[PATCH net] netdevsim: avoid NULL dereference after failed probe

[PATCH net] netdevsim: avoid NULL dereference after failed probe

[Jiacheng Xu]

device_register() reports whether device registration succeeded, not
whether the matching driver's probe succeeded. If nsim_drv_probe()
fails, the driver core leaves the nsim_bus_dev registered while the probe
error path clears its driver data.

new_device_store() subsequently marks the nsim_bus_dev initialized. A
write to its new_port or del_port attribute therefore passes the init
check and calls nsim_drv_port_add() or nsim_drv_port_del() with no valid
nsim_dev. Both helpers pass the NULL driver data to priv_to_devlink(),
leading to a NULL pointer dereference.

This can be reproduced by creating a netdevsim device for which
nsim_drv_probe() fails and then writing to the new_port or del_port
attribute of the registered device.

Serialize the driver data check and the port operation with the device
lock, and reject the operation with -ENODEV when no driver data is
present. This also prevents driver unbind from freeing nsim_dev between
the check and its use, and follows the locking used by sriov_numvfs.

Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion")
Cc: stable@vger.kernel.org
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
---
 drivers/net/netdevsim/bus.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
index 41483e371f05..0ab51306ad0a 100644
--- a/drivers/net/netdevsim/bus.c
+++ b/drivers/net/netdevsim/bus.c
@@ -93,8 +93,13 @@ new_port_store(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}
 
-	ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index,
-				addr_set ? eth_addr : NULL);
+	device_lock(dev);
+	if (!dev_get_drvdata(dev))
+		ret = -ENODEV;
+	else
+		ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+					port_index, addr_set ? eth_addr : NULL);
+	device_unlock(dev);
 	return ret ? ret : count;
 }
 
@@ -115,7 +120,13 @@ del_port_store(struct device *dev, struct device_attribute *attr,
 	if (ret)
 		return ret;
 
-	ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index);
+	device_lock(dev);
+	if (!dev_get_drvdata(dev))
+		ret = -ENODEV;
+	else
+		ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+					port_index);
+	device_unlock(dev);
 	return ret ? ret : count;
 }
 
-- 
2.25.1

Re: [PATCH net] netdevsim: avoid NULL dereference after failed probe

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] netdevsim: avoid NULL dereference after failed probe

[Hangbin Liu]

Hi Jiacheng,
On Mon, Oct 12, 2026 at 09:59:41PM +0800, Jiacheng Xu wrote:
> device_register() reports whether device registration succeeded, not
> whether the matching driver's probe succeeded. If nsim_drv_probe()
> fails, the driver core leaves the nsim_bus_dev registered while the probe
> error path clears its driver data.
> 
> new_device_store() subsequently marks the nsim_bus_dev initialized. A
> write to its new_port or del_port attribute therefore passes the init
> check and calls nsim_drv_port_add() or nsim_drv_port_del() with no valid
> nsim_dev. Both helpers pass the NULL driver data to priv_to_devlink(),
> leading to a NULL pointer dereference.
> 
> This can be reproduced by creating a netdevsim device for which
> nsim_drv_probe() fails and then writing to the new_port or del_port
> attribute of the registered device.
> 
> Serialize the driver data check and the port operation with the device
> lock, and reject the operation with -ENODEV when no driver data is
> present. This also prevents driver unbind from freeing nsim_dev between
> the check and its use, and follows the locking used by sriov_numvfs.
> 
> Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
> ---
>  drivers/net/netdevsim/bus.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
> index 41483e371f05..0ab51306ad0a 100644
> --- a/drivers/net/netdevsim/bus.c
> +++ b/drivers/net/netdevsim/bus.c
> @@ -93,8 +93,13 @@ new_port_store(struct device *dev, struct device_attribute *attr,
>  		return -EINVAL;
>  	}
>  
> -	ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index,
> -				addr_set ? eth_addr : NULL);
> +	device_lock(dev);
> +	if (!dev_get_drvdata(dev))
> +		ret = -ENODEV;
> +	else
> +		ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
> +					port_index, addr_set ? eth_addr : NULL);
> +	device_unlock(dev);
>  	return ret ? ret : count;
>  }
>  
> @@ -115,7 +120,13 @@ del_port_store(struct device *dev, struct device_attribute *attr,
>  	if (ret)
>  		return ret;
>  
> -	ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index);
> +	device_lock(dev);
> +	if (!dev_get_drvdata(dev))
> +		ret = -ENODEV;
> +	else
> +		ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
> +					port_index);
> +	device_unlock(dev);
>  	return ret ? ret : count;
>  }
>  

I remember you had a reproducer in v1 patch
https://lore.kernel.org/netdev/42315c2c.15f85.1a01853d723.Coremail.stitch@zju.edu.cn/

In v2 we talked about try unregister the device if failed. But looks not easy.
This patch only rebase to latest net tree. But no version tag and change log.

Over all, the code change looks good to me.

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>