[PATCH net 0/3] netdevsim: psp: fix init and uninit bugs

Daniel Zahka
2026-05-05T10:42:27Z

This series has three fixes. The first is a straightforward NULL
pointer dereference that is reachable by creating and destroying some
vfs on a kernel with INET_PSP enabled.

The last two patches deal with nsim_psp_rereg_write(), which is a
debugfs handler that reregisters netdevsim's psp_dev without
aquiescing and disabling tx/rx processing. This was added to enable
some tests in psp.py where a psp device is unregistered while it still
referenced by tcp socket state.

There are two issues with this code:
1. Calls to nsim_psp_uninit() are not properly serialized
2. netdevsim's psp_dev refcount can be released while nsim_do_psp() is
reading from it.

Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
---
Daniel Zahka (3):
netdevsim: psp: only call nsim_psp_uninit() on PFs
netdevsim: psp: serialize calls to nsim_psp_uninit()
netdevsim: psp: rcu protect psp_dev reference

drivers/net/netdevsim/netdev.c | 3 +-
drivers/net/netdevsim/netdevsim.h | 4 ++-
drivers/net/netdevsim/psp.c | 65 +++++++++++++++++++++++++++------------
3 files changed, 51 insertions(+), 21 deletions(-)
---
base-commit: 07d99587396024932e02474c3a5bede71d108454
change-id: 20260504-psd-rcu-aea28e0e2c14

Best regards,
--
Daniel Zahka <daniel.zahka@gmail.com>