[PATCH] netdevsim: fix NULL deref in port attrs after unbind

[PATCH] netdevsim: fix NULL deref in port attrs after unbind

[Shuai Liu]

The new_port and del_port device attributes call nsim_drv_port_add() and
nsim_drv_port_del(), which fetch the driver private data with
dev_get_drvdata().  If the device has been unbound from the driver, that
private data is NULL and priv_to_devlink() turns it into a bogus pointer,
so a write to either attribute faults in devl_lock():

  BUG: unable to handle page fault for address: fffffffffffffeb0
  RIP: 0010:__lock_acquire
  Call Trace:
   ...
   nsim_drv_port_add
   new_port_store

sriov_numvfs_store() already guards against this by taking device_lock()
and checking dev_get_drvdata().  Do the same in new_port_store() and
del_port_store().  Holding device_lock() also prevents the private data
from going away between the check and its use.

Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion")
Reported-by: syzbot+b3fca27eb4005f0111f4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b3fca27eb4005f0111f4
Signed-off-by: Shuai Liu <847807867@qq.com>
---
Tested with the syzbot C reproducer on x86-64 QEMU using a KASAN +
lockdep kernel: without this patch the kernel panics in
nsim_drv_port_add() with a page fault at 0xffffffffffffef0; with it, the
write to new_port returns -ENOENT, the concurrent create/unbind/delete
race loop completes without a report, and adding/deleting a port on a
bound device still works.

AI assistance disclosure: the root-cause analysis and the draft patch
were produced with an AI coding assistant from the syzbot report; the
change was compiled, checkpatch-tested and runtime-verified as described
above.
---
 drivers/net/netdevsim/bus.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
index b792ee10b1c1..abcd0f38d85c 100644
--- a/drivers/net/netdevsim/bus.c
+++ b/drivers/net/netdevsim/bus.c
@@ -93,8 +93,13 @@ new_port_store(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}
 
-	ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index,
-				addr_set ? eth_addr : NULL);
+	device_lock(dev);
+	ret = -ENOENT;
+	if (dev_get_drvdata(dev))
+		ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+					port_index, addr_set ? eth_addr : NULL);
+	device_unlock(dev);
+
 	return ret ? ret : count;
 }
 
@@ -115,7 +120,13 @@ del_port_store(struct device *dev, struct device_attribute *attr,
 	if (ret)
 		return ret;
 
-	ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index);
+	device_lock(dev);
+	ret = -ENOENT;
+	if (dev_get_drvdata(dev))
+		ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+					port_index);
+	device_unlock(dev);
+
 	return ret ? ret : count;
 }
 
-- 
2.53.0