Forwarded: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del

[syzbot <syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] netdevsim: fix use-after-free in __nsim_dev_port_del
Author: hrushirajg23@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

debugfs files created under a port's ddir (ethtool/get_err,
ethtool/set_err, ring params, bpf_offloaded_id, udp_ports/inject_error,
etc.) store raw pointers directly into the netdevsim struct, which lives
in the net_device private data kmalloc slab.

If these files outlive the netdevsim struct, a concurrent reader can
trigger a slab-use-after-free by passing debugfs_file_get() (which only
checks dentry lifetime) and then dereferencing the freed data pointer
in debugfs_u32_get().

In __nsim_dev_port_del(), nsim_destroy() is called before
nsim_dev_port_debugfs_exit(). However, nsim_destroy() calls free_netdev()
at its end, while nsim_dev_port_debugfs_exit() removes the port's
debugfs directory. This means the slab is freed before the debugfs
files are removed.

Fix by calling debugfs_remove_recursive(ns->nsim_dev_port->ddir) in
nsim_destroy() right before free_netdev(). This ensures all per-port
debugfs files are destroyed synchronously before the backing memory is
freed. The subsequent call to nsim_dev_port_debugfs_exit() in
__nsim_dev_port_del() becomes a harmless no-op.

Reported-by: syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9
Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com>
---
 drivers/net/netdevsim/netdev.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index a750768912b5..511139d65d69 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -1213,6 +1213,22 @@ void nsim_destroy(struct netdevsim *ns)
 		ns->page = NULL;
 	}
 
+	/*
+	 * Remove all per-port debugfs files before free_netdev() releases
+	 * the netdevsim struct. Files like ethtool/get_err, bpf_offloaded_id,
+	 * etc. store raw pointers into ns (netdev_priv data inside the
+	 * net_device slab). A concurrent reader with the file open could pass
+	 * debugfs_file_get() and then dereference freed memory if these files
+	 * outlive free_netdev(). debugfs_remove_recursive() on the parent ddir
+	 * handles this atomically; the subsequent nsim_dev_port_debugfs_exit()
+	 * call in __nsim_dev_port_del() becomes a harmless no-op.
+	 *
+	 * The three explicitly tracked dentries (vlan_dfs, qr_dfs, pp_dfs)
+	 * are children of ddir and are covered by the recursive removal below,
+	 * so their individual debugfs_remove() calls become no-ops too.
+	 */
+	debugfs_remove_recursive(ns->nsim_dev_port->ddir);
+
 	free_netdev(dev);
 }
 
-- 
2.47.3