netdevsim: psp: serialize calls to nsim_psp_uninit()

The debugfs write handler, nsim_psp_rereg_write(), can race against
nsim_destroy() and against itself, causing nsim_psp_uninit() to run
more than once concurrently. Two complementary changes serialize all
callers:

1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before
   doing the actual teardown. debugfs_remove() drains any in-flight
   writers and prevents new ones from starting.

2. Add a mutex around the body of nsim_psp_rereg_write() so that two
   concurrent userspace writers cannot both enter the teardown path
   at once.

The teardown work itself is moved into a new __nsim_psp_uninit() that
the rereg handler calls under the mutex, while the public
nsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy()
pair so nsim_destroy() doesn't have to know about the psp internals.

Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260505-psd-rcu-v1-2-a8f69ec1ab96@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 7e129dddbbe7f97974f04b1e7164e7a7163d89ed..e373ffc26b0c0f6992acf73edceb2d63c3bf24dc 100644 (file)
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -121,6 +121,8 @@ struct netdevsim {
                u64_stats_t tx_bytes;
                struct u64_stats_sync syncp;
                struct psp_dev *dev;
+               struct dentry *rereg;
+               struct mutex rereg_lock;
                u32 spi;
                u32 assoc_cnt;
        } psp;

diff --git a/drivers/net/netdevsim/psp.c b/drivers/net/netdevsim/psp.c
index 0b4d717253b08036904beba7b228c6137f610e89..86d84b7e566b28795b51ca493605b62afa864a16 100644 (file)
--- a/drivers/net/netdevsim/psp.c
+++ b/drivers/net/netdevsim/psp.c
@@ -209,13 +209,20 @@ static struct psp_dev_caps nsim_psp_caps = {
        .assoc_drv_spc = sizeof(void *),
 };
 
-void nsim_psp_uninit(struct netdevsim *ns)
+static void __nsim_psp_uninit(struct netdevsim *ns)
 {
        if (!IS_ERR(ns->psp.dev))
                psp_dev_unregister(ns->psp.dev);
        WARN_ON(ns->psp.assoc_cnt);
 }
 
+void nsim_psp_uninit(struct netdevsim *ns)
+{
+       debugfs_remove(ns->psp.rereg);
+       mutex_destroy(&ns->psp.rereg_lock);
+       __nsim_psp_uninit(ns);
+}
+
 static ssize_t
 nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
                     loff_t *ppos)
@@ -223,11 +230,13 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
        struct netdevsim *ns = file->private_data;
        int err;
 
-       nsim_psp_uninit(ns);
+       mutex_lock(&ns->psp.rereg_lock);
+       __nsim_psp_uninit(ns);
 
        ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
                                     &nsim_psp_caps, ns);
        err = PTR_ERR_OR_ZERO(ns->psp.dev);
+       mutex_unlock(&ns->psp.rereg_lock);
        return err ?: count;
 }
 
@@ -249,6 +258,8 @@ int nsim_psp_init(struct netdevsim *ns)
        if (err)
                return err;
 
-       debugfs_create_file("psp_rereg", 0200, ddir, ns, &nsim_psp_rereg_fops);
+       mutex_init(&ns->psp.rereg_lock);
+       ns->psp.rereg = debugfs_create_file("psp_rereg", 0200, ddir, ns,
+                                           &nsim_psp_rereg_fops);
        return 0;
 }