[PATCH net v5 0/4] net: devmem: fix RX and TX binding teardown on device unregistration

[Mina Almasry]

Fix two device-unregistration lifecycle bugs in devmem TCP bindings and
add netdevsim support plus selftests covering both RX and TX device
unregistration. These issues were found via LLM-assisted code review
(Sashiko) and reproduced and verified with the new nl_netdev.py
selftests on netdevsim (not tested on real hardware):

1. net: devmem: unmap dma_buf synchronously on queue uninstall
   Synchronously unmap and detach binding->attachment under binding->lock
   when the last RX queue is uninstalled in mp_dmabuf_devmem_uninstall()
   or closed in net_devmem_unbind_dmabuf(), and unmap remaining unbound RX
   bindings on NETDEV_UNREGISTER, preventing slab-use-after-free in
   dma_unmap_sg_attrs() when the binding is freed after dma_dev. Factor
   out net_devmem_lock_dev() and net_devmem_unlock_dev() to synchronize
   netdev_nl_sock_priv_destroy() and __net_devmem_dmabuf_binding_free()
   against NETDEV_UNREGISTER.

2. net: devmem: detach TX bindings on NETDEV_UNREGISTER
   Extend net_devmem_dev_unregister() to fully detach and unmap TX
   bindings when binding->dev unregisters, or clear binding->vdev alone
   when only a virtual device unregisters while binding->dev lives.

3. netdevsim: support devmem RX and TX bindings
   Enable PP_FLAG_DMA_MAP | PP_FLAG_ALLOW_UNREADABLE_NETMEM, 64-bit DMA mask
   on nsim_bus_dev, and NETMEM_TX_DMA on netdevsim so devmem RX/TX bindings
   can be exercised in software selftests.

4. selftests: net: add devmem RX and TX netdev unregister tests
   Add devmem_bind_rx_unregister_check and devmem_bind_tx_unregister_check
   to tools/testing/selftests/net/nl_netdev.py.

Cc: Tariq Toukan <tariqt@xxxxxxxxxx>
Cc: Kaifeng Wang <kaifengw@xxxxxxxxxx>
Cc: Dragos Tatulea <dtatulea@xxxxxxxxxx>
Cc: Stanislav Fomichev <sdf@xxxxxxxxxxx>

---
v5:
- Rebase onto net after the net-next merge and state how the issues were
  discovered and tested (Jakub).
- 1/4: Inline net_devmem_dev_unregister_rx() into
  net_devmem_dev_unregister() (Stanislav). Factor out
  net_devmem_lock_dev() and net_devmem_unlock_dev() and clear binding->dev
  after unmapping and re-acquiring the xarray lock so
  __net_devmem_dmabuf_binding_free() cannot free the binding while
  net_devmem_dev_unregister() is still accessing it, and reject RX devmem
  net_iovs in validate_xmit_unreadable_skb() (Sashiko).
- 2/4: Inline the TX unregistration check into net_devmem_dev_unregister()
  (Stanislav), clear binding->vdev under the xarray lock, and lock
  binding->dev in __net_devmem_dmabuf_binding_free() for TX bindings as
  well (Sashiko).
- 3/4: Configure the DMA mask and dma_parms in nsim_bus_probe() gated on
  dma_pci_p2pdma_supported(), require PP_DMA_INDEX_BITS before setting
  PP_FLAG_DMA_MAP, check for NULL ns->rq in nsim_pp_hold_write(), and drop
  unreadable or net_iov skbs at the start of nsim_start_xmit() (Sashiko).
- 4/4: Tolerate non-UTF-8 dma-buf names in debugfs bufinfo (Sashiko).
- Link to v4: https://lore.kernel.org/netdev/20261015163915.1166043-1-almasrymina@xxxxxxxxxx/

v4:
- 1/4: Unmap RX bindings in net_devmem_unbind_dmabuf() once their queues
  are closed, and make netif_mp_close_rxq() report queue restart
  failures, so the NETDEV_UNREGISTER walk only handles bindings whose
  queue failed to restart. Drop net_devmem_lock: walk the bindings under
  the xarray lock and take the instance lock of binding->dev in the
  final free. (Stanislav) Record a queue in bound_rxqs before opening
  it. (Sashiko)
- 2/4: Detach and unmap TX bindings directly from the walk, without a
  grace period or a second pass. (Stanislav)
- Link to v3: https://lore.kernel.org/netdev/20261014161754.3782346-1-almasrymina@xxxxxxxxxx/

v3:
- 1/4: Run the NETDEV_UNREGISTER walk under the netdev instance lock,
  and skip it when the device only moves to another netns. (Sashiko)
- 2/4: Detach all matching TX bindings, then synchronize_net() once
  before unmapping them. (Sashiko)
- 3/4: Only request page pool DMA mapping with CONFIG_HAS_DMA, refuse
  pp_hold on memory provider pools, and drop unreadable skbs in the
  software PSP checksum path. (Sashiko)
- 4/4: Check only the test's dma-buf in debugfs, skip instead of passing
  silently, clean up on errors, compute UDMABUF_CREATE per arch, and
  add the needed config options. (Sashiko, Dragos)
- Link to v2: https://lore.kernel.org/netdev/20261012174300.2338784-1-almasrymina@xxxxxxxxxx/

v2:
- 1/4: Don't unmap when a leased queue is unleased. Keep bindings in
  net_devmem_dmabuf_bindings until freed, hidden from TX lookups by an
  xarray mark, and unmap unbound RX bindings on NETDEV_UNREGISTER. Update
  the binding->lock and binding->ref comments. (Sashiko)
- 2/4: Detach TX bindings from the same net_devmem_lock-protected walk,
  which now also covers unbound TX bindings, and clear the LIVE mark
  instead of erasing the ID. The walk no longer uses RCU or takes
  binding references (Stanislav).
- Link to v1: https://lore.kernel.org/netdev/20261010025532.839559-1-almasrymina@xxxxxxxxxx/

Mina Almasry (4):
  net: devmem: unmap dma_buf synchronously on queue uninstall
  net: devmem: detach TX bindings on NETDEV_UNREGISTER
  netdevsim: support devmem RX and TX bindings
  selftests: net: add devmem RX and TX netdev unregister tests

 drivers/net/netdevsim/bus.c              |   9 ++
 drivers/net/netdevsim/netdev.c           |  33 ++++-
 drivers/net/netdevsim/netdevsim.h        |   1 +
 include/net/page_pool/memory_provider.h  |   4 +-
 net/core/dev.c                           |   4 +-
 net/core/devmem.c                        | 181 +++++++++++++++++++----
 net/core/devmem.h                        |  37 ++++-
 net/core/netdev-genl.c                   |  16 +-
 net/core/netdev_rx_queue.c               |  26 ++--
 tools/testing/selftests/net/config       |   4 +
 tools/testing/selftests/net/nl_netdev.py | 125 +++++++++++++++-
 11 files changed, 373 insertions(+), 67 deletions(-)


base-commit: 5838f10563d58afca6711edb5e4eda968ca181d9
-- 
2.56.0.385.gac671c819a-goog