From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=91.218.175.12 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794187116; b=Jews36gy3HnP/Nvi+ZNLAn362cAvdiyTe/p+6xpnui9P7Fo/t0GqoLRSI4YTfuo2wC/f KPt72NuHoUxeKn48YnKI6MjuHmzA0+sEz0XtCRdvfA7xzVnzoLp8AF2h5U1ccOTzwwuby S9RkoqcCTVW/03zmgY/pW4FxZQBW0npURI75u/bg+7nsrbLEEz1/e+8bGHseuHBpr88B3 AvZ3oOkkkBY1FjCDMTy7IKRAjHJqrW+xtB1mvBcEvZNfPdTF3Zw0NSHErjn+KGZDm2+bG nxG1pOcK2DmgUNIQgeYkEA2HGaZ45RevOFRmZzvoMN0dphAjM6XpvltqmmzwCHoDUoQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794187116; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:Date:From:To:Cc:Subject:Message-ID: References:MIME-Version:Content-Type:Content-Disposition: Content-Transfer-Encoding:In-Reply-To; bh=xPeztD9jupX4eVwTVUeTKAoTPh5ugz27mamWsCNiAPk=; b=AzKu+quOmWcOE4ZFC/MooeNTHJpeiCn6IGK7SBUyGAwjbkRETPiEQBcLq2jGCNxhJJ4b QjBgMCU607fYLv2JZNVCohMBUteU07Uf1XXpvTvd0q8QogGQaWP9x4Oesc77NFZZUcSH+ ScQPw1orhwKCjLwvrMx3/upPyXCk6BoE8j6QE9Y2YR1SQ2NVP8EqAK7CoIRO7Rz5fzYCt VvThz8DITswSNTzHp/4q/cd3Z2JnimJh6yfVcQcyHl9kYXaNvkw/mPHcBHicaS+G56YoQ VB0Jz+J7GVutUT6Wu71c/lBJmYGOY/TkhqT9K6P1RAhJ/m4ttC+PPnmX299yJC8ykGw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=iAWQjwsz; arc=none smtp.remote-ip=91.218.175.12 Received: from mta0.migadu.com (out-12.mta0.migadu.com [91.218.175.12]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F776606A322 for ; Mon, 9 Nov 2026 01:18:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 2F776606A322 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=iAWQjwsz X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=clTj9343lRLL07YsOYeNovaP17CXMps+FdlXaphuSNA=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1794187101; v=1; x=1794791901; b=iAWQjwszyGQARCy6cQPq1IU+KVGUWAM8zhlEowA5+N9o7GfY41XiWB6GQ6JTbc3wXCcoheR2 ZTOs1D9GyMnoLa92K8CDlA5zp3rG4rolGLYFviBcS0t5rD75FjxmDQiJhsdGCoDBIT7NvopdfMg IEsO35ekf7Cd+VT7aeEb8zUI= X-Envelope-To: linux-kernel@vger.kernel.org Received: by mta10.migadu.com with ESMTPS id 7e66af7b63cab7ae; Mon, 09 Nov 2026 01:18:20 +0000 X-Mizu-Trace-ID: 7e66af7b63cab7ae X-Migadu-Flow: FLOW_OUT Date: Mon, 9 Nov 2026 09:18:05 +0800 From: Hangbin Liu To: Nguyen Ngoc Thang , Jiacheng Xu , Shuai Liu <847807867@qq.com>, =?iso-8859-1?Q?=D6mer?= Mete Kaya Cc: kuba@kernel.org, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+b3fca27eb4005f0111f4@syzkaller.appspotmail.com Subject: Re: [PATCH net] netdevsim: check the driver is bound in new_port/del_port Message-ID: References: <20261101135824.24484-1-ngocthang2710.1999@gmail.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20261101135824.24484-1-ngocthang2710.1999@gmail.com> On Sun, Nov 01, 2026 at 08:58:24PM +0700, Nguyen Ngoc Thang wrote: > new_port and del_port are attributes of the bus device, so they stay > reachable after the driver is unbound. nsim_drv_remove() clears > drvdata, yet both handlers pass it straight to priv_to_devlink() and > devl_lock(), which faults on a small negative pointer: > > BUG: unable to handle page fault for address: fffffffffffffeb0 > RIP: 0010:__lock_acquire+0x41/0x2de0 kernel/locking/lockdep.c:5140 > Call Trace: > lock_acquire+0x115/0x350 > mutex_lock_nested+0x55/0x1d0 > nsim_drv_port_add+0x5a/0x140 drivers/net/netdevsim/dev.c:1760 > new_port_store+0x1a5/0x280 drivers/net/netdevsim/bus.c:96 > kernfs_fop_write_iter+0x3a5/0x540 > > The nsim_bus_dev->init check does not help: it is only cleared when > the whole device is deleted, not on unbind. > > Do what sriov_numvfs already does: take device_lock() so the driver > cannot be unbound underneath us, and return -ENOENT if drvdata is > NULL. > > Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion") > Reported-by: syzbot+b3fca27eb4005f0111f4@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=b3fca27eb4005f0111f4 > Signed-off-by: Nguyen Ngoc Thang > --- > Reproduced in QEMU (x86_64, KASAN + lockdep) with the syzbot C repro: > the unpatched kernel oopses in nsim_drv_port_add() right after unbind. > With the patch, the write to new_port returns -ENOENT, a 40s stress of > bind/unbind + new_device/del_device racing with new_port/del_port/ > sriov_numvfs runs clean (no splat, no lockdep report, no hung task), > and new_port/del_port still work as before on a bound device. > drivers/net/netdevsim/bus.c | 17 ++++++++++++++--- > 1 file changed, 14 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c > index 5c55c308487b..d843b3c985cf 100644 > --- a/drivers/net/netdevsim/bus.c > +++ b/drivers/net/netdevsim/bus.c > @@ -93,8 +93,13 @@ new_port_store(struct device *dev, struct device_attribute *attr, > return -EINVAL; > } > > - ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index, > - addr_set ? eth_addr : NULL); > + device_lock(dev); > + ret = -ENOENT; > + if (dev_get_drvdata(dev)) > + ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, > + port_index, addr_set ? eth_addr : NULL); > + device_unlock(dev); > + > return ret ? ret : count; > } > > @@ -115,7 +120,13 @@ del_port_store(struct device *dev, struct device_attribute *attr, > if (ret) > return ret; > > - ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index); > + device_lock(dev); > + ret = -ENOENT; > + if (dev_get_drvdata(dev)) > + ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, > + port_index); > + device_unlock(dev); > + > return ret ? ret : count; > } > > -- > 2.43.0 > There are three identical fixes (author cc'ed) following Jiacheng’s patch [1]. I’m not sure whether there were others before that. I notified Jiacheng and Nguyen on Nov 2, but Jiacheng hasn’t reposted his patch. To prevent further duplicate fixes from landing on netdev, I’d prefer to ack Nguyen’s patch, since it is the earliest one that includes test information. [1] https://lore.kernel.org/netdev/4fe1dcd1.16124.1a01a660a42.Coremail.stitch@zju.edu.cn/ Reviewed-by: Hangbin Liu