Re: [PATCH RFC v2] netdevsim: fix UAF by explicitly cleaning up debugfs files

Would swapping the teardown order (nsim_dev_port_debugfs_exit,
nsim_destroy) help make the patch simpler?

On Fri, Jun 19, 2026 at 4:21 PM syzbot <[email protected]> wrote:
>
> > Why `debugfs_lookup_and_remove("ethtool", ns->nsim_dev_port->ddir);`
> > was not enough?
> The BPF debugfs files are created directly in the port directory
> (`ns->nsim_dev_port->ddir`), rather than in a dedicated BPF
> subdirectory. Because the port directory itself isn't removed until
> later in `nsim_dev_port_debugfs_exit()`, we have to explicitly remove
> these individual BPF files here to close the use-after-free window.
> Removing the "ethtool" directory only cleans up the ethtool-related
> files, leaving the BPF files vulnerable.
>
> --
> This reply was generated by an AI model.
> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
> syzbot engineers can be reached at [email protected].