Commit 24c96a42 authored by Daniel Zahka's avatar Daniel Zahka Committed by Jakub Kicinski
Browse files

netdevsim: psp: serialize calls to nsim_psp_uninit() 



The debugfs write handler, nsim_psp_rereg_write(), can race against
nsim_destroy() and against itself, causing nsim_psp_uninit() to run
more than once concurrently. Two complementary changes serialize all
callers:

1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before
   doing the actual teardown. debugfs_remove() drains any in-flight
   writers and prevents new ones from starting.

2. Add a mutex around the body of nsim_psp_rereg_write() so that two
   concurrent userspace writers cannot both enter the teardown path
   at once.

The teardown work itself is moved into a new __nsim_psp_uninit() that
the rereg handler calls under the mutex, while the public
nsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy()
pair so nsim_destroy() doesn't have to know about the psp internals.

Fixes: f857478d ("netdevsim: a basic test PSP implementation")
Signed-off-by: default avatarDaniel Zahka <daniel.zahka@gmail.com>
Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260505-psd-rcu-v1-2-a8f69ec1ab96@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 7ce3f1be

drivers/net/netdevsim/netdevsim.h

+2 −0
Original line number Diff line number Diff line
@@ -121,6 +121,8 @@ struct netdevsim { 
		u64_stats_t tx_bytes;

		struct u64_stats_sync syncp;

		struct psp_dev *dev;

		struct dentry *rereg;

		struct mutex rereg_lock;

		u32 spi;

		u32 assoc_cnt;

	} psp;

drivers/net/netdevsim/psp.c

+14 −3
Original line number Diff line number Diff line
@@ -209,13 +209,20 @@ static struct psp_dev_caps nsim_psp_caps = { 
	.assoc_drv_spc = sizeof(void *),

};



void nsim_psp_uninit(struct netdevsim *ns)

static void __nsim_psp_uninit(struct netdevsim *ns)

{

	if (!IS_ERR(ns->psp.dev))

		psp_dev_unregister(ns->psp.dev);

	WARN_ON(ns->psp.assoc_cnt);

}



void nsim_psp_uninit(struct netdevsim *ns)

{

	debugfs_remove(ns->psp.rereg);

	mutex_destroy(&ns->psp.rereg_lock);

	__nsim_psp_uninit(ns);

}



static ssize_t

nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,

		     loff_t *ppos)
@@ -223,11 +230,13 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count, 
	struct netdevsim *ns = file->private_data;

	int err;



	nsim_psp_uninit(ns);

	mutex_lock(&ns->psp.rereg_lock);

	__nsim_psp_uninit(ns);



	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,

				     &nsim_psp_caps, ns);

	err = PTR_ERR_OR_ZERO(ns->psp.dev);

	mutex_unlock(&ns->psp.rereg_lock);

	return err ?: count;

}
@@ -249,6 +258,8 @@ int nsim_psp_init(struct netdevsim *ns) 
	if (err)

		return err;



	debugfs_create_file("psp_rereg", 0200, ddir, ns, &nsim_psp_rereg_fops);

	mutex_init(&ns->psp.rereg_lock);

	ns->psp.rereg = debugfs_create_file("psp_rereg", 0200, ddir, ns,

					    &nsim_psp_rereg_fops);

	return 0;

}