Re: [PATCH v2 08/17] net: psp: add socket security association code

On Wed, Jun 25, 2025 at 6:52 AM Daniel Zahka [off-list ref] wrote:

From: Jakub Kicinski <kuba@kernel.org>

Add the ability to install PSP Rx and Tx crypto keys on TCP
connections. Netlink ops are provided for both operations.
Rx side combines allocating a new Rx key and installing it
on the socket. Theoretically these are separate actions,
but in practice they will always be used one after the
other. We can add distinct "alloc" and "install" ops later.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
Co-developed-by: Daniel Zahka <daniel.zahka@gmail.com>
---
+/**
+ * psp_assoc_put() - release a reference on a PSP association
+ * @pas: association to release
+ */
+void psp_assoc_put(struct psp_assoc *pas)
+{
+       if (pas && refcount_dec_and_test(&pas->refcnt))
+               call_rcu(&pas->rcu, psp_assoc_free_queue);
+}
+
+void psp_sk_assoc_free(struct sock *sk)
+{
+       rcu_read_lock();

This is a writer side.

rcu_read_lock() here is wrong, and only silences lockdep.

Use instead rcu_dereference_protected(sk->psp_assoc,
whatever_assert_making_sure_we_are_under_some_protection_against_another_writer);

The condition can be 1 if we are in a sk dismantle point, otherwise
lockdep_sock_is_held(sk) is often used.

+       psp_assoc_put(rcu_dereference(sk->psp_assoc));
+       rcu_assign_pointer(sk->psp_assoc, NULL);
+       rcu_read_unlock();
+}