Re: [PATCH net v2] psp: fix NULL genl_sock deref race with concurrent netns teardown

[Wei Wang]

On Tue, Jul 7, 2026 at 12:00 PM Kiran Kella <kiran.kella@xxxxxxxxxxxx> wrote:
>
> >
> The race occurs between network namespace removal and PSP device
> unregistration.  When a netns is deleted while a PSP device associated
> with that netns is concurrently being removed, psp_dev_unregister()
> triggers psp_nl_notify_dev() to send a device change notification.
> Concurrently, cleanup_net() running in the netns workqueue calls
> genl_pernet_exit(), which sets net->genl_sock to NULL. If
> genl_pernet_exit() wins the race, two sites in psp_nl_multicast_per_ns()
> then dereference the NULL socket and crash:
>
> CPU 0 (netns teardown)       CPU 1 (PSP device unregister)
> ======================       =============================
> cleanup_net [workqueue]
>   genl_pernet_exit()         psp_dev_unregister()
>     net->genl_sock = NULL      psp_nl_notify_dev()
>                                  psp_nl_multicast_per_ns()
>                                    build_ntf()
>                                      -> netlink_has_listeners(NULL)
>                                      /* crash */
>                                    genlmsg_multicast_netns()
>                                      -> nlmsg_multicast_filtered(NULL)
>                                      /* crash */
>
> Both the main_net path (derived from psd->main_netdev) and each
> assoc_net entry in psd->assoc_dev_list are affected.
>
> Fix by replacing the bare dev_net() calls with maybe_get_net().
> maybe_get_net() returns NULL if the namespace is already dying.
> Holding the reference ensures genl_sock remains valid across both the
> build_ntf() and genlmsg_multicast_netns() calls.
>
> Fixes: 00c94ca2b99e ("psp: base PSP device support")
> Fixes: 06c2dce2d0f6 ("psp: add new netlink cmd for dev-assoc and dev-disassoc")
> Reviewed-by: Ajit Khaparde <ajit.khaparde@xxxxxxxxxxxx>
> Reviewed-by: Vikas Gupta <vikas.gupta@xxxxxxxxxxxx>
> Reviewed-by: Bhargava Marreddy <bhargava.marreddy@xxxxxxxxxxxx>
> Reviewed-by: Akhilesh Samineni <akhilesh.samineni@xxxxxxxxxxxx>
> Reviewed-by: Daniel Zahka <daniel.zahka@xxxxxxxxxxxx>
> Tested-by: Daniel Zahka <daniel.zahka@xxxxxxxxxxxx>
> Signed-off-by: Kiran Kella <kiran.kella@xxxxxxxxxxxx>
> ---
> v2:
>  - get rid of the extra struct net *net, by doing
> (!maybe_get_net(assoc_net)) directly (as suggested by Daniel Zahka)
>
> v1: https://lore.kernel.org/all/20260703112431.2860506-1-kiran.kella@xxxxxxxxxxxx/
>

LGTM! Thanks for the fix!
Reviewed-by: Wei Wang <weibunny@xxxxxx>

>  net/psp/psp_nl.c | 23 ++++++++++++++---------
>  1 file changed, 14 insertions(+), 9 deletions(-)
>
> diff --git a/net/psp/psp_nl.c b/net/psp/psp_nl.c
> index 9610d8c456ff..1438dbb07949 100644
> --- a/net/psp/psp_nl.c
> +++ b/net/psp/psp_nl.c
> @@ -62,7 +62,10 @@ psp_nl_multicast_per_ns(struct psp_dev *psd, unsigned int group,
>         struct net *main_net;
>         struct sk_buff *ntf;
>
> -       main_net = dev_net(psd->main_netdev);
> +       main_net = maybe_get_net(dev_net(psd->main_netdev));
> +       if (!main_net)
> +               return;
> +
>         xa_init(&sent_nets);
>
>         list_for_each_entry(entry, &psd->assoc_dev_list, dev_list) {
> @@ -77,21 +80,23 @@ psp_nl_multicast_per_ns(struct psp_dev *psd, unsigned int group,
>                 if (ret == -EBUSY)
>                         continue;
>
> -               ntf = build_ntf(psd, assoc_net, ctx);
> -               if (!ntf)
> +               if (!maybe_get_net(assoc_net))
>                         continue;
>
> -               genlmsg_multicast_netns(&psp_nl_family, assoc_net, ntf, 0,
> -                                       group, GFP_KERNEL);
> +               ntf = build_ntf(psd, assoc_net, ctx);
> +               if (ntf)
> +                       genlmsg_multicast_netns(&psp_nl_family, assoc_net, ntf,
> +                                               0, group, GFP_KERNEL);
> +               put_net(assoc_net);
>         }
>         xa_destroy(&sent_nets);
>
>         /* Send to main device netns */
>         ntf = build_ntf(psd, main_net, ctx);
> -       if (!ntf)
> -               return;
> -       genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group,
> -                               GFP_KERNEL);
> +       if (ntf)
> +               genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group,
> +                                       GFP_KERNEL);
> +       put_net(main_net);
>  }
>
>  static struct sk_buff *psp_nl_clone_ntf(struct psp_dev *psd, struct net *net,
> --
> 2.54.0
>