From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f177.google.com (mail-qt1-f177.google.com [209.85.160.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A98B29D268 for ; Mon, 6 Jul 2026 13:46:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783345603; cv=none; b=RV8ZVRUJD+aq6yQVutv0bV1zOkxoMlM9icPkaI/IurztLoDZEelCFGPQBJJPdWRyxSaPP05CAcZc8pNCDG8cuWlAtB3g/6UgoO6orqy8QUavvTTkM61MKfeHkxivB3/cVB+6VkbDx7LVuALd5dxr1hK33syCJm8hLblk+VZPMbg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783345603; c=relaxed/simple; bh=TUmRlO+AbpgAfi9o5IOSVpzcEDMF68wOS3eK2ACYgWo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=LMCEElaPZPPRblP7h/5YPL1PDA0q419ILnofGuR4KhAx1qN6bJFAzMykgGuysGKQBtmOKTVMY1/hVTSqO+axm2sb+bDU44NLMyqvjbugEswDv/c1XrtfLyMINSpCDOB904wzX1bF2UTRe2e8HBzQjQEXd6C/qYZXJZws3YeyMjI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=F4dt0qQZ; arc=none smtp.client-ip=209.85.160.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="F4dt0qQZ" Received: by mail-qt1-f177.google.com with SMTP id d75a77b69052e-51c0c68aa31so18179071cf.3 for ; Mon, 06 Jul 2026 06:46:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783345601; x=1783950401; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=ZCa1Sw7nmZcTObya2YqeINBUf27MeVq0Ha0ay3otiUE=; b=F4dt0qQZx6AzySqFZX8pYqxXei4yPUN9ZIy52RJNkM4fOxb1tgzKztTxNXEhGeSNG+ MLF7ctKv7TybHQA5lCdqbYU9kg/5M6ZgkAmzTF1sEAuCEYdQ5wyryngj2pIhOsg5lkxu oOhQRq7N4dyx3gff4PjWzVYBDEv2aAvm0UNBKtttOrPaFdgg00vrIuAks2gHt26mSxue tjNv5T29ccVyEOYhjTmTomdHzOu8orZQmtObZDTg8tOstAGpyVRfTNitF2NNyITqEIRM /vw9o04Mt5scULTFnra4DqaDbVA6t364uH8OS4dteO5/hLuX+xK9R1LJ2GPAXOC2LSln rY+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783345601; x=1783950401; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ZCa1Sw7nmZcTObya2YqeINBUf27MeVq0Ha0ay3otiUE=; b=nLI28wGyo07yvyc+w1Uya29LMUSTc8RJFzvR5gfTJTF9hK2xgjySOJUsFzX2VJ4mml frOyGcYVvi5+JjEXIDLdbIQT93HSMW6u2EpzIIAcHZzHGb1f3kNRqNUxi1XnOhoX0ihm Dd3CeuPUyjhYEpe2N1mUCkHjn2OESso5v21q4DMLs2gwHG8xkcLVL1seJNPhRYHvj2xf EmQj2MhFACUDgtz00X54DrBIcmicQX3MWeOwM+Y+yYtJTl+Qr0RKkci5N0roEf/XHV2p wWzXnn2YS+Xpj/HmYvKVNNePFLha2fNb9G4tpJI7u9prcYhXpSHnMU5J1C9cqmC/llbZ WD3Q== X-Forwarded-Encrypted: i=1; AHgh+RrCxhJYXDGXNEXfrWxjaHsDVQ8mS3Zl5zz/0eD/nvT1yO9+PWiZjg5tqVcN9JfJ1ff+gFALKRae4lfipvM=@vger.kernel.org X-Gm-Message-State: AOJu0YxZoUon+2Tno8851tc1gCz3VIWDjMdn1DblUC2N+9ej7oilAS1T LIvCEFZrNqTrcR3wIoyUYd0gEj/8cfPupjfgZ+jRGLYXaglOm64bOrUU X-Gm-Gg: AfdE7cl/8WG98PQBjaf0SXAiCI6ZdmGaFbn3124UDAwTYQEs/6SIg13K6AVsLWBCpPa jMp9rA71FInuwvrQFUOO0Ma2fgzmrbVDY4QEeZiMV1pvBIhR96g/t6oaJON6SKDfHVH/hbFm28J GL3K4x3fS364udjCzRu7NAltBSRtsWq5t/cjhcYpdwXqI1BF0wFXrsOX86VcftvRzis5O26XWMt mtKNCqXY+/tN/1Nb2yBtjzZCFYbIrB6X92yHITcMKSUpWwskJI8Z0Qly7ZHXO/OIKC4yj8frBRo 4zIZmuJjAopUkbZeyyFvguEzZUdTIUBQzXsVoF1A+EkzaFhyHLGu1VW1sR7qj1EP+GvLFs0vkDq RIbKccfS6y7stnDdA5cmGTcsrS6WvsToj6L+B+hh04WnGpHS75nNg9chlE0Lz4u18fzlLfOZKll /CJMMSBMSMO/vyPG5e8GfbBcf7XA== X-Received: by 2002:ac8:5953:0:b0:51c:167d:b345 with SMTP id d75a77b69052e-51c747a1330mr6801971cf.24.1783345601043; Mon, 06 Jul 2026 06:46:41 -0700 (PDT) Received: from ?IPV6:2620:10d:c0a8:11c9::1088? ([2620:10d:c091:400::5:30c]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51c41d2cf18sm98895181cf.14.2026.07.06.06.46.40 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 06 Jul 2026 06:46:40 -0700 (PDT) Message-ID: Date: Mon, 6 Jul 2026 09:46:39 -0400 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net] psp: fix NULL genl_sock deref race with concurrent netns teardown To: Kiran Kella , kuba@kernel.org, willemdebruijn.kernel@gmail.com Cc: davem@davemloft.net, edumazet@google.com, pabeni@redhat.com, horms@kernel.org, weibunny@fb.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, jayakrishnan.udayavarma@broadcom.com, ajit.khaparde@broadcom.com, akhilesh.samineni@broadcom.com, Vikas Gupta , Bhargava Marreddy References: <20260703112431.2860506-1-kiran.kella@broadcom.com> Content-Language: en-US From: Daniel Zahka In-Reply-To: <20260703112431.2860506-1-kiran.kella@broadcom.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 7/3/26 7:24 AM, Kiran Kella wrote: > The race occurs between network namespace removal and PSP device > unregistration. When a netns is deleted while a PSP device associated > with that netns is concurrently being removed, psp_dev_unregister() > triggers psp_nl_notify_dev() to send a device change notification. > Concurrently, cleanup_net() running in the netns workqueue calls > genl_pernet_exit(), which sets net->genl_sock to NULL. If > genl_pernet_exit() wins the race, two sites in psp_nl_multicast_per_ns() > then dereference the NULL socket and crash: > > CPU 0 (netns teardown) CPU 1 (PSP device unregister) > ====================== ============================= > cleanup_net [workqueue] > genl_pernet_exit() psp_dev_unregister() > net->genl_sock = NULL psp_nl_notify_dev() > psp_nl_multicast_per_ns() > build_ntf() > -> netlink_has_listeners(NULL) > /* crash */ > genlmsg_multicast_netns() > -> nlmsg_multicast_filtered(NULL) > /* crash */ > > Both the main_net path (derived from psd->main_netdev) and each > assoc_net entry in psd->assoc_dev_list are affected. > > Fix by replacing the bare dev_net() calls with maybe_get_net(). > maybe_get_net() returns NULL if the namespace is already dying. > Holding the reference ensures genl_sock remains valid across both the > build_ntf() and genlmsg_multicast_netns() calls. > > Fixes: 00c94ca2b99e ("psp: base PSP device support") > Fixes: 06c2dce2d0f6 ("psp: add new netlink cmd for dev-assoc and dev-disassoc") > Signed-off-by: Kiran Kella > Reviewed-by: Ajit Khaparde > Reviewed-by: Vikas Gupta > Reviewed-by: Bhargava Marreddy Thanks. I was able to repro myself by inserting a delay after the old: main_net = dev_net(psd->main_netdev); and then executing nsim_psp_rereg_write() in parallel with destroying the netns that I placed a netdevsim dev into. Tested-by: Daniel Zahka Reviewed-by: Daniel Zahka > --- > net/psp/psp_nl.c | 33 +++++++++++++++++++++------------ > 1 file changed, 21 insertions(+), 12 deletions(-) > > diff --git a/net/psp/psp_nl.c b/net/psp/psp_nl.c > index 9610d8c456ff..24ab626a9e8a 100644 > --- a/net/psp/psp_nl.c > +++ b/net/psp/psp_nl.c > @@ -62,36 +62,45 @@ psp_nl_multicast_per_ns(struct psp_dev *psd, unsigned int group, > struct net *main_net; > struct sk_buff *ntf; > > - main_net = dev_net(psd->main_netdev); > + main_net = maybe_get_net(dev_net(psd->main_netdev)); > + if (!main_net) > + return; > + > xa_init(&sent_nets); > > list_for_each_entry(entry, &psd->assoc_dev_list, dev_list) { > struct net *assoc_net = dev_net(entry->assoc_dev); > + struct net *net; > int ret; > > if (net_eq(assoc_net, main_net)) > continue; > > - ret = xa_insert(&sent_nets, (unsigned long)assoc_net, assoc_net, > - GFP_KERNEL); > - if (ret == -EBUSY) > + net = maybe_get_net(assoc_net); > + if (!net) > continue; > > - ntf = build_ntf(psd, assoc_net, ctx); > - if (!ntf) > + ret = xa_insert(&sent_nets, (unsigned long)assoc_net, assoc_net, > + GFP_KERNEL); > + if (ret == -EBUSY) { > + put_net(net); > continue; > + } > > - genlmsg_multicast_netns(&psp_nl_family, assoc_net, ntf, 0, > - group, GFP_KERNEL); > + ntf = build_ntf(psd, net, ctx); > + if (ntf) > + genlmsg_multicast_netns(&psp_nl_family, net, ntf, 0, > + group, GFP_KERNEL); > + put_net(net); > } some optional nits if you wanted to respin: You could eliminate the extra struct net *net, by just doing something like if (!maybe_get_net(assoc_net)) directly. You could get away with a single put_net(net); call site, if you reorder the ops that could fail so that maybe_get_net(assoc_net) happens last before the build_ntf(psd, net, ctx) > xa_destroy(&sent_nets); > > /* Send to main device netns */ > ntf = build_ntf(psd, main_net, ctx); > - if (!ntf) > - return; > - genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group, > - GFP_KERNEL); > + if (ntf) > + genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group, > + GFP_KERNEL); > + put_net(main_net); > } > > static struct sk_buff *psp_nl_clone_ntf(struct psp_dev *psd, struct net *net,