[PATCH net-next] ppp: update channel locking comment and doc

[PATCH net-next] ppp: update channel locking comment and doc

[Qingfang Deng]

Commit ec4215683e47 ("ppp: defer channel free to an RCU grace period to
fix pppol2tp RX UAF") defers freeing generic channel state to an RCU
grace period via call_rcu().

Update the SMP locking notes comment in include/linux/ppp_channel.h and
Documentation/networking/ppp_generic.rst to reflect that in-flight RCU
readers can complete safely after ppp_unregister_channel().

Reported by Sashiko.

Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
 Documentation/networking/ppp_generic.rst | 11 +++++------
 include/linux/ppp_channel.h              | 10 +++++-----
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/Documentation/networking/ppp_generic.rst b/Documentation/networking/ppp_generic.rst
index 5a10abce5964..4c81a0c64fe0 100644
--- a/Documentation/networking/ppp_generic.rst
+++ b/Documentation/networking/ppp_generic.rst
@@ -213,11 +213,6 @@ The generic layer requires these guarantees from the channel:
   ppp_register_channel() is called until after the call to
   ppp_unregister_channel() returns.
 
-* No thread may be in a call to any of ppp_input(), ppp_input_error(),
-  ppp_output_wakeup(), ppp_channel_index() or ppp_unit_number() for a
-  channel at the time that ppp_unregister_channel() is called for that
-  channel.
-
 * ppp_register_channel() and ppp_unregister_channel() must be called
   from process context, not interrupt or softirq/BH context.
 
@@ -233,6 +228,10 @@ The generic layer requires these guarantees from the channel:
 
 The generic layer provides these guarantees to the channels:
 
+* The generic layer defers freeing the generic channel state to an
+  RCU grace period in ppp_unregister_channel(), allowing in-flight RCU
+  readers to complete safely.
+
 * The generic layer will not call the start_xmit() function for a
   channel while any thread is already executing in that function for
   that channel.
@@ -453,4 +452,4 @@ an interface unit are:
   fragments is disabled.  This ioctl is only available if the
   CONFIG_PPP_MULTILINK option is selected.
 
-Last modified: 7-feb-2002
+Last modified: 7-aug-2026
diff --git a/include/linux/ppp_channel.h b/include/linux/ppp_channel.h
index 2f63e9a6cc88..7332e32a448d 100644
--- a/include/linux/ppp_channel.h
+++ b/include/linux/ppp_channel.h
@@ -79,11 +79,11 @@ extern char *ppp_dev_name(struct ppp_channel *);
 
 /*
  * SMP locking notes:
- * The channel code must ensure that when it calls ppp_unregister_channel,
- * nothing is executing in any of the procedures above, for that
- * channel.  The generic layer will ensure that nothing is executing
- * in the start_xmit and ioctl routines for the channel by the time
- * that ppp_unregister_channel returns.
+ * ppp_unregister_channel() defers freeing the generic channel state to an
+ * RCU grace period, allowing in-flight RCU readers to complete safely.
+ * The generic layer also ensures that no calls to the channel's start_xmit
+ * or ioctl routines are in progress by the time ppp_unregister_channel()
+ * returns.
  */
 
 #endif /* __KERNEL__ */
-- 
2.43.0