On Sun, Oct 30, 2022 at 03:29:19PM +0100, Dmitry Vyukov wrote:

The current virtual nci driver is great for testing and fuzzing.
But it allows to create at most one "global" device which does not allow
to run parallel tests and harms fuzzing isolation and reproducibility.
Restructure the driver to allow creation of multiple independent devices.
This should be backwards compatible for existing tests.

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Bongsu Jeon <bongsu.jeon@samsung.com>
Cc: Krzysztof Kozlowski <redacted>
Cc: netdev@vger.kernel.org
---
 drivers/nfc/virtual_ncidev.c | 143 ++++++++++++++++-------------------
 1 file changed, 66 insertions(+), 77 deletions(-)

<...>

 static int virtual_nci_send(struct nci_dev *ndev, struct sk_buff *skb)
 {
-	mutex_lock(&nci_mutex);
-	if (state != virtual_ncidev_enabled) {
-		mutex_unlock(&nci_mutex);
-		kfree_skb(skb);
-		return 0;
-	}
+	struct virtual_nci_dev *vdev = nci_get_drvdata(ndev);
 
-	if (send_buff) {
-		mutex_unlock(&nci_mutex);
+	mutex_lock(&vdev->mtx);
+	if (vdev->send_buff) {
+		mutex_unlock(&vdev->mtx);
 		kfree_skb(skb);

You probably need to set vdev->send_buff to NULL here.

 		return -1;
 	}
-	send_buff = skb_copy(skb, GFP_KERNEL);
-	mutex_unlock(&nci_mutex);
-	wake_up_interruptible(&wq);
+	vdev->send_buff = skb_copy(skb, GFP_KERNEL);

You don't check return value of skb_copy(), it can fail, but
this function will return 0 (success). Do you do it deliberately?

If yes, please add a comment to the code, as it is not clear.

Thanks

+	mutex_unlock(&vdev->mtx);
+	wake_up_interruptible(&vdev->wq);
 	consume_skb(skb);
 
 	return 0;