[PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[Ömer Mete Kaya]

nsim_drv_port_add() does not check devlink_is_reload_failed(), so ports
can be added via new_port after a failed reload.  nsim_dev_reload_destroy()
returns early in that state, leaving them behind.  nsim_drv_remove() then
hits WARN_ON in bpf_offload_dev_destroy() and a subsequent use-after-free.

Block port creation with -EIO when reload has failed, and delete any
leftover ports on the early-return path as a safety net.

Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload")
Reported-by: syzbot+88435e204734072bf39a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=88435e204734072bf39a
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
Tested with syzbot C reproducer.
v2: drop Cc:stable and target net-next.

 drivers/net/netdevsim/dev.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index feb88ccbbced..61f0824ce4d3 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -1697,8 +1697,10 @@ static void nsim_dev_reload_destroy(struct nsim_dev *nsim_dev)
 {
 	struct devlink *devlink = priv_to_devlink(nsim_dev);

-	if (devlink_is_reload_failed(devlink))
+	if (devlink_is_reload_failed(devlink)) {
+		nsim_dev_port_del_all(nsim_dev);
 		return;
+	}
 	debugfs_remove(nsim_dev->take_snapshot);

 	if (nsim_dev_get_vfs(nsim_dev)) {
@@ -1758,7 +1760,9 @@ int nsim_drv_port_add(struct nsim_bus_dev *nsim_bus_dev, enum nsim_dev_port_type
 	int err;

 	devl_lock(priv_to_devlink(nsim_dev));
-	if (__nsim_dev_port_lookup(nsim_dev, type, port_index))
+	if (devlink_is_reload_failed(priv_to_devlink(nsim_dev)))
+		err = -EIO;
+	else if (__nsim_dev_port_lookup(nsim_dev, type, port_index))
 		err = -EEXIST;
 	else
 		err = __nsim_dev_port_add(nsim_dev, type, port_index, perm_addr);
--
2.56.0

Re: [PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[Mina Almasry]

On Thu, Oct 29, 2026 at 5:15 PM Ömer Mete Kaya <omermetekaya0@gmail.com> wrote:
>
> nsim_drv_port_add() does not check devlink_is_reload_failed(), so ports
> can be added via new_port after a failed reload.  nsim_dev_reload_destroy()
> returns early in that state, leaving them behind.  nsim_drv_remove() then
> hits WARN_ON in bpf_offload_dev_destroy() and a subsequent use-after-free.
>
> Block port creation with -EIO when reload has failed, and delete any
> leftover ports on the early-return path as a safety net.
>
> Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload")
> Reported-by: syzbot+88435e204734072bf39a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=88435e204734072bf39a
> Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>

I'm so sorry, I don't think I was clear. Currently net-next is closed.
I should have said wait until net-next re-opens and THEN send your
fix:

https://netdev.bots.linux.dev/net-next.html

And yes, normally fixes go to net, but the volume of fixes has been so
large that non-critcal fixes now go to net-next.

Let me try this:

pw-bot: defer


-- 
Thanks,
Mina

Re: [PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[Ömer Mete Kaya]

> I'm so sorry, I don't think I was clear. Currently net-next is closed.
> I should have said wait until net-next re-opens and THEN send your
> fix:
> 
> https://netdev.bots.linux.dev/net-next.html
> 
> And yes, normally fixes go to net, but the volume of fixes has been so
> large that non-critcal fixes now go to net-next.
> 
> Let me try this:
> 
> pw-bot: defer
> 
> 
Hi Mina,

Apologies for taking up your time; I will resend it after November 9th.

Thanks,
Ömer

Re: [PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[Hangbin Liu]

Hi, 
On Fri, Oct 30, 2026 at 03:13:20AM +0300, Ömer Mete Kaya wrote:
> nsim_drv_port_add() does not check devlink_is_reload_failed(), so ports
> can be added via new_port after a failed reload.  nsim_dev_reload_destroy()
> returns early in that state, leaving them behind.  nsim_drv_remove() then
> hits WARN_ON in bpf_offload_dev_destroy() and a subsequent use-after-free.
> 
> Block port creation with -EIO when reload has failed, and delete any
> leftover ports on the early-return path as a safety net.
> 
> Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload")
> Reported-by: syzbot+88435e204734072bf39a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=88435e204734072bf39a
> Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>

Looks Joas has a same issue fix with yours a few hour earlier.

https://lore.kernel.org/netdev/179324296598.34505.11070163314749859668@gmail.com/

> ---
> Tested with syzbot C reproducer.
> v2: drop Cc:stable and target net-next.
> 
>  drivers/net/netdevsim/dev.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
> index feb88ccbbced..61f0824ce4d3 100644
> --- a/drivers/net/netdevsim/dev.c
> +++ b/drivers/net/netdevsim/dev.c
> @@ -1697,8 +1697,10 @@ static void nsim_dev_reload_destroy(struct nsim_dev *nsim_dev)
>  {
>  	struct devlink *devlink = priv_to_devlink(nsim_dev);
> 
> -	if (devlink_is_reload_failed(devlink))
> +	if (devlink_is_reload_failed(devlink)) {
> +		nsim_dev_port_del_all(nsim_dev);
>  		return;
> +	}
>  	debugfs_remove(nsim_dev->take_snapshot);
> 
>  	if (nsim_dev_get_vfs(nsim_dev)) {
> @@ -1758,7 +1760,9 @@ int nsim_drv_port_add(struct nsim_bus_dev *nsim_bus_dev, enum nsim_dev_port_type
>  	int err;
> 
>  	devl_lock(priv_to_devlink(nsim_dev));
> -	if (__nsim_dev_port_lookup(nsim_dev, type, port_index))
> +	if (devlink_is_reload_failed(priv_to_devlink(nsim_dev)))
> +		err = -EIO;
> +	else if (__nsim_dev_port_lookup(nsim_dev, type, port_index))
>  		err = -EEXIST;
>  	else
>  		err = __nsim_dev_port_add(nsim_dev, type, port_index, perm_addr);


But yours have an extra guard in nsim_drv_port_add...

Leave this to Jakub decide...

Thanks
Hangbin

Re: [PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[Mina Almasry]

On Fri, Oct 30, 2026 at 2:05 AM Hangbin Liu <hangbin.liu@linux.dev> wrote:
>
> Looks Joas has a same issue fix with yours a few hour earlier.
>
> https://lore.kernel.org/netdev/179324296598.34505.11070163314749859668@gmail.com/
>
> > ---
> > Tested with syzbot C reproducer.
> > v2: drop Cc:stable and target net-next.
...
> But yours have an extra guard in nsim_drv_port_add...
>
> Leave this to Jakub decide...

I prefer Ömer's version. Once reload_down has torn down the device and
reload_up has failed, the device is in an uninitialized state, so
rejecting new_port in nsim_drv_port_add() makes more sense than
allowing ports/netdevs to be registered on a half-torn-down nsim_dev
and only cleaning them up later.

-- 
Thanks,
Mina

Re: [PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[Hangbin Liu]

On Fri, Oct 30, 2026 at 06:42:45AM +0000, Mina Almasry wrote:
> On Fri, Oct 30, 2026 at 2:05 AM Hangbin Liu <hangbin.liu@linux.dev> wrote:
> >
> > Looks Joas has a same issue fix with yours a few hour earlier.
> >
> > https://lore.kernel.org/netdev/179324296598.34505.11070163314749859668@gmail.com/
> >
> > > ---
> > > Tested with syzbot C reproducer.
> > > v2: drop Cc:stable and target net-next.
> ...
> > But yours have an extra guard in nsim_drv_port_add...
> >
> > Leave this to Jakub decide...
> 
> I prefer Ömer's version. Once reload_down has torn down the device and
> reload_up has failed, the device is in an uninitialized state, so
> rejecting new_port in nsim_drv_port_add() makes more sense than
> allowing ports/netdevs to be registered on a half-torn-down nsim_dev
> and only cleaning them up later.

+1

Thanks
Hangbin

Re: [PATCH net-next v2] netdevsim: reject port addition and clean up ports after a failed reload

[Joas Antonio dos Santos]

On Fri, Oct 30, 2026, Ömer Mete Kaya wrote:
> nsim_drv_port_add() does not check devlink_is_reload_failed(), so ports
> can be added via new_port after a failed reload.

I sent a fix for the same syzbot report a bit earlier, which only
deleted the leftover ports in nsim_dev_reload_destroy().  Rejecting
new_port once the reload has failed is the better fix, so please take
this one and drop mine.

I tested this patch on net/main (94cea342e891) on arm64 QEMU with KASAN,
running the syzbot C reproducer.  Without a fix it hits the WARNING in
bpf_offload_dev_destroy() and then a slab-use-after-free in
devlink_bus_name() through the leftover netdev; with this patch there
is no warning or KASAN report in 3 runs.

Tested-by: Joas Antonio dos Santos <joasantonio108@gmail.com>