[PATCH net 0/3] netdevsim: psp: fix init and uninit bugs

[PATCH net 0/3] netdevsim: psp: fix init and uninit bugs

[Daniel Zahka]

This series has three fixes. The first is a straightforward NULL
pointer dereference that is reachable by creating and destroying some
vfs on a kernel with INET_PSP enabled.

The last two patches deal with nsim_psp_rereg_write(), which is a
debugfs handler that reregisters netdevsim's psp_dev without
aquiescing and disabling tx/rx processing. This was added to enable
some tests in psp.py where a psp device is unregistered while it still
referenced by tcp socket state.

There are two issues with this code:
1. Calls to nsim_psp_uninit() are not properly serialized
2. netdevsim's psp_dev refcount can be released while nsim_do_psp() is
   reading from it.

Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
---
Daniel Zahka (3):
      netdevsim: psp: only call nsim_psp_uninit() on PFs
      netdevsim: psp: serialize calls to nsim_psp_uninit()
      netdevsim: psp: rcu protect psp_dev reference

 drivers/net/netdevsim/netdev.c    |  3 +-
 drivers/net/netdevsim/netdevsim.h |  4 ++-
 drivers/net/netdevsim/psp.c       | 65 +++++++++++++++++++++++++++------------
 3 files changed, 51 insertions(+), 21 deletions(-)
---
base-commit: 07d99587396024932e02474c3a5bede71d108454
change-id: 20260504-psd-rcu-aea28e0e2c14

Best regards,
-- 
Daniel Zahka <daniel.zahka@gmail.com>

[PATCH net 1/3] netdevsim: psp: only call nsim_psp_uninit() on PFs

[Daniel Zahka]

VFs go through nsim_init_netdevsim_vf() which never calls
nsim_psp_init(), so ns->psp.dev stays NULL. nsim_psp_uninit() guards
with !IS_ERR(ns->psp.dev), so destroying a VF reaches
psp_dev_unregister(NULL) and dereferences NULL on the first
mutex_lock(&psd->lock):

  BUG: kernel NULL pointer dereference, address: 0000000000000020
  RIP: 0010:mutex_lock+0x1c/0x30
  Call Trace:
   psp_dev_unregister+0x2a/0x1a0
   nsim_psp_uninit+0x1f/0x40 [netdevsim]
   nsim_destroy+0x61/0x1e0 [netdevsim]
   __nsim_dev_port_del+0x47/0x90 [netdevsim]
   nsim_drv_configure_vfs+0xc9/0x130 [netdevsim]
   nsim_bus_dev_numvfs_store+0x79/0xb0 [netdevsim]

Gate nsim_psp_uninit() on nsim_dev_port_is_pf(), matching the pattern
already used for nsim_exit_netdevsim() and the bpf/ipsec/macsec/queue
teardowns.

Reproducer:
  modprobe netdevsim
  echo "10 1" > /sys/bus/netdevsim/new_device
  echo 1 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs
  devlink dev eswitch set netdevsim/netdevsim10 mode switchdev
  echo 0 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs

Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
---
 drivers/net/netdevsim/netdev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index a05af192caf3..a750768912b5 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -1182,7 +1182,8 @@ void nsim_destroy(struct netdevsim *ns)
 		unregister_netdevice_notifier_dev_net(ns->netdev, &ns->nb,
 						      &ns->nn);
 
-	nsim_psp_uninit(ns);
+	if (nsim_dev_port_is_pf(ns->nsim_dev_port))
+		nsim_psp_uninit(ns);
 
 	rtnl_lock();
 	peer = rtnl_dereference(ns->peer);

-- 
2.52.0

[PATCH net 2/3] netdevsim: psp: serialize calls to nsim_psp_uninit()

[Daniel Zahka]

The debugfs write handler, nsim_psp_rereg_write(), can race against
nsim_destroy() and against itself, causing nsim_psp_uninit() to run
more than once concurrently. Two complementary changes serialize all
callers:

1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before
   doing the actual teardown. debugfs_remove() drains any in-flight
   writers and prevents new ones from starting.

2. Add a mutex around the body of nsim_psp_rereg_write() so that two
   concurrent userspace writers cannot both enter the teardown path
   at once.

The teardown work itself is moved into a new __nsim_psp_uninit() that
the rereg handler calls under the mutex, while the public
nsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy()
pair so nsim_destroy() doesn't have to know about the psp internals.

Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
---
 drivers/net/netdevsim/netdevsim.h |  2 ++
 drivers/net/netdevsim/psp.c       | 17 ++++++++++++++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 7e129dddbbe7..e373ffc26b0c 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -121,6 +121,8 @@ struct netdevsim {
 		u64_stats_t tx_bytes;
 		struct u64_stats_sync syncp;
 		struct psp_dev *dev;
+		struct dentry *rereg;
+		struct mutex rereg_lock;
 		u32 spi;
 		u32 assoc_cnt;
 	} psp;
diff --git a/drivers/net/netdevsim/psp.c b/drivers/net/netdevsim/psp.c
index 0b4d717253b0..86d84b7e566b 100644
--- a/drivers/net/netdevsim/psp.c
+++ b/drivers/net/netdevsim/psp.c
@@ -209,13 +209,20 @@ static struct psp_dev_caps nsim_psp_caps = {
 	.assoc_drv_spc = sizeof(void *),
 };
 
-void nsim_psp_uninit(struct netdevsim *ns)
+static void __nsim_psp_uninit(struct netdevsim *ns)
 {
 	if (!IS_ERR(ns->psp.dev))
 		psp_dev_unregister(ns->psp.dev);
 	WARN_ON(ns->psp.assoc_cnt);
 }
 
+void nsim_psp_uninit(struct netdevsim *ns)
+{
+	debugfs_remove(ns->psp.rereg);
+	mutex_destroy(&ns->psp.rereg_lock);
+	__nsim_psp_uninit(ns);
+}
+
 static ssize_t
 nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
 		     loff_t *ppos)
@@ -223,11 +230,13 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
 	struct netdevsim *ns = file->private_data;
 	int err;
 
-	nsim_psp_uninit(ns);
+	mutex_lock(&ns->psp.rereg_lock);
+	__nsim_psp_uninit(ns);
 
 	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
 				     &nsim_psp_caps, ns);
 	err = PTR_ERR_OR_ZERO(ns->psp.dev);
+	mutex_unlock(&ns->psp.rereg_lock);
 	return err ?: count;
 }
 
@@ -249,6 +258,8 @@ int nsim_psp_init(struct netdevsim *ns)
 	if (err)
 		return err;
 
-	debugfs_create_file("psp_rereg", 0200, ddir, ns, &nsim_psp_rereg_fops);
+	mutex_init(&ns->psp.rereg_lock);
+	ns->psp.rereg = debugfs_create_file("psp_rereg", 0200, ddir, ns,
+					    &nsim_psp_rereg_fops);
 	return 0;
 }

-- 
2.52.0

[PATCH net 3/3] netdevsim: psp: rcu protect psp_dev reference

[Daniel Zahka]

There are two issues with the way psp_dev is used in nsim_do_psp():

1. There is no check for IS_ERR() on the peers psp_dev, before
   dereferencing.
2. The refcount on this psp_dev can be dropped by
   nsim_psp_rereg_write()

To fix this, we can make netdevsim's reference to its psp_dev an rcu
reference, and then nsim_do_psp() can read the fields it needs from an
rcu critical section.

Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
---
 drivers/net/netdevsim/netdevsim.h |  2 +-
 drivers/net/netdevsim/psp.c       | 54 +++++++++++++++++++++++++--------------
 2 files changed, 36 insertions(+), 20 deletions(-)

diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index e373ffc26b0c..d909c4160ea1 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -120,7 +120,7 @@ struct netdevsim {
 		u64_stats_t tx_packets;
 		u64_stats_t tx_bytes;
 		struct u64_stats_sync syncp;
-		struct psp_dev *dev;
+		struct psp_dev __rcu *dev;
 		struct dentry *rereg;
 		struct mutex rereg_lock;
 		u32 spi;
diff --git a/drivers/net/netdevsim/psp.c b/drivers/net/netdevsim/psp.c
index 86d84b7e566b..6936ecb8173e 100644
--- a/drivers/net/netdevsim/psp.c
+++ b/drivers/net/netdevsim/psp.c
@@ -19,6 +19,7 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
 	    struct netdevsim *peer_ns, struct skb_ext **psp_ext)
 {
 	enum skb_drop_reason rc = 0;
+	struct psp_dev *peer_psd;
 	struct psp_assoc *pas;
 	struct net *net;
 	void **ptr;
@@ -48,7 +49,8 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
 	}
 
 	/* Now pretend we just received this frame */
-	if (peer_ns->psp.dev->config.versions & (1 << pas->version)) {
+	peer_psd = rcu_dereference(peer_ns->psp.dev);
+	if (peer_psd && peer_psd->config.versions & (1 << pas->version)) {
 		bool strip_icv = false;
 		u8 generation;
 
@@ -61,8 +63,7 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
 
 		skb_ext_reset(skb);
 		skb->mac_len = ETH_HLEN;
-		if (psp_dev_rcv(skb, peer_ns->psp.dev->id, generation,
-				strip_icv)) {
+		if (psp_dev_rcv(skb, peer_psd->id, generation, strip_icv)) {
 			rc = SKB_DROP_REASON_PSP_OUTPUT;
 			goto out_unlock;
 		}
@@ -209,10 +210,18 @@ static struct psp_dev_caps nsim_psp_caps = {
 	.assoc_drv_spc = sizeof(void *),
 };
 
-static void __nsim_psp_uninit(struct netdevsim *ns)
+static void __nsim_psp_uninit(struct netdevsim *ns, bool teardown)
 {
-	if (!IS_ERR(ns->psp.dev))
-		psp_dev_unregister(ns->psp.dev);
+	struct psp_dev *psd;
+
+	psd = rcu_dereference_protected(ns->psp.dev,
+					teardown ||
+					lockdep_is_held(&ns->psp.rereg_lock));
+	if (psd) {
+		rcu_assign_pointer(ns->psp.dev, NULL);
+		synchronize_rcu();
+		psp_dev_unregister(psd);
+	}
 	WARN_ON(ns->psp.assoc_cnt);
 }
 
@@ -220,7 +229,7 @@ void nsim_psp_uninit(struct netdevsim *ns)
 {
 	debugfs_remove(ns->psp.rereg);
 	mutex_destroy(&ns->psp.rereg_lock);
-	__nsim_psp_uninit(ns);
+	__nsim_psp_uninit(ns, true);
 }
 
 static ssize_t
@@ -228,16 +237,23 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
 		     loff_t *ppos)
 {
 	struct netdevsim *ns = file->private_data;
-	int err;
+	struct psp_dev *psd;
+	ssize_t ret;
 
 	mutex_lock(&ns->psp.rereg_lock);
-	__nsim_psp_uninit(ns);
+	__nsim_psp_uninit(ns, false);
+
+	psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);
+	if (IS_ERR(psd)) {
+		ret = PTR_ERR(psd);
+		goto out;
+	}
 
-	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
-				     &nsim_psp_caps, ns);
-	err = PTR_ERR_OR_ZERO(ns->psp.dev);
+	rcu_assign_pointer(ns->psp.dev, psd);
+	ret = count;
+out:
 	mutex_unlock(&ns->psp.rereg_lock);
-	return err ?: count;
+	return ret;
 }
 
 static const struct file_operations nsim_psp_rereg_fops = {
@@ -250,13 +266,13 @@ static const struct file_operations nsim_psp_rereg_fops = {
 int nsim_psp_init(struct netdevsim *ns)
 {
 	struct dentry *ddir = ns->nsim_dev_port->ddir;
-	int err;
+	struct psp_dev *psd;
+
+	psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);
+	if (IS_ERR(psd))
+		return PTR_ERR(psd);
 
-	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
-				     &nsim_psp_caps, ns);
-	err = PTR_ERR_OR_ZERO(ns->psp.dev);
-	if (err)
-		return err;
+	rcu_assign_pointer(ns->psp.dev, psd);
 
 	mutex_init(&ns->psp.rereg_lock);
 	ns->psp.rereg = debugfs_create_file("psp_rereg", 0200, ddir, ns,

-- 
2.52.0

Re: [PATCH net 1/3] netdevsim: psp: only call nsim_psp_uninit() on PFs

[Willem de Bruijn]

Daniel Zahka wrote:
> VFs go through nsim_init_netdevsim_vf() which never calls
> nsim_psp_init(), so ns->psp.dev stays NULL. nsim_psp_uninit() guards
> with !IS_ERR(ns->psp.dev), so destroying a VF reaches
> psp_dev_unregister(NULL) and dereferences NULL on the first
> mutex_lock(&psd->lock):
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000020
>   RIP: 0010:mutex_lock+0x1c/0x30
>   Call Trace:
>    psp_dev_unregister+0x2a/0x1a0
>    nsim_psp_uninit+0x1f/0x40 [netdevsim]
>    nsim_destroy+0x61/0x1e0 [netdevsim]
>    __nsim_dev_port_del+0x47/0x90 [netdevsim]
>    nsim_drv_configure_vfs+0xc9/0x130 [netdevsim]
>    nsim_bus_dev_numvfs_store+0x79/0xb0 [netdevsim]
> 
> Gate nsim_psp_uninit() on nsim_dev_port_is_pf(), matching the pattern
> already used for nsim_exit_netdevsim() and the bpf/ipsec/macsec/queue
> teardowns.
> 
> Reproducer:
>   modprobe netdevsim
>   echo "10 1" > /sys/bus/netdevsim/new_device
>   echo 1 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs
>   devlink dev eswitch set netdevsim/netdevsim10 mode switchdev
>   echo 0 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs
> 
> Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net 2/3] netdevsim: psp: serialize calls to nsim_psp_uninit()

[Willem de Bruijn]

Daniel Zahka wrote:
> The debugfs write handler, nsim_psp_rereg_write(), can race against
> nsim_destroy() and against itself, causing nsim_psp_uninit() to run
> more than once concurrently. Two complementary changes serialize all
> callers:

nit: sounds and looks as if this would be simpler as two patches.
but no need to respin just for that.

> 
> 1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before
>    doing the actual teardown. debugfs_remove() drains any in-flight
>    writers and prevents new ones from starting.
> 
> 2. Add a mutex around the body of nsim_psp_rereg_write() so that two
>    concurrent userspace writers cannot both enter the teardown path
>    at once.
> 
> The teardown work itself is moved into a new __nsim_psp_uninit() that
> the rereg handler calls under the mutex, while the public
> nsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy()
> pair so nsim_destroy() doesn't have to know about the psp internals.
> 
> Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net 3/3] netdevsim: psp: rcu protect psp_dev reference

[Willem de Bruijn]

Daniel Zahka wrote:
> There are two issues with the way psp_dev is used in nsim_do_psp():
> 
> 1. There is no check for IS_ERR() on the peers psp_dev, before
>    dereferencing.
> 2. The refcount on this psp_dev can be dropped by
>    nsim_psp_rereg_write()
> 
> To fix this, we can make netdevsim's reference to its psp_dev an rcu
> reference, and then nsim_do_psp() can read the fields it needs from an
> rcu critical section.
> 
> Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>

>  static ssize_t
> @@ -228,16 +237,23 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
>  		     loff_t *ppos)
>  {
>  	struct netdevsim *ns = file->private_data;
> -	int err;
> +	struct psp_dev *psd;
> +	ssize_t ret;
>  
>  	mutex_lock(&ns->psp.rereg_lock);
> -	__nsim_psp_uninit(ns);
> +	__nsim_psp_uninit(ns, false);
> +
> +	psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);
> +	if (IS_ERR(psd)) {
> +		ret = PTR_ERR(psd);
> +		goto out;
> +	}

Do you want to create the new device first and only delete the old
state if that succeeds? To avoid a netdevsim in state without dev.

>  
> -	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
> -				     &nsim_psp_caps, ns);
> -	err = PTR_ERR_OR_ZERO(ns->psp.dev);
> +	rcu_assign_pointer(ns->psp.dev, psd);
> +	ret = count;
> +out:
>  	mutex_unlock(&ns->psp.rereg_lock);
> -	return err ?: count;
> +	return ret;
>  }
>  

Re: [PATCH net 3/3] netdevsim: psp: rcu protect psp_dev reference

[Daniel Zahka]

On 5/6/26 3:34 PM, Willem de Bruijn wrote:
> Daniel Zahka wrote
>>   static ssize_t
>> @@ -228,16 +237,23 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
>>   		     loff_t *ppos)
>>   {
>>   	struct netdevsim *ns = file->private_data;
>> -	int err;
>> +	struct psp_dev *psd;
>> +	ssize_t ret;
>>   
>>   	mutex_lock(&ns->psp.rereg_lock);
>> -	__nsim_psp_uninit(ns);
>> +	__nsim_psp_uninit(ns, false);
>> +
>> +	psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);
>> +	if (IS_ERR(psd)) {
>> +		ret = PTR_ERR(psd);
>> +		goto out;
>> +	}
> Do you want to create the new device first and only delete the old
> state if that succeeds? To avoid a netdevsim in state without dev.
>
>>   
>> -	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
>> -				     &nsim_psp_caps, ns);
>> -	err = PTR_ERR_OR_ZERO(ns->psp.dev);
>> +	rcu_assign_pointer(ns->psp.dev, psd);
>> +	ret = count;
>> +out:
>>   	mutex_unlock(&ns->psp.rereg_lock);
>> -	return err ?: count;
>> +	return ret;
>>   }
>>   

Unfortunately, the way we have psp_dev_unregister() written, it would 
clear out the main_netdev->psp_dev field from the second 
psp_dev_create() call. I don't believe there is use case to do this in a 
real driver, so I'm not sure we need to change how the create/unregister 
paths work.

Re: [PATCH net 3/3] netdevsim: psp: rcu protect psp_dev reference

[Willem de Bruijn]

Daniel Zahka wrote:
> 
> On 5/6/26 3:34 PM, Willem de Bruijn wrote:
> > Daniel Zahka wrote
> >>   static ssize_t
> >> @@ -228,16 +237,23 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
> >>   		     loff_t *ppos)
> >>   {
> >>   	struct netdevsim *ns = file->private_data;
> >> -	int err;
> >> +	struct psp_dev *psd;
> >> +	ssize_t ret;
> >>   
> >>   	mutex_lock(&ns->psp.rereg_lock);
> >> -	__nsim_psp_uninit(ns);
> >> +	__nsim_psp_uninit(ns, false);
> >> +
> >> +	psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);
> >> +	if (IS_ERR(psd)) {
> >> +		ret = PTR_ERR(psd);
> >> +		goto out;
> >> +	}
> > Do you want to create the new device first and only delete the old
> > state if that succeeds? To avoid a netdevsim in state without dev.
> >
> >>   
> >> -	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
> >> -				     &nsim_psp_caps, ns);
> >> -	err = PTR_ERR_OR_ZERO(ns->psp.dev);
> >> +	rcu_assign_pointer(ns->psp.dev, psd);
> >> +	ret = count;
> >> +out:
> >>   	mutex_unlock(&ns->psp.rereg_lock);
> >> -	return err ?: count;
> >> +	return ret;
> >>   }
> >>   
> 
> Unfortunately, the way we have psp_dev_unregister() written, it would 
> clear out the main_netdev->psp_dev field from the second 
> psp_dev_create() call. I don't believe there is use case to do this in a 
> real driver, so I'm not sure we need to change how the create/unregister 
> paths work.

Thanks for that context.

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net 0/3] netdevsim: psp: fix init and uninit bugs

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 05 May 2026 03:42:22 -0700 you wrote:
> This series has three fixes. The first is a straightforward NULL
> pointer dereference that is reachable by creating and destroying some
> vfs on a kernel with INET_PSP enabled.
> 
> The last two patches deal with nsim_psp_rereg_write(), which is a
> debugfs handler that reregisters netdevsim's psp_dev without
> aquiescing and disabling tx/rx processing. This was added to enable
> some tests in psp.py where a psp device is unregistered while it still
> referenced by tcp socket state.
> 
> [...]

Here is the summary with links:
  - [net,1/3] netdevsim: psp: only call nsim_psp_uninit() on PFs
    https://git.kernel.org/netdev/net/c/7ce3f1bedaac
  - [net,2/3] netdevsim: psp: serialize calls to nsim_psp_uninit()
    https://git.kernel.org/netdev/net/c/24c96a42006e
  - [net,3/3] netdevsim: psp: rcu protect psp_dev reference
    https://git.kernel.org/netdev/net/c/07bdec3fc737

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html