CVE-2025-40251

In the Linux kernel, the following vulnerability has been resolved:

devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

The function devl_rate_nodes_destroy is documented to "Unset parent for

all rate objects". However, it was only calling the driver-specific

`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing

the parent's refcount, without actually setting the

`devlink_rate->parent` pointer to NULL.

This leaves a dangling pointer in the `devlink_rate` struct, which cause

refcount error in netdevsim[1] and mlx5[2]. In addition, this is

inconsistent with the behavior of `devlink_nl_rate_parent_node_set`,

where the parent pointer is correctly cleared.

This patch fixes the issue by explicitly setting `devlink_rate->parent`

to NULL after notifying the driver, thus fulfilling the function's

documented behavior for all rate objects.

[1]

repro steps:

echo 1 > /sys/bus/netdevsim/new_device

devlink dev eswitch set netdevsim/netdevsim1 mode switchdev

echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs

devlink port function rate add netdevsim/netdevsim1/test_node

devlink port function rate set netdevsim/netdevsim1/128 parent test_node

echo 1 > /sys/bus/netdevsim/del_device

dmesg:

refcount_t: decrement hit 0; leaking memory.

WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0

CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014

RIP: 0010:refcount_warn_saturate+0x42/0xe0

Call Trace:

<TASK>

devl_rate_leaf_destroy+0x8d/0x90

__nsim_dev_port_del+0x6c/0x70 [netdevsim]

nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]

nsim_drv_remove+0x2b/0xb0 [netdevsim]

device_release_driver_internal+0x194/0x1f0

bus_remove_device+0xc6/0x130

device_del+0x159/0x3c0

device_unregister+0x1a/0x60

del_device_store+0x111/0x170 [netdevsim]

kernfs_fop_write_iter+0x12e/0x1e0

vfs_write+0x215/0x3d0

ksys_write+0x5f/0xd0

do_syscall_64+0x55/0x10f0

entry_SYSCALL_64_after_hwframe+0x4b/0x53

[2]

devlink dev eswitch set pci/0000:08:00.0 mode switchdev

devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000

devlink port function rate add pci/0000:08:00.0/group1

devlink port function rate set pci/0000:08:00.0/32768 parent group1

modprobe -r mlx5_ib mlx5_fwctl mlx5_core

dmesg:

refcount_t: decrement hit 0; leaking memory.

WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0

CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014

RIP: 0010:refcount_warn_saturate+0x42/0xe0

Call Trace:

<TASK>

devl_rate_leaf_destroy+0x8d/0x90

mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]

mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]

mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]

mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]

notifier_call_chain+0x33/0xa0

blocking_notifier_call_chain+0x3b/0x50

mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]

mlx5_eswitch_disable+0x63/0x90 [mlx5_core]

mlx5_unload+0x1d/0x170 [mlx5_core]

mlx5_uninit_one+0xa2/0x130 [mlx5_core]

remove_one+0x78/0xd0 [mlx5_core]

pci_device_remove+0x39/0xa0

device_release_driver_internal+0x194/0x1f0

unbind_store+0x99/0xa0

kernfs_fop_write_iter+0x12e/0x1e0

vfs_write+0x215/0x3d0

ksys_write+0x5f/0xd0

do_syscall_64+0x53/0x1f0

entry_SYSCALL_64_after_hwframe+0x4b/0x53