when attempting to
> acquire devlink->lock.
>
> full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=b3fca27eb4005f0111f4


This looks like the same issue Jiacheng's pending patch addresses,

new_port/del_port don't take device_lock nor check drvdata, so a write
after unbind hits a NULL nsim_dev:

https://lore.kernel.org/netdev/20261012135941.78329-1-stitch@zju.edu.cn/