Re: [PATCH net] psp: fix NULL genl_sock deref race with concurrent netns teardown

[Kiran Kella]

On Mon, Jul 6, 2026 at 7:16 PM Daniel Zahka <daniel.zahka@xxxxxxxxx> wrote:
>
>
> On 7/3/26 7:24 AM, Kiran Kella wrote:
> > The race occurs between network namespace removal and PSP device
> > unregistration.  When a netns is deleted while a PSP device associated
> > with that netns is concurrently being removed, psp_dev_unregister()

>
>
> Thanks. I was able to repro myself by inserting a delay after the old:
>
> main_net = dev_net(psd->main_netdev);
>
> and then executing nsim_psp_rereg_write() in parallel with destroying
> the netns that I placed a netdevsim dev into.
>
> Tested-by: Daniel Zahka <daniel.zahka@xxxxxxxxx>
>
> Reviewed-by: Daniel Zahka <daniel.zahka@xxxxxxxxx>

Thanks Daniel for reviewing and validating the fix.

>
> > ---
> >   net/psp/psp_nl.c | 33 +++++++++++++++++++++------------
> >   1 file changed, 21 insertions(+), 12 deletions(-)

> > +             ntf = build_ntf(psd, net, ctx);
> > +             if (ntf)
> > +                     genlmsg_multicast_netns(&psp_nl_family, net, ntf, 0,
> > +                                             group, GFP_KERNEL);
> > +             put_net(net);
> >       }
>
> some optional nits if you wanted to respin:
>
> You could eliminate the extra struct net *net, by just doing something
> like if (!maybe_get_net(assoc_net)) directly.
>
> You could get away with a single put_net(net); call site, if you reorder
> the ops that could fail so that maybe_get_net(assoc_net) happens last
> before the build_ntf(psd, net, ctx)
>

ACK. Will fix in v2.
Thanks,
Kiran

> >       xa_destroy(&sent_nets);
> >

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature