netdevsim: take bus device refcount before registering device

Browse source

nsim_bus_dev_release() drops nsim_bus_devs when a device is freed, but
the matching increment was done in new_device_store() after
nsim_bus_dev_new() returned.  When device_register() failed inside
nsim_bus_dev_new(), put_device() invoked the release callback and
decremented without an increment, driving the refcount to zero; a later
creation then incremented from zero (refcount_t: addition on 0).

Increment nsim_bus_devs in nsim_bus_dev_new() before device_register(),
and drop the bus reference in nsim_bus_exit() only after every device has
been removed, so the completion cannot be signaled early.

Cc: stable+noautosel@kernel.org # netdevsim is a test harness, it's never loaded on production systems
Reported-by: syzbot+989ff6506f5c6d1ff56b@syzkaller.appspot.com
Closes: https://syzkaller.appspot.com/bug?extid=989ff6506f5c6d1ff56b
Signed-off-by: Adriano Cordova <adrianox@gmail.com>
Link: https://patch.msgid.link/20260902025704.34606-1-adrianox@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Adriano Cordova 2026-09-01 22:57:04 -04:00 • committed by Jakub Kicinski

parent a5249d1d9a

commit d5f5853f16

1 changed files with 4 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/net/netdevsim/bus.c

View file