[PATCH net v2] netdevsim: avoid NULL dereference after failed probe

["Jiacheng Xu" <stitch@zju.edu.cn>]

device_register() reports whether device registration succeeded, not
whether the matching driver's probe succeeded. If nsim_drv_probe()
fails, the driver core leaves the nsim_bus_dev registered while the probe
error path clears its driver data.

new_device_store() subsequently marks the nsim_bus_dev initialized. A
write to its new_port or del_port attribute therefore passes the init
check and calls nsim_drv_port_add() or nsim_drv_port_del() with no valid
nsim_dev. Both helpers pass the NULL driver data to priv_to_devlink(),
leading to a NULL pointer dereference.

This can be reproduced by creating a netdevsim device for which
nsim_drv_probe() fails and then writing to the new_port or del_port
attribute of the registered device.

Serialize the driver data check and the port operation with the device
lock, and reject the operation with -ENODEV when no driver data is
present. This also prevents driver unbind from freeing nsim_dev between
the check and its use, and follows the locking used by sriov_numvfs.

Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion")
Cc: stable@vger.kernel.org
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
---
Changes in v2:
- Target the patch to the net tree.
- Remove the reproducer attachment and describe the trigger in the
  commit message.

drivers/net/netdevsim/bus.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
index 41483e371f05..0ab51306ad0a 100644
--- a/drivers/net/netdevsim/bus.c
+++ b/drivers/net/netdevsim/bus.c
@@ -93,8 +93,13 @@ new_port_store(struct device *dev, struct device_attribute *attr,
                return -EINVAL;
        }

-       ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index,
-                               addr_set ? eth_addr : NULL);
+       device_lock(dev);
+       if (!dev_get_drvdata(dev))
+               ret = -ENODEV;
+       else
+               ret = nsim_drv_port_add(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+                                       port_index, addr_set ? eth_addr : NULL);
+       device_unlock(dev);
        return ret ? ret : count;
 }

@@ -115,7 +120,13 @@ del_port_store(struct device *dev, struct device_attribute *attr,
        if (ret)
                return ret;

-       ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF, port_index);
+       device_lock(dev);
+       if (!dev_get_drvdata(dev))
+               ret = -ENODEV;
+       else
+               ret = nsim_drv_port_del(nsim_bus_dev, NSIM_DEV_PORT_TYPE_PF,
+                                       port_index);
+       device_unlock(dev);
        return ret ? ret : count;
 }

--
2.25.1