Re: [PATCH v2 08/17] net: psp: add socket security association code

Eric Dumazet
2025-06-26T03:32:09Z

On Wed, Jun 25, 2025 at 6:52 AM Daniel Zahka <daniel.zahka@gmail.com> wrote:
>
> From: Jakub Kicinski <kuba@kernel.org>
>
> Add the ability to install PSP Rx and Tx crypto keys on TCP
> connections. Netlink ops are provided for both operations.
> Rx side combines allocating a new Rx key and installing it
> on the socket. Theoretically these are separate actions,
> but in practice they will always be used one after the
> other. We can add distinct "alloc" and "install" ops later.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
> Co-developed-by: Daniel Zahka <daniel.zahka@gmail.com>
> ---
> +/**
> + * psp_assoc_put() - release a reference on a PSP association
> + * @pas: association to release
> + */
> +void psp_assoc_put(struct psp_assoc *pas)
> +{
> + if (pas && refcount_dec_and_test(&pas->refcnt))
> + call_rcu(&pas->rcu, psp_assoc_free_queue);
> +}
> +
> +void psp_sk_assoc_free(struct sock *sk)
> +{
> + rcu_read_lock();

This is a writer side.

rcu_read_lock() here is wrong, and only silences lockdep.

Use instead rcu_dereference_protected(sk->psp_assoc,
whatever_assert_making_sure_we_are_under_some_protection_against_another_writer);

The condition can be 1 if we are in a sk dismantle point, otherwise
lockdep_sock_is_held(sk) is often used.

> + psp_assoc_put(rcu_dereference(sk->psp_assoc));
> + rcu_assign_pointer(sk->psp_assoc, NULL);
> + rcu_read_unlock();
> +}