Re: [PATCH RFC] netdevsim: remove debugfs files before freeing netdev

Should we explicitly save the debugfs folder pointer and call
debugfs_remove_recursive on nsim_destroy?
Cleanup should be symmetrical to resource creation.

On Fri, Jun 19, 2026 at 11:16 AM 'syzbot' via
syzkaller-upstream-moderation
<[email protected]> wrote:
>
> A KASAN slab-use-after-free bug was detected in debugfs_u32_get(). The root
> cause is a race condition between the destruction of a netdevsim port and
> the cleanup of its associated debugfs files.
>
> When a netdevsim port is destroyed, the teardown happens in
> __nsim_dev_port_del(), which first calls nsim_destroy() and then
> nsim_dev_port_debugfs_exit(). nsim_destroy() eventually calls
> free_netdev(), which frees the struct netdevsim memory. However, the
> debugfs files pointing to fields inside this struct are only removed later
> in nsim_dev_port_debugfs_exit(). This creates a use-after-free window where
> a user space program can access the freed memory by reading from the
> debugfs files. The same issue exists in the error path of nsim_create().
>
> To fix this, ensure that the debugfs directory nsim_dev_port->ddir is
> recursively removed before the struct netdevsim memory is freed. Move the
> debugfs_remove_recursive() call to the beginning of nsim_destroy() and the
> error path of nsim_create(). Set nsim_dev_port->ddir to NULL to make the
> subsequent call to nsim_dev_port_debugfs_exit() a safe no-op. Finally,
> remove redundant debugfs_remove() calls for individual files and
> subdirectories, as they are now handled by the recursive removal.
>
> BUG: KASAN: slab-use-after-free in debugfs_u32_get+0x6c/0x70
> fs/debugfs/file.c:657
> Read of size 4 at addr ffff88810cd6db00 by task syz.3.8220/23584
>
> Call Trace:
>  debugfs_u32_get+0x6c/0x70 fs/debugfs/file.c:657
>  simple_attr_read+0x227/0x490 fs/libfs.c:1368
>  debugfs_attr_read+0x76/0x130 fs/debugfs/file.c:523
>  vfs_read+0x213/0xa80 fs/read_write.c:572
>  ksys_read+0x150/0x270 fs/read_write.c:717
>
> Freed by task 22896:
>  kfree+0x1c5/0x640 mm/slub.c:6566
>  device_release+0xc4/0x1f0 drivers/base/core.c:-1
>  kobject_cleanup lib/kobject.c:689 [inline]
>  kobject_release lib/kobject.c:720 [inline]
>  kref_put include/linux/kref.h:65 [inline]
>  kobject_put+0x222/0x550 lib/kobject.c:737
>  __nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
>  nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
>  nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
>
> Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
> Assisted-by: Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9
> Link: https://syzkaller.appspot.com/ai_job?id=b0e49fe8-9a07-4af6-b52c-12fa3167dd55
> To: "Andrew Lunn" <[email protected]>
> To: "David S. Miller" <[email protected]>
> To: "Eric Dumazet" <[email protected]>
> To: "Jakub Kicinski" <[email protected]>
> To: <[email protected]>
> To: "Paolo Abeni" <[email protected]>
> Cc: <[email protected]>
>
> ---
> diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
> index f00fc2f9e..3a79cef66 100644
> --- a/drivers/net/netdevsim/dev.c
> +++ b/drivers/net/netdevsim/dev.c
> @@ -442,6 +442,7 @@ static int nsim_dev_port_debugfs_init(struct nsim_dev *nsim_dev,
>  static void nsim_dev_port_debugfs_exit(struct nsim_dev_port *nsim_dev_port)
>  {
>         debugfs_remove_recursive(nsim_dev_port->ddir);
> +       nsim_dev_port->ddir = NULL;
>  }
>
>  static int nsim_dev_resources_register(struct devlink *devlink)
> diff --git a/drivers/net/netdevsim/ipsec.c b/drivers/net/netdevsim/ipsec.c
> index 36a1be492..0bc9f42a5 100644
> --- a/drivers/net/netdevsim/ipsec.c
> +++ b/drivers/net/netdevsim/ipsec.c
> @@ -292,5 +292,4 @@ void nsim_ipsec_teardown(struct netdevsim *ns)
>         if (ipsec->count)
>                 netdev_err(ns->netdev, "tearing down IPsec offload with %d SAs left\n",
>                            ipsec->count);
> -       debugfs_remove_recursive(ipsec->pfile);
>  }
> diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> index a75076891..91e92456f 100644
> --- a/drivers/net/netdevsim/netdev.c
> +++ b/drivers/net/netdevsim/netdev.c
> @@ -1164,6 +1164,8 @@ struct netdevsim *nsim_create(struct nsim_dev *nsim_dev,
>         return ns;
>
>  err_free_netdev:
> +       debugfs_remove_recursive(nsim_dev_port->ddir);
> +       nsim_dev_port->ddir = NULL;
>         free_netdev(dev);
>         return ERR_PTR(err);
>  }
> @@ -1174,9 +1176,8 @@ void nsim_destroy(struct netdevsim *ns)
>         struct netdevsim *peer;
>         u16 vid;
>
> -       debugfs_remove(ns->vlan_dfs);
> -       debugfs_remove(ns->qr_dfs);
> -       debugfs_remove(ns->pp_dfs);
> +       debugfs_remove_recursive(ns->nsim_dev_port->ddir);
> +       ns->nsim_dev_port->ddir = NULL;
>
>         if (ns->nb.notifier_call)
>                 unregister_netdevice_notifier_dev_net(ns->netdev, &ns->nb,
> diff --git a/drivers/net/netdevsim/psp.c b/drivers/net/netdevsim/psp.c
> index 6936ecb81..2f27a2114 100644
> --- a/drivers/net/netdevsim/psp.c
> +++ b/drivers/net/netdevsim/psp.c
> @@ -227,7 +227,6 @@ static void __nsim_psp_uninit(struct netdevsim *ns, bool teardown)
>
>  void nsim_psp_uninit(struct netdevsim *ns)
>  {
> -       debugfs_remove(ns->psp.rereg);
>         mutex_destroy(&ns->psp.rereg_lock);
>         __nsim_psp_uninit(ns, true);
>  }
> diff --git a/drivers/net/netdevsim/udp_tunnels.c b/drivers/net/netdevsim/udp_tunnels.c
> index 89fff76e5..e9cdfe817 100644
> --- a/drivers/net/netdevsim/udp_tunnels.c
> +++ b/drivers/net/netdevsim/udp_tunnels.c
> @@ -190,7 +190,6 @@ void nsim_udp_tunnels_info_destroy(struct net_device *dev)
>  {
>         struct netdevsim *ns = netdev_priv(dev);
>
> -       debugfs_remove_recursive(ns->udp_ports.ddir);
>         kfree(dev->udp_tunnel_nic_info);
>         dev->udp_tunnel_nic_info = NULL;
>  }
>
>
> base-commit: 8cd9520d35a6c38db6567e97dd93b1f11f185dc6
> --
> This is an AI-generated patch subject to moderation.
> Reply with '#syz upstream' to Sign-off the patch as a human author
> and send it to the upstream kernel mailing lists.
> Reply with '#syz reject' to reject it ('#syz unreject' to undo).
>
> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
> You can comment on the patch as usual, syzbot will try to address
> the comments and send a new version of the patch if necessary.
> syzbot engineers can be reached at [email protected].
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/b2de6fa2-bc67-45a6-abb0-35868b40b0da%40mail.kernel.org.